Troubleshoot Blackbaud ID Authentication

For security reasons, a user's session will automatically time out when a user appears to be idle too long.

A Keep Working? prompt will appear a few minutes before the timeout.

• Users who spend longer amounts of time tasks like Pushpage (Newsletter) might accidentally appear to be “idle.”

• If you are impersonating when you time out, you will need to re-impersonate the user when you log back in.

• If you were not on a "full" page when you time out, you will be returned to the neared full page you last loaded when you log back in.

• Some older bridged or Podium pages may not be preserved as you expect if you time out. To test a particular page, bookmark it, then wait for it to timeout, when you log back in, use the bookmark to see if you can get right to that page.

Users must allow third party cookies in their internet browsers.

Alternatively, they must allow an exception for Blackbaud and your school's sites.

If a user doesn't enable third party cookies or white list blackbaud.com or myschoolapp.com, the log in page may appear to "loop" and thus prevent the user from signing in.

Users who log in with Google Single Sign-On (SSO), but haven't yet logged into Google, may be prompted to re-enter their email address for Google login after they enter the email on the school-branded login screen for the Blackbaud Education Management products.

,Blackbaud is aware of this and is working to smooth out this workflow. For now, however, this is how the SAML 2.0 configuration works.

As a workaround, we recommend users sign into Google first.

Also, consider registering Blackbaud Education Management as a custom app at Google for easier access to Google Drive.

If it takes more than two days to verify your claimed domain when you set up Blackbaud ID Single Sign-On (SSO), confirm that your DNS record has been correctly updated with your domain's TXT record value.

If Blackbaud hosts your DNS, you can do this through the DNS Toolbox. https://www.blackbaud.com/files/support/helpfiles/admin/content/auth-email-domains.html

Users who share laptops must be vigilant.

Remember to sign out of all apps between users, especially if you also use Google, Office 365, or another Identity Provider IdP.

If the user

• is a parent at multiple schools that use Blackbaud ID,

• but is not employed by either school,

• and thus neither school controls the email address,

then the parent can use the same email address at multiple schools for their Blackbaud ID.

When the user is invited to the second school, the user's statues in the second school's Core will be "awaiting response." After the account is linked at the second school, the status at the second school will be "registered."

To help the parent , we recommend the school provide these instructions :

1. Go to the school's site https://schoolname.myschoolapp.com.

2. Enter the parent 's email address.

3. Select Next.

4. A confirmation message appears:

   "Your username is being converted to use Blackbaud ID with your email address."

5. Select Continue.

6. The Blackbaud ID login screen appears.

7. If the parent doesn't know their password, use the Forgot Password link to reset it.

If the Sign In page appears, then the user already has a Blackbaud ID account. If the user then attempts to Sign Up, an error appears to indicate "The user already exists."

If a user is

• both a parent and an employee at the same school,

• or is a parent at one school and an employee at a different school,

• and the school controls the employee email address,

• and both schools use Blackbaud ID,

then the individual:

• should use a personal email account for parental access,

• shouldn't reuse their school-issued-employee email for personal purposes,

• should use the employee email only for work purposes.

When your school claims an email domain in the Blackbaud ID Single Sign-On (SSO) configuration, the school controls the Blackbaud ID sign-in page will directs to your Identity Provider IdP to authenticate the user.

If the parent uses the same email for the school where they are employed and the school their child attends , and then the employee departs the school and the school-issued-employee email is disabled, then the individual will lose access to both school sites.

If your school hires a user who already has a Blackbaud ID from their previous employer, then your school should assign a new Blackbaud ID using your school-issued-employee email.

This enables your school to control the employee's access to your school’s data through your own authentication.

If you configure your Blackbaud Authentication settings in Core to require your school domain, the individual won't be able to link an email outside of that domain to their account in your 'Blackbaud's Education Management' products.

When a staff member departs your school, disable the former employee's account on your Identity Provider IdP.

This makes the email address unavailable to the former employee and the account can be completely deactivated in the future.

However, for some situations, you may not want to disable the account, but rather change the password, such as if you need the replacement staff to have ongoing access to the departed user's inbox. This is acceptable as long as the former user did not link any other organizations to the Blackbaud ID account.

See Withdraw Employee.