- \n
- A 探花大神 administrator account<\/li>\n\n\n\n
- 探花大神 SSO Package or higher or SSO \u00e0 la carte option<\/li>\n\n\n\n
- A Workable user account with administrator permissions<\/li>\n\n\n\n
- Your Workable subdomain name<\/a><\/li>\n<\/ul>\n\n\n\n
Important Considerations<\/strong><\/p>\n\n\n\n
- \n
- SSO is not required to use the SCIM integration for provisioning and Identity Management, but it is strongly recommended<\/li>\n\n\n\n
- You can configure 2 different Workable connectors, one for SSO and another for SCIM<\/li>\n\n\n\n
- If you are using JIT, it is not recommended to use SCIM and vice versa<\/li>\n<\/ul>\n\n\n\n
Attribute Considerations<\/strong><\/p>\n\n\n\n
- \n
- A default set of attributes are managed for users. See the Attribute Mappings<\/a> section for more details<\/li>\n\n\n\n
- Only 2 user attributes are required, but it is strongly recommended to additionally use all of the suggested attributes<\/li>\n<\/ul>\n\n\n\n
Creating a new 探花大神 Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the 探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/h2>\n\n\n\n
To configure 探花大神<\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the SSO<\/strong> tab.<\/li>\n\n\n\n
- Replace any instances of YOUR_SUBDOMAIN with your Workable subdomain name.<\/li>\n\n\n\n
- Add or change any attributes.<\/li>\n\n\n\n
- Click Save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the certificate<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nThe certificate.pem will download to your local Downloads<\/strong> folder.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure Workable<\/h3>\n\n\n\n
- \n
- Contact your Account Manager<\/a>, implementation manager, or customer support to initiate the setup process for SSO on your Workable account.<\/li>\n\n\n\n
- Include the following information with your request:\n
- \n
- 探花大神 IDP URL<\/strong><\/li>\n\n\n\n
- 探花大神 IdP Entity ID<\/strong><\/li>\n\n\n\n
- certificate.pem file downloaded in the previous section<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Workable will notify you when the setup is complete.<\/li>\n<\/ol>\n\n\n\n
Using JIT Provisioning<\/strong><\/h2>\n\n\n\n
Additional attributes are required to use JIT provisioning. JIT required attributes are prepopulated and are on by default to enable JIT provisioning. You can\u2019t edit the JIT required service provider attributes. You can customize the 探花大神 attribute name and the constant value for JIT required attributes. Toggle off the attributes to opt out of sending the attributes in the SAML assertion.<\/p>\n\n\n\n
To complete the provisioning process<\/strong><\/h3>\n\n\n\n
- \n
- Authorize a user\u2019s access to the application in 探花大神. <\/li>\n\n\n\n
- Have the user log in to the application using SSO. The SAML assertion passes from 探花大神 to the service provider, and gives the service provider the information it needs to create the user account.<\/li>\n<\/ol>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to 探花大神, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
To learn how to authorize user access from the Groups Configuration<\/strong> panel, see Authorize Users to an SSO Application<\/a>.<\/p>\n\n\n\n
Validating SSO user authentication workflow(s)<\/strong><\/h2>\n\n\n\n
IdP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Access the 探花大神 User Console<\/a><\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- 探花大神 asserts the user’s identity to the SP and is authenticated without the user having to log in to the application<\/li>\n<\/ul>\n\n\n\n
SP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Go\u00a0to the SP application login – generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
This varies by SP.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Login redirects the user to 探花大神 where the user enters their 探花大神 credentials<\/li>\n\n\n\n
- After the user is logged in successfully, they are redirected\u00a0back to the SP and automatically logged in<\/li>\n<\/ul>\n\n\n\n
Configuring the Identity Management Integration<\/h2>\n\n\n\n
To generate a Workable API Access Token<\/h3>\n\n\n\n
- \n
- Log into Workable as an admin.<\/li>\n\n\n\n
- Click your profile icon in the upper right and go to Settings ><\/strong> Integrations > Apps<\/strong> > API<\/strong> Access Tokens<\/strong>. <\/li>\n\n\n\n
- Click the + Generate API token<\/strong> and enter the following:\n
- \n
- Name<\/strong> – enter a name for your token<\/li>\n\n\n\n
- Expires in<\/strong> – select an expiration<\/li>\n\n\n\n
- API scopes<\/strong> – select r_employees<\/kbd><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Click Generate token<\/strong>.<\/li>\n\n\n\n
- Copy the token.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Warning:<\/strong> \nThe Client ID and Secret (token) may only be shown once. Copy them to a secure location, like the 探花大神 Password Manager<\/a>, for future reference.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure 探花大神<\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the Identity Managemen<\/strong>t tab.<\/li>\n\n\n\n
- In the Service Provider (SP) Configuration<\/strong> section, select or enter the following:\n
- \n
- API Type<\/strong> – select Custom API Import<\/strong><\/li>\n\n\n\n
- Authentication method<\/strong> – select Bearer token<\/strong><\/li>\n\n\n\n
- Base URL<\/strong> – https:\/\/<yourworkablesubdomain>.workable.com\/<\/kbd><\/li>\n\n\n\n
- Token Key<\/strong> – paste the token generated in the previous section<\/li>\n\n\n\n
- Resource Location<\/strong> – employees<\/kbd><\/li>\n\n\n\n
- Endpoint path<\/strong> – spi\/v3\/employees<\/kbd><\/li>\n\n\n\n
- Response Parameter Location<\/strong> – Body<\/li>\n\n\n\n
- Response Body JSON Path<\/strong> – totalCount<\/kbd><\/kbd><\/li>\n\n\n\n
- Limit name<\/strong> – limit<\/kbd><\/li>\n\n\n\n
- Offset name<\/strong> – offset<\/kbd><\/li>\n\n\n\n
- Unique ID<\/strong> – id<\/kbd><\/li>\n\n\n\n
- User Status<\/strong> – state<\/kbd><\/li>\n\n\n\n
- Inactive Status Values<\/strong> – inactive<\/kbd><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Click Test Connection<\/strong>. If successful, the attribute mapping table will appear.<\/li>\n\n\n\n
- Complete all required and desired optional mappings.<\/li>\n\n\n\n
- Click Preview Mappings<\/strong> to verify the mappings.<\/li>\n\n\n\n
- If the mappings are correct, click Activate<\/strong> and then Save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Warning:<\/strong> \nYou must click Activate <\/strong>before you click Save <\/strong>or you will lose all of your information.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Attribute Mappings<\/strong><\/h2>\n\n\n\n
The following table lists attributes that 探花大神 sends to the application. See Attribute Considerations<\/a> for more information regarding attribute mapping considerations. <\/p>\n\n\n\n
Learn about 探花大神 Properties and how they work with system users in our API<\/a>. <\/p>\n\n\n\n
\nWorkable User Attributes<\/h3>\n
\n - Authentication method<\/strong> – select Bearer token<\/strong><\/li>\n\n\n\n
- Select the Identity Managemen<\/strong>t tab.<\/li>\n\n\n\n
- Expires in<\/strong> – select an expiration<\/li>\n\n\n\n
- Click the + Generate API token<\/strong> and enter the following:\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Log in to the <\/a>探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- 探花大神 IdP Entity ID<\/strong><\/li>\n\n\n\n
- Include the following information with your request:\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- Select the SSO<\/strong> tab.<\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Only 2 user attributes are required, but it is strongly recommended to additionally use all of the suggested attributes<\/li>\n<\/ul>\n\n\n\n
- A default set of attributes are managed for users. See the Attribute Mappings<\/a> section for more details<\/li>\n\n\n\n