ÃÛ¶¹ÊÓƵ

Select the method supported by your IDP server for sending authentication information:

• POST
• REDIRECT

Enter the sign-out URL for the IDP server. Workfront sends an HTTP request to this URL before signing out of Workfront. This closes the user's session on the remote server when the Workfront session is closed.

NOTE: You are redirected to the sign-out URL only if you have the option Only Allow SAML 2.0 Authentication enabled in your user profile.

Specify the URL where users will be redirected to change their passwords.

Because the SAML 2.0 credentials are used to access Workfront, users must be redirected to a page where they can change their SAML 2.0 password instead of completing this activity through Workfront.

Select the Secure Hash Algorithm (SHA) that your IDP supports:

• SHA-1
• SHA-256

This option automatically creates a user in the system when a new user with a directory username and password attempts to log in to Workfront for the first time.

To create users in Workfront, you must map Workfront data attributes with the following user data attributes in your directory provider:

• First Name
• Last Name
• Email Address

When you select the check box, the following options display:

Select the Workfront User Attribute that you want to map from the drop-down list, then specify the corresponding Directory Attribute in the user directory.

The Directory Attribute field should contain the Directory Attribute Name from the User Attribute table you saved when successfully testing your SAML 2.0 configuration.

You can set a Default Workfront Value in the Default Value field. You can also set rules based on the values from your SAML 2.0 Identity Provider.

WARNING: Workfront attempts to map the attributes listed below every time a user logs into the system. Because of this, we do not recommend mapping access levels. You can easily remove administrative access if an attribute is mapped incorrectly. Click Add Mapping to add additional rules.

You can map the following Workfront attributes:

• Access Level

• Address

• Address2

• Billing Per Hour

• City

• Company

• Cost Per Hour

• Email Address

• Extension

• First Name

• Home Group

• Home Team

• Job Role

• Last Name

• Layout Template

• Manager

• Mobile Phone

• Phone Number

• Postal Code

• Schedule

• State

• Timesheet Profile

• Title

Click Save when you are finished mapping user attributes.

Allows Workfront administrators to access Workfront using their Workfront login. If this option is not selected, Workfront administrators must use their SAML 2.0 username and password.

Workfront first attempts to log in to Workfront via SAML 2.0 for users with the Workfront System Administrator access level. If the SAML 2.0 authentication fails, Workfront uses local authentication for Workfront administrators.

We recommend that you always have this option selected so that your Workfront administrator can log in to Workfront if your SAML 2.0 provider is ever temporarily unavailable.

Activates SSO on the Workfront system. Ensure that you have communicated login instructions to your users.

After you enable your SSO configuration in Workfront, you must enable the Only Allow SAML 2.0 Authentication setting for all users so that they can use SSO.

For more information about updating users for SSO, see Update users for single sign-on.

For more information about user settings, see Edit a user's profile.

Click Test Connection to verify that Workfront and the SAML 2.0 Identity Provider can communicate with each other. This connection is successful only if you exchanged the XML files.

After you successfully test the link between your SAML 2.0 Identity Provider and Workfront, you will see a screen similar to the image below.

NOTE: This screen is displayed in a browser pop-up, so ensure that you disable pop-up blockers in your browser.

Save the information displayed in the table for later use.