Configuring Security Assertion Markup Language (SAML) SSO with Workday and Oloid

​

Introduction

This document provides step-by-step instructions to configure Workday for Single Sign-On (SSO) integration with Oloid. It covers security configuration, creation of an Authentication Selector, setup of an Identity Provider, and SAML configuration required to enable secure user authentication through Oloid.

​

Prerequisites

• You must have access to the Workday Admin Access.
• Ensure that the Webkey application is created and configured in the Tenant Admin Portal. For more information, refer. How to create and configure WebKey Application in Tenant Admin Portal.
• Ensure that the IDP profile is created and configured in the Tenant Admin Portal. For more information, refer How to Create IDP Profile for Security Assertion Markup Language (SAML) in the Tenant Admin Portal.

​

Steps to Configure Workday

• Configure Workday Security
• Create and Configure Authentication Selector
• Create Identity Provider in Workday
• Configure Certificate
• Configure SAML Settings
• Generate Workday Certificate & Signature (Optional but Recommended)

The Workday is configured successfully.

​

Configure Workday Security

1. Log in to the Workday. The Welcome screen is displayed.
2. Navigate/Search Edit Tenant Setup – Security in the search bar. The Edit Tenant Setup - Security page is displayed.

​

Create and Configure Authentication Selector

1. Go to Single Sign-on section.
2. Click the ➕ (Add Row) button. A new row is added.
3. In the new row, under Redirect Type, select Authentication Selector > Create Authentication Selector. The Create Authentication Selector screen is displayed.
4. Do the following.
   1. Enter Name.
   2. Enter Description (Optional).
   3. Select and Enter Login Redirect URL.
   4. Select and Enter Mobile App Login Redirect URL.
   5. Select and Enter Mobile Browser Login Redirect URL.
      Note: Refer below table for the URLs.

Field Value Login Redirect URL https://<your-environment>.workday.com/<your-tenant-name>/login-saml2.flex Mobile App Login Redirect URL https://<your-environment>.workday.com/<your-tenant-name>/login-saml2.flex Mobile Browser Login Redirect URL https://<your-environment>.workday.com/<your-tenant-name>/login-saml2.flex

5. Click OK.

The Authentication Selector is created and configured successfully.

6. Go back to Single Sign-on section and do the following.

a. Select the newly created selector. b. Enable SAML Authentication.

​

Create Identity Provider in Workday

1. Enter Identity Provider Name.
2. Enter Issuer.
   Note: To navigate the issuer URL, on your Tenant Admin Portal, go to Auth Policy > Identity Provider > Select the preferred IDP > Oloid Metadata, copy Entity ID.

​

Configure Certificate in Workday

1. Select Create x509 Public Key. The Create x509 Public Key pop-up is displayed.
2. Do the following.
   1. Upload the signing certificate.
      Note: To download the Certificate, on your Tenant Admin Portal, go to Auth Policy > Identity Provider > Select the preferred IDP > Oloid Metadata, click Download Certificate.
   2. Click Ok. The certificate is configured successfully, and the SAML Identity Provider page is displayed.

​

Configure SAML Settings in Workday

1. Go the SAML Identity Provider page, scroll right to configure the SAML settings in Workday.
2. Enable Use Unspecified Name ID Format for Logout Request.
3. Enable SP Initiated.
4. Enable Do Not Deflate SP-initiated Authentication Request.
5. Enter IdP SSO Service URL.
   Note: To navigate the IdP SSO Service URL, on your Tenant Admin Portal, go to Auth Policy > Identity Provider > Select the preferred IDP > Oloid Metadata, copy Sign-on URL.
6. Enter Used for Environments.
   Note: You can select Implementation, Sandbox and Production (as required).
7. Click Ok. The SAML Settings is configured successfully. After configuration, to log in to Workday refer How to Log in to Workday with Assigned Credentials