> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oloid-demo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Security Assertion Markup Language (SAML) SSO with Workday and Oloid

> This document provides step-by-step instructions to configure SAML SSO with Workday and Oloid.

## Introduction

This document provides step-by-step instructions to configure Workday for Single Sign-On (SSO) integration with Oloid. It covers security configuration, creation of an Authentication Selector, setup of an Identity Provider, and SAML configuration required to enable secure user authentication through Oloid.

## Prerequisites

* You must have access to the Workday Admin Access.
* Ensure that the Webkey application is created and configured in the Tenant Admin Portal. For more information, refer. [How to create and configure WebKey Application in Tenant Admin Portal](https://oloid.help/en/articles/8693859-how-to-create-and-configure-webkey-application-in-tenant-admin-portal).
* Ensure that the IDP profile is created and configured in the Tenant Admin Portal. For more information, refer [How to Create IDP Profile for Security Assertion Markup Language (SAML) in the Tenant Admin Portal](https://oloid.help/en/articles/12808717-how-to-create-idp-profile-for-security-assertion-markup-language-saml-in-the-tenant-admin-portal).

## Steps to Configure Workday

* [Configure Workday Security](#configure-workday-security)
* [Create and Configure Authentication Selector](#create-and-configure-authentication-selector)
* [Create Identity Provider in Workday](#create-identity-provider-in-workday)
* [Configure Certificate](#configure-certificate-in-workday)
* [Configure SAML Settings](#configure-saml-settings-in-workday)
* Generate Workday Certificate & Signature (Optional but Recommended)

The Workday is configured successfully.

### Configure Workday Security

1. Log in to the Workday.
   The Welcome screen is displayed.
2. Navigate/Search **Edit Tenant Setup – Security** in the search bar.

   ![Configuring Security Assertion Markup... - screenshot 1](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-64f21563.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=9a29e0c1e5b579fada624844bd7f81d7)

   The Edit Tenant Setup - Security page is displayed.

### Create and Configure Authentication Selector

> [!NOTE]
>
> **Note:** Workday requires an **Authentication Selector** to route users to the appropriate Identity Provider (e.g., Oloid). If one does not already exist, it must be created.

1. Go to **Single Sign-on** section.
2. Click the **➕ (Add Row)** button.

   ![Configuring Security Assertion Markup... - screenshot 2](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-de0a97ff.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=8e9ba4b616255b166319729fa2780edd)

   A new row is added.
3. In the new row, under **Redirect Type**, select **Authentication Selector > Create Authentication Selector.**

   ![Configuring Security Assertion Markup... - screenshot 3](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-cc60aa05.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=aa9e218fced893e187a378b30b9f76bc)

   The **Create Authentication Selector** screen is displayed.
4. Do the following.
   1. Enter **Name**.
   2. Enter **Description** (Optional).
   3. Select and Enter **Login Redirect URL.**
   4. Select and Enter **Mobile App Login Redirect URL**.
   5. Select and Enter **Mobile Browser Login Redirect URL**.

      > [!NOTE]
      >
      > **Note:** Refer below table for the URLs.

**Field**

**Value**

Login Redirect URL

https\://\<**your-environment>**.workday.com/\<**your-tenant-name>**/login-saml2.flex

Mobile App Login Redirect URL

https\://\<**your-environment>**.workday.com/\<**your-tenant-name>**/login-saml2.flex

Mobile Browser Login Redirect URL

https\://\<**your-environment>**.workday.com/\<**your-tenant-name>**/login-saml2.flex

> [!NOTE]
>
> **Note:** Enter your workday environment and your tenant name in the URL.

5. Click **OK**.

![Configuring Security Assertion Markup... - screenshot 4](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-8e00fd28.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=9226947752a0f8357ba60117c6907c1a)

The **Authentication Selector** is created and configured successfully.

6. Go back to **Single Sign-on** section and do the following.

a. Select the newly created selector.

b. Enable **SAML Authentication**.

![Configuring Security Assertion Markup... - screenshot 5](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-4842683e.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=d047874464dc77b6e93a11d7d08857d8)

### Create Identity Provider in Workday

1. Enter **Identity Provider Name.**
2. Enter **Issuer**.

   ![Configuring Security Assertion Markup... - screenshot 6](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-4cafcb4f.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=d6f358fb90758254f7e031e862faaa2e)

   > [!NOTE]
   >
   > **Note:** To navigate the issuer URL, on your **Tenant Admin Portal**, go to **Auth Policy > Identity Provider > Select the preferred IDP > Oloid Metadata**, copy **Entity ID**.

### Configure Certificate in Workday

1. Select **Create x509 Public Key**.

   ![Configuring Security Assertion Markup... - screenshot 7](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-43d30782.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=0c3d4adf8ec89586b0573a1cbbf3b853)

   The **Create x509 Public Key** pop-up is displayed.
2. Do the following.
   1. Upload the **signing certificate**.

      > [!NOTE]
      >
      > **Note:** To download the Certificate, on your **Tenant Admin Portal**, go to **Auth Policy > Identity Provider > Select the preferred IDP > Oloid Metadata**, click **Download Certificate**.

   2. Click **Ok**.

      ![Configuring Security Assertion Markup... - screenshot 8](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-a7a75f98.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=a3e11327f81ec8dcba1bd2b361576bd6)

      The certificate is configured successfully, and the SAML Identity Provider page is displayed.

      ![Configuring Security Assertion Markup... - screenshot 9](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-30590c67.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=fd9d7eb4a51573996a26d91ee65853aa)

### Configure SAML Settings in Workday

1. Go the **SAML Identity Provider** page, scroll right to configure the SAML settings in Workday.

2. Enable **Use Unspecified Name ID Format for Logout Request**.

3. Enable **SP Initiated**.

4. Enable **Do Not Deflate SP-initiated Authentication Request**.

5. Enter **IdP SSO Service URL.**

   > [!NOTE]
   >
   > **Note:** To navigate the IdP SSO Service URL, on your **Tenant Admin Portal**, go to **Auth Policy > Identity Provider > Select the preferred IDP > Oloid Metadata**, copy **Sign-on URL**.

6. Enter **Used for Environments**.

   > [!NOTE]
   >
   > **Note:** You can select Implementation, Sandbox and Production (as required).

7. Click **Ok**.

   ![Configuring Security Assertion Markup... - screenshot 10](https://mintcdn.com/oloid-999c42b2/FA4BPEP_pEAqB4tY/images/intercom/14884360/image-5f8a147c.png?fit=max\&auto=format\&n=FA4BPEP_pEAqB4tY\&q=85\&s=5e631898c267d3c083c5f76b4fa5304d)

   The SAML Settings is configured successfully.
   After configuration, to log in to Workday refer [How to Log in to Workday with Assigned Credentials](https://oloid.help/en/articles/15030169-how-to-log-in-to-workday-with-assigned-credentials)