Workday SSO: Sign In to Workday Through SSOGEN

Workday SSO with SSOGEN means Workday trusts a signed SAML assertion from SSOGEN instead of checking its own password. This page lists the values to copy in each direction and how to prove the sign-in before anyone depends on it.

Start a guided trial

Workday SSO with SSOGEN gives employees one sign-in and removes leavers in one step. Workday is the service provider (SAML) or the client (OpenID Connect). SSOGEN is the identity provider, and it connects any application that speaks SAML 2.0 or OpenID Connect this way, with no catalog entry needed.

Below are the values to copy between the two screens. Workday’s admin screen uses its own labels, so match fields by meaning with the table.

Values to copy for Workday

SSOGEN field or value	Vendor-neutral name in the application	Direction
Service provider entity ID	Entity ID, identifier, audience	From Workday into SSOGEN
Assertion consumer service URL	ACS URL, reply URL	From Workday into SSOGEN
Single logout URL (optional)	Logout URL	From Workday into SSOGEN, if it has one
IdP entity ID	Identity provider entity ID, issuer	From SSOGEN into Workday
Single sign-on URL	Sign-in URL, login URL	From SSOGEN into Workday
Signing certificate	Identity provider certificate	From SSOGEN into Workday
Name ID	User matching attribute	Choose in SSOGEN, set the same format in Workday

If Workday publishes a metadata file, upload it in the Connection step, and SSOGEN fills in the first three rows. In the other direction, importing SSOGEN’s metadata address sets the last four rows at once, including the certificate.

Match people on email and remove leavers promptly

Workday usually holds the record of who works at your company, so the sign-in rule and the leaver rule go together.

Pick email under Identify the person by when the application matches people by email address. Every person who needs Workday must have an email address in SSOGEN. A person without one is refused and is never sent under another name.

Then decide how leavers lose access:

Unassign a person or group in SSOGEN, and the tile disappears at once.
The sign-in policy stops any new session.
Outbound provisioning also switches the account off when the application offers SCIM 2.0.

Register, assign, test and activate

In the Admin Console open Applications, then SAML (or OpenID Connect) and start the registration wizard.
Fill in General and Connection with the values above, choose a Sign-in policy, and set Identify the person by.
Enter the Launch URL, the address that starts the application’s own SSO sign-in. Selecting Next here saves the application, still unavailable.
Assign a person or group, run Test for a named person, and read the result.
Select Activate application. The application then appears in My Apps for the people assigned to it.

The full screens and every message are in Register a SAML application and Register an OpenID Connect application. The test and activation details are in Assign people, set the sign-in policy, test and activate.

Questions people ask

How do I set up Workday SSO with SSOGEN?

Register Workday as a SAML application in SSOGEN, copy SSOGEN’s metadata or three values into the application’s single sign-on screen, assign people, test and activate.

Which Name ID should Workday get?

Whatever the application uses to match accounts. For most SaaS products that is the email address. Choose email in SSOGEN and set the same format in the application.

Can SSOGEN create Workday accounts?

Only if the application offers a SCIM 2.0 interface over https. Outbound provisioning needs its SCIM base URL and a bearer token.

Where to go next

Return to the hub. The SSO applications hub has the protocol comparison and the other guides.
Choose the protocol. If you are not sure whether Workday belongs under SAML or OpenID Connect, read Choose how to connect an application.
See it working. To see Workday SSO and leaver removal working, request a trial.