Skip to main content

RapidIdentity Integration

Manage1to1 integrates directly with RapidIdentity using its OneRoster API (OAuth 2.0) to synchronize buildings, students, and staff automatically.

Once enabled, RapidIdentity becomes the source of record for roster data in Manage1to1, eliminating manual CSV imports and keeping your roster synchronized daily.

Permission Required

To configure RapidIdentity integration, you need the Manage Settings permission assigned to your role.

Understanding RapidIdentity Integration​

Think of RapidIdentity OneRoster integration as a direct, secure connection between RapidIdentity and Manage1to1. Roster data flows automatically, so you no longer export and import CSV files by hand.

What RapidIdentity integration does:

  • Imports buildings directly from RapidIdentity
  • Synchronizes students and staff automatically
  • Eliminates manual CSV exports and imports
  • Keeps Manage1to1 aligned with RapidIdentity daily

Why use RapidIdentity OneRoster:

  • Direct integration - A native connection to your roster source
  • OAuth security - Secure authentication using industry standards
  • Automated - A daily sync keeps data current without manual effort
  • Reliable - OneRoster is a proven standard for roster exchange

Overview​

RapidIdentity publishes roster data through a OneRoster API secured with OAuth 2.0. Manage1to1 connects to this API to consume roster data and keep your district aligned automatically.

How it works:

RapidIdentity → OneRoster API → Manage1to1

When this integration is enabled:

  • Buildings are sourced from RapidIdentity
  • Students and staff are synchronized automatically
  • Manual CSV-based imports are disabled
  • OneRoster becomes the exclusive roster source

Important Notes​

Before enabling OneRoster:

  • When OneRoster is enabled, Manage1to1 relies on RapidIdentity for buildings and user roster data
  • If you enable OneRoster after Manage1to1 is already in use, confirm the RapidIdentity school building sourcedId values align with the building identifiers already stored in Manage1to1 (commonly the SIS value used in Building Management)
  • A one-time Building Synchronization is required after connection. Students tied to buildings that do not exist in Manage1to1 are ignored

Building alignment is critical: If building identifiers do not match between RapidIdentity and Manage1to1, students will not import correctly. Review building SIS IDs in Manage1to1 before enabling integration.

What You'll Need from RapidIdentity​

When configuring RapidIdentity as your OneRoster provider, Manage1to1 needs a small set of values from the OneRoster client configured in RapidIdentity. Your RapidIdentity administrator can provide these, and the Jamf RapidIdentity documentation covers where to find them.

Choose OAuth 2.0 in RapidIdentity

RapidIdentity can secure a OneRoster connection with either OAuth 2.0 or the older OAuth 1.0. Manage1to1 uses OAuth 2.0 (OneRoster 1.1 with OAuth 2.0). When you create the connection in RapidIdentity, select the OAuth 2.0 option and use the Client ID and Client Secret it issues, not an OAuth 1.0 Consumer Key.

Base URL​

The Base URL is your district's RapidIdentity OneRoster endpoint, sometimes labeled the Roster API URL in RapidIdentity. It tells Manage1to1 where to send all OneRoster requests for buildings, users, and related data.

What it looks like: https://your-tenant.rapididentity.com/ims/oneroster/v1p1

Where to find it: Copy the exact URL from your RapidIdentity rostering configuration. Include the version segment at the end.

Token URL​

The Token URL is where Manage1to1 requests OAuth access tokens. These tokens are required for every OneRoster request and are refreshed automatically during synchronization.

What it looks like: The OAuth 2.0 token endpoint shown with your rostering configuration, commonly your base URL followed by /token/.

Where to find it: Provided with the OneRoster configuration in RapidIdentity.

Client ID​

The OAuth 2.0 Client ID uniquely identifies Manage1to1 as an approved application in RapidIdentity.

What it looks like: An alphanumeric string.

Where to find it: Generated when the OneRoster connection for Manage1to1 is created in RapidIdentity with OAuth 2.0. Use the OAuth 2.0 Client ID, not an OAuth 1.0 Consumer Key.

Important: Copy this value exactly as provided. Do not modify or truncate it.

Client Secret​

The OAuth 2.0 Client Secret is paired with the Client ID and authenticates Manage1to1 when it requests access tokens.

What it looks like: A long alphanumeric string.

Where to find it: Provided with the OAuth 2.0 OneRoster configuration in RapidIdentity.

Security: Treat this value as sensitive. Only an administrator with appropriate access should enter it, and it should never be shared publicly.

OAuth Scope (optional)​

Some roster sources require a specific scope value on the token request. If RapidIdentity provides one for your district, enter it. Leave this blank when a scope is not required.

Once all required values are entered, you can validate connectivity before running building and user synchronization.

Step 1: Create the OneRoster Connection in RapidIdentity​

Work with your RapidIdentity administrator to create a OneRoster connection for Manage1to1 using OneRoster 1.1 with OAuth 2.0, and grant it access to the schools you want to sync. When it is created, record the values Manage1to1 needs.

For the RapidIdentity-side steps, follow the Jamf RapidIdentity documentation.

