Skip to content
  • There are no suggestions because the search field is empty.

Configure Clever SSO SAML Attributes for Staff/Student Routing

This article explains how to configure SAML attributes in Clever SSO to differentiate staff and students and to provide school/class routing for content and group rules.

Summary

  • Use one or more of these methods supported in Clever SSO: distinct email domains, a released SAML attribute for role, and a school attribute (SchoolID) to identify the school. Provide attribute names and values so DT+ can route users and apply content restrictions.

Configure differentiation between staff and students

  1. Use email domains

    • If staff and students use different email domains, use the domain to separate them (e.g., staff@school.org vs student@schoolstudent.org). No extra SAML attribute is required when domains differ.

  2. Release a role attribute via SAML

    • Release an attribute (example name: role) in the SAML configuration with explicit values for staff and student (e.g., role=staff, role=student).
    • DT+ will use this attribute/value to place users into separate groups and apply different content filters (for example, allow adult-themed content for staff while blocking it for students).

Provide school/class information for routing

  1. School attribute (SchoolID)

    • Release a SchoolID (or equivalent) attribute that contains the value identifying each school. Clever provides a school attribute listing the school of attendance for staff and students; supply those values for routing.
    • DT+ requires the SchoolID values to set up routing and group rules per school.

  2. Additional identifiers

    • If Clever uses fields like student_number or teacher_number, those exist but are not necessarily used as the user-type attribute. Provide the attributes and values DT+ requests for routing.

Steps to prepare for DT+ SSO setup

  1. Decide your primary differentiator:

    • Prefer email-domain separation if staff and students already use different domains.
    • If domains are shared, plan to release a role attribute with staff/student values.

  2. Provide school values:

    • Ensure the SchoolID (or Clever’s school attribute) is released and contains the school identifier values for each user.

  3. Share attribute names and values with DT+:

    • Supply the attribute names and the exact values for staff, students, and each school so DT+ can create group rules and routing.

Use cases

  • Apply content filters: use role attribute or email-domain separation to allow staff access to adult-themed content while blocking it for students.
  • Per-school routing: use SchoolID (school attribute) to route users into the correct school-level group rules.

Conclusion

  • You can differentiate staff and students in Clever SSO by (in order of simplicity) using different email domains or releasing a role attribute with explicit staff/student values. Provide a SchoolID (or Clever’s school attribute) value for each user so DT+ can route accounts by school. Share the exact attribute names and values with DT+ to complete the SAML SSO configuration.