> For the complete documentation index, see [llms.txt](https://guides.mangoapps.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://guides.mangoapps.com/integrations-guide/single-sign-on/sso-integrations-by-provider/sso-integrations-for-workday/workday-as-an-sso-provider-for-mangoapps.md).

# Workday as an SSO Provider for MangoApps

Workday as an SSO Provider for MangoApps ( SAML Connection)

### Overview

This guide explains how to configure Workday as a SAML-based Single Sign-On (SSO) provider for MangoApps. Using Workday for SSO eases access, improves security, and simplifies login experiences for your organization.

***

### Required Roles

To successfully complete this integration, you will need access to the following roles:

* **MangoApps Admin Credentials:** Required to access and configure the MangoApps SSO settings.
* **Workday Admin Credentials:** Required to set up and manage SAML connections within the Workday interface.

***

### Workday Side Setup

Start by configuring the SAML settings in your Workday environment. This setup allows Workday to act as the identity provider for MangoApps.

**Login to Workday** using your administrator account and search for **Create SAML SSO Link**.

Select it to access the pop-up window. From this window, click the 3-dash menu and click **Create SAML SSO Link**. 

<figure><img src="https://1627138357-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LjKbJ2ssjhlUZRcGOXW%2Fuploads%2F7jWbC12LiiUFNYZyvu60%2F02-06-2025-03-07-27.png?alt=media&amp;token=852925a9-0627-44c5-b4d4-16428de8bcf4" alt="" width="496"><figcaption></figcaption></figure>

This will open the **Create SAML SSO Link** configuration form.

<figure><img src="https://1627138357-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LjKbJ2ssjhlUZRcGOXW%2Fuploads%2FO6BaPbzAUl20dRDOwyqQ%2F02-06-2025-14-57-23a.png?alt=media&amp;token=c06e2bb9-ed2e-4f24-9280-ff3ec229a97d" alt="" width="563"><figcaption></figcaption></figure>

Fill out the form with the following:

* **Name:** Descriptive name for your SSO connection.
* **SAML Version:** 2.0
* **ACS URL:** Copy this URL from the MangoApps Admin Portal (**Admin > SSO > Connections > New SSO Connection**).

<figure><img src="https://1627138357-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LjKbJ2ssjhlUZRcGOXW%2Fuploads%2Fysz5Tf4ZTsVsrzMPg0gy%2F02-06-2025-01-30-52.png?alt=media&amp;token=d5aa1b22-1082-44ab-94bc-f2217a20319e" alt="" width="563"><figcaption></figcaption></figure>

* **Name Identifier:** Select based on your user identification method (Email Address, Employee ID, Username, Workday Identifier).
* **Enable “Use Unspecified Name ID Format”** (recommended).
* **Recipient:** Enter your MangoApps domain URL.
* **Issuer ID:** Use `http://www.workday.com`.
* **Signature Method:** SHA256.
* **Message Signing:** Select **Both Message and Assertion**.

Click **Save**.&#x20;

***

Now, we need to retrieve the metadata for the connection for use in the MangoApps Setup.

Search for **View SAML SSO Link** and select the newly created SSO link.

<figure><img src="https://1627138357-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LjKbJ2ssjhlUZRcGOXW%2Fuploads%2F3zjVAZwPdimznOXhWWQP%2F02-06-2025-03-29-02a.png?alt=media&amp;token=5fa42826-be95-4130-be92-5bb57bafc261" alt="" width="482"><figcaption></figcaption></figure>

Click the **Okay** button. This will bring up the selected link's details screen. Click the **three-dot menu** in the top navigation bar, then choose **SAML SSO Link > Generate Metadata**.

<figure><img src="https://1627138357-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LjKbJ2ssjhlUZRcGOXW%2Fuploads%2F4SrQpWGkkqSRp2RJSFb8%2F02-06-2025-03-33-16.png?alt=media&amp;token=2ffc071c-a7cc-43c9-94dc-cea92abd4871" alt=""><figcaption></figcaption></figure>

**Save the SAML Metadata Descriptor** — information contained here will be used in the MangoApps setup.

This completes the Workday side of the integration.

***

### MangoApps Setup

After setting up Workday, configure MangoApps to recognize Workday as a valid SSO provider.

Log in to **MangoApps Admin Portal**.

Navitgate to **Admin > SSO > Connections** and open the **SAML** tab. Click the **Add SSO Connection** button in the top right of the screen.

<figure><img src="https://1627138357-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LjKbJ2ssjhlUZRcGOXW%2Fuploads%2F423fwv3c9tQARmwRtR3S%2F02-06-2025-01-23-42.png?alt=media&amp;token=6cd59c1d-3df3-41b7-a43f-7c74115df6c5" alt="" width="563"><figcaption></figcaption></figure>

In the provider dropdown, select **Workday**.

<figure><img src="https://1627138357-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LjKbJ2ssjhlUZRcGOXW%2Fuploads%2FEB9IwQ8hTMnJLQ8DNI6r%2F02-06-2025-01-27-00.png?alt=media&amp;token=e71a12c0-743d-46fe-bcf5-32f9b13a596f" alt="" width="563"><figcaption></figcaption></figure>

In the '**Configure Manually**' dropdown, enter the following parameters, all of which can be found in the **SAML Metadata Descriptor** copied from Workday:

* **Issuer URL / Entity ID** (from metadata).
* **X.509 Certificate** (from metadata).
* For the **SAML 2.0 Endpoint**, ente&#x72;**:**\
  `https://impl.wd12.myworkday.com/mangoapps_dpt1/samlsso/autosubmit/<appid>`
  * Replace `<appid>` with the Application ID found in the browser URL after clicking the "Generate Metadata" option in Workday, which displays the Workday SAML metadata details.

<figure><img src="https://1627138357-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LjKbJ2ssjhlUZRcGOXW%2Fuploads%2FRmsbUJblVdsqR43ZYII1%2Fergsertghre.png?alt=media&amp;token=598e4883-01b3-46bb-beb2-60888a9f9f79" alt=""><figcaption></figcaption></figure>

***

### Testing Considerations

Before rolling out SSO to all users:

* Test the connection with a few test accounts from different departments.
* Ensure attributes (e.g., Email, Username) match between MangoApps and Workday.
* Validate correct user mapping and login redirection.
* Confirm that users not present in Workday are denied access (if desired).

***

### Security Considerations

Security is critical when enabling SSO:

* Use SHA256 as the signature method for stronger message integrity.
* Enable both message and assertion signing.
* Regularly rotate your x509 certificate in line with internal IT policies.
* Restrict SSO login access based on IP ranges or conditional access policies, if supported.

***

### End User Experience

Once configured, users can access MangoApps by authenticating through Workday:

* Users will visit your MangoApps login URL.
* Upon selecting the **Workday SSO option**, they are redirected to Workday for authentication.
* After successful login, they are redirected back into the MangoApps platform with secure access.

***

### Rollout Recommendations

For a smooth deployment:

1. **Pilot Group Testing:** Start with a small user group to identify any potential issues.
2. **Communicate:** Send an internal announcement detailing the new login process.
3. **Training:** Provide documentation or video guides on how users can log in via Workday.
4. **Support:** Set up a helpdesk line or internal IT support to assist with login issues during the transition.
5. **Gradual Rollout:** Transition teams in phases before enforcing mandatory SSO.