What to record:

  • Base URL (Roster API URL)
  • Token URL
  • Client ID
  • Client Secret
  • OAuth scope, if your district requires one

Tip: Copy these values to a secure document for reference. You will enter them into Manage1to1 in the next step.

Step 2: Enable RapidIdentity as the OneRoster Provider in Manage1to1​

After the connection exists in RapidIdentity, connect Manage1to1 to it.

Steps:

  1. In Manage1to1, navigate to Settings → Rostering & SIS and find the User Rostering section
  2. Select Configure Provider
  3. Set the Rostering Provider to RapidIdentity
  4. Enter the values from your RapidIdentity OneRoster configuration:
    • Base URL - OneRoster API endpoint (Roster API URL)
    • Token URL - OAuth token endpoint
    • Client ID - Application identifier
    • Client Secret - Authentication secret
    • OAuth Scope - only if your district requires one
  5. Use Test Configuration to confirm connectivity

Test configuration: The test verifies that:

  • The Base URL and Token URL are correct
  • The Client ID and Client Secret are valid
  • Manage1to1 can successfully authenticate with RapidIdentity
  • The OneRoster API is accessible

If the test fails:

  • Verify every value was copied correctly (no extra spaces, no truncation)
  • Confirm the OneRoster client is still active in RapidIdentity
  • Check that school access was granted correctly
  • If RapidIdentity provided a scope value, confirm it was entered
  • Contact Manage1to1 Support if issues persist

Once the configuration test passes, Manage1to1 is ready for OneRoster synchronization.

Step 3: Initial Synchronization​

After the provider is enabled, run the initial synchronization to import buildings and users.

Building Synchronization​

Run the Building Synchronization first (required).

How to run:

  1. In the User Rostering section, click Sync Buildings
  2. Wait for synchronization to complete
  3. Review results to confirm all buildings imported

What this does:

  • Imports buildings from RapidIdentity
  • Creates new buildings in Manage1to1
  • Establishes the foundation for user imports

Important: Building sync must complete successfully before running user sync. Students cannot be imported if their assigned building does not exist in Manage1to1.

User Synchronization​

After buildings are synchronized, run the initial User Synchronization (students and staff).

How to run:

  1. Ensure building sync completed successfully
  2. Click Sync Users in the User Rostering section
  3. Wait for synchronization to complete (may take several minutes)
  4. Review results to confirm students and staff imported

What this does:

  • Imports students from RapidIdentity
  • Imports staff from RapidIdentity
  • Associates users with buildings
  • Creates user accounts in Manage1to1

Step 4: Enable Ongoing Automation​

After the initial synchronization succeeds, enable automated imports to keep data synchronized daily.

How to enable:

  1. Navigate to Settings → System Automation → Automation Settings
  2. Ensure Enable Automatic Student Import is enabled
  3. Ensure Enable Automatic Staff Import is enabled
  4. Verify the Default Daily Automation Time is configured
  5. Save settings

What this does:

  • The OneRoster sync runs automatically at the configured time (for example, 2:00 AM)
  • Student and staff data updates daily
  • New users are created and existing users are updated
  • Changes in RapidIdentity appear in Manage1to1 within 24 hours

Switching Providers​

Moving to or from RapidIdentity is a supported, self-service change. The key is aligning your building identifiers first, so schools are not duplicated. See Switching Your Roster Source for the full walkthrough.

Best Practices​

✅ Do:

  • Verify building alignment before enabling integration
  • Test configuration before running the initial sync
  • Run building sync before user sync
  • Monitor the initial sync to confirm success
  • Enable ongoing automation after a successful initial sync
  • Keep the RapidIdentity OneRoster client active

❌ Don't:

  • Skip building sync and go straight to user sync
  • Change RapidIdentity credentials without updating Manage1to1
  • Disable the OneRoster client in RapidIdentity while integration is active
  • Disable automation without understanding the impact

Common Questions​

Q: Which OneRoster version does RapidIdentity use with Manage1to1? RapidIdentity connects over the OneRoster 1.1 API. Enter your Base URL exactly as RapidIdentity provides it, including the version segment.

Q: What if my RapidIdentity sync fails? Confirm the OneRoster client is still active in RapidIdentity and that the credentials have not changed. Review the sync results for specific messages. Contact Support if the issue persists.

Q: Can I restrict which schools Manage1to1 can access? Yes. Grant the OneRoster client access only to the schools you want to sync when it is created in RapidIdentity. Only those schools will sync to Manage1to1.

Q: How often does RapidIdentity sync with Manage1to1? Daily, at the automation time configured in Automation Settings. You can also trigger a manual sync from the User Rostering section at any time.

Q: Does RapidIdentity OneRoster import guardians? It depends on what your roster source publishes. OneRoster focuses on buildings, students, and staff, and guardian data is often imported separately.

Q: What if my building identifiers in RapidIdentity do not match Manage1to1? Update the building SIS IDs in Manage1to1 to match the RapidIdentity sourcedId values before enabling OneRoster. Use Preview Building Match to see exactly how each school will resolve before anything is saved.

RapidIdentity integration provides automated roster synchronization for districts that use RapidIdentity as their roster source. Proper configuration and building alignment ensure reliable daily data sync with minimal maintenance required.

Last updated on