> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Asana Enterprise

Asana Enterprise offers a Web and mobile application that offers a work management platform that provides powerful admin controls and advanced data protection. (see <https://asana.com/>). This integration provides instructions to integrate Asana with Identity as a Service. Once integrated, users can use single sign-on to log in to their Asana account using Identity as a Service.

note

This integration was tested using Identity as a Service version 5.15 and the Asana Enterprise Service as of March 2021. Other versions of the Asana Enterprise service may require integration and configuration steps that differ from those documented in this procedure. For Asana versions other than the March 2021 service, use this procedure as a starting point for integrating the Asana Enterprise service. In the event of other issues, contact <support@entrust.com> for assistance.

To integrate Asana Enterprise with Identity as a Service, you must do the following

## Step 1: Complete the prerequisites

note

The Asana SAML service does not support SAML SSO logout and does not provide a logout URL to input into the IDP SAML configuration. Consequently, Identity as a Service performs a session logout based on the Authentication Session Lifetime (see [Manage General settings](/docs/authentication-and-security/manage-authenticators/manage-general-settings.md)).

This procedure creates a user for SAML integration testing. However, the Asana product documentation indicates that you can bulk load users or create new user on-boarding pages with the Asana on-boarding features. See the following documentation for more information:

> <https://asana.com/guide/help/fundamentals/about-asana>
> <https://asana.com/guide/help/fundamentals/accounts>
> <https://asana.com/guide/examples/hr/onboarding>

### Create a user in Asana Enterprise

You must input a valid email address for the new user. Also, the domain in the email address must be part of the organization's email domain.

1. Log in to your Asana administrative account using URL:

   > <https://app.asana.com/login>
   > The **Login** page appears.

2. Enter your email address and your password and then click **Login**. The Asana **Home** page appears.

3. In the upper right corner, click on the pink profile circle icon and select **Admin Console** from the drop-down list. The Asana Administration portal appears.

4. In the menu pane, click **Members**. The **Members** page appears.

5. Click **Invite Members**.

6. Click **Invite with Email**.

7. In the **Email Addresses** field, enter a valid email address for the new user.

8. Click **Send**. The new user receives a **Welcome to Asana** email from Asana.

### Create a new Asana user

1. Open the **Welcome to Asana** email and click the **Accept Invite** link in the email.
2. Click **Continue Signing Up**. The **Let's Setup Your Profile** page appears.
3. Enter your **Full Name**.
4. Enter a **Password**.
5. Click **Continue**. The **Who's on your team?** page appears.
6. Enter the **Email Address** of at least one team member.
7. Click **Continue to your first project**. The **Asana Dashboard** page appears.

### Create a corresponding user in Identity as a Service

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.

2. Click Plus icon. The **Add User** page appears.

note
If you have a directory synced to your Entrust Identity as a Service account, a drop-down list appears prompting you to **Create a local user** or **Sync a user**. If you do not have a directory synced to your account, you will not see the drop-down list.

3. To add the user manually, select **Create local user**.

4. Enter the following attributes, as required:

   1. Enter the **First Name** of the user.

   2. Enter the **Last Name** of the user.

   3. Enter the **Email** address of the user. The email address is used to send authenticator and account information emails. The email address for the new user in Identity as a Service must match the email address that was set for the same new user in Asana Enterprise.

   4. Enter the **Mobile** number of the user. The mobile device number is used to send SMS one-time passwords to the user. It can also be used to send VOICE one-time passwords to the user if the user does not have a phone number.

   5. Enter the **Phone** number of the user. The phone number is used to send a voice message of one-time passwords to the user.

   note
   By default, First Name, Last Name, and Email are set as mandatory. For information on changing them, see "Edit a system attribute" in the section, [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md).

   6. Enter the **User ID** of the user. This system attribute is mandatory.

   7. From the **Language Preference** drop-down list, select the language of the user.

   note
   Selecting **Account Default** sets the user's language preference to the account language setting. The account language setting is defined at Menu icon **>** **Theme**. If the account language setting changes, the user's language also changes.

   8. If applicable, under **Required Attributes**, on the line below each required attribute, enter the value for the attribute. For more information on attributes, see [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md).

5. Optional. Add a user alias to allow the user to log in using their User ID or an alias.

   Note the following when adding aliases:

   - All aliases must be unique in the system.
   - An alias must not be the same as a User ID in the system.
   - You can add up to 10 aliases.

   Add an alias as follows:

   1. Under **Aliases**, click **Add**. The **Add Alias** dialog box appears.
   2. In the **Add Alias** field, enter the alias.
   3. Click **OK**.
   4. Repeat steps a to c to add another alias.

6. From the **Select Group to add** drop-down list, assign the user to the required group. You can add a user to multiple groups.

note
If no groups are selected, the user is assigned to the **All Identity as a Service Users** group by default.

7. From the **Select Role** drop-down list, select the user role. The role determines which features the user can access in Entrust Identity as a Service. The default setting is **No Role Assigned**. For more information, see [Create, assign, and manage roles](/docs/people-and-access/manage-members/create-assign-and-manage-roles.md).

note
Be sure to add an email address for the new user. The email address must match the email address that was set in Asana Enterprise for the user.

## Step 2: Create a SAML signing certificate in Identity as a Service

### Create a SAML signing certificate

Identity as a Service provides a default self-signed certificate. You can also create your own certificate. This might be necessary if your certificate is about to expire or you want to create a certificate and replace the self-signed certificate with a certificate signed by a Certificate Authority (CA).

1. Log in to your Identity as a Service administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **SAML Cloud Integrations**, click **SAML Signing Certificates**. The **SAML Signing Certificates** page appears.
4. Click Plus icon. The **Create Signing Certificate** dialog box appears.
5. Enter a **Name** for the certificate.
6. Select the expiry date from the pop-up calendar and click **OK**.
7. Click **Add**. The certificate appears on the **Signing Certificates** page.

## Step 3: Export the signing certificate from Identity as a Service

### Export a SAML signing certificate

1. Log in to your Identity as a Service administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **SAML Cloud Integrations**, click **SAML Signing Certificates**. The **SAML Signing Certificates** page appears.
4. Click the download icon next to the certificate to export the certificate you want to import into your SAML service provider application. The **Export Certificate** dialog box appears.
5. If the certificate has been issued by a CA, do one of the following:
   - Click **Certificate** to export the self-signed certificate.
   - Click **Root CA Certificate** to export a certificate issued from a CA.
   - Click **Certificate Chain** to export the SAML signing certificate and its CA certificates.
6. Click **Export**.

## Step 4: Copy the SAML Configuration from Identity as a Service

### Copy the SAML Configuration from Identity as a Service

1. Log into your Identity as a Service administrator account.

2. Click Menu icon **>** **Security > Applications**. The **Applications Lists** page appears.

3. Under **SAML Cloud Integrations**, click **SAML Configuration**. The **SAML Configuration** dialog box appears.

   This dialog box contains information you need to configure your SAML application for Identity as a Service authentication.

4. Do one of the following:

   - Leave this dialog box open to reference later in this procedure.
   - Copy the Entity ID, Single Sign-on URL, and Single Logout URL to a text file and save it to reference later in this procedure.

note
Depending on the integration you are performing, you may not need all three of these SAML configuration values.

## Step 5: Configure Asana for single sign-on with Identity as a Service

1. Log in to your Asana administrator account. The Asana **Home** page appears.

2. Click the user profile button on the top-right of the Home page and select **Admin Console** from the drop-down list. The **Asana Admin** portal appears.

3. Click **Security**. The **Security** page appears.

4. Click **SAML authentication**. The **SAML authentication** dialog box appears.

5. Select **Optional** as the **SAML option**.

note
Once you have tested your SAML integration and verified it is correct, you can change this to **Required for all members, except guest accounts**. Please be advised that once **Required for all members, except guest accounts** is enabled, Asana administrator accounts will log in using SAML SSO only.

6. In the **Sign-in page** URL field, paste the Single Sign-On URL you copied in _Step 4: Copy the SAML Configuration from Identity as a Service_.

7. Open the certificate you exported in _Step 3: Export the signing certificate from Identity as a Service_ in a text editor such as Notepad.

8. Copy the contents of the certificate and paste them in to the **X.509 certificate** field.

9. Click **Save Configuration**.

10. Close the **SAML Options Updated** message box.

## Step 6: Add Asana to Identity as a Service

### Add Asana as an application to Identity as a Service

1. Log into your Identity as a Service administrator account.

2. Click Menu icon **>** **Security > Applications**. The **Applications Lists** page appears.

3. Click **Add**. The **Select an Application Template** page appears.

4. Do one of the following:

   - Select **SAML Cloud Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

5. Click **Asana**. The **Add Asana** page appears.

6. Enter an **Application Name**.

7. Enter an **Application Description**.

8. Optional. Add a custom application logo.

   1. Click Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears.
   2. Click Upload icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your image.
   4. If required, resize your image.
   5. Click **OK**.

9. Select the **Authentication Flow** that appears to users during login.

10. Click **Next**. The **General** page appears.

11. In the **Default Assertion Consumer Service URL** field, enter:

    > <https://app/asana.com/-/saml/consume>

12. In the **Service Provider Entity ID** field, enter

    > <https://app.asana.com>

13. Leave the **Single Logout Service URL** field empty.

14. Enter the **SAML Session Timeout** to the time when the SAML Assertion times out. The maximum is 720 minutes.

15. Enter the **Max Authentication Age (seconds)** to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.

16. From the **SAML NameID Attribute** drop-down list, select **Email**.

17. From the **SAML NameID Encoding Format** drop-down list, select **Email**.

18. From the **SAML Signing Certificate** drop-down list, select the signing certificate you copied into Asana in _Step 5: Configure Asana for single sign-on with Identity as a Service_.

19. Optional: Select **Respond Immediately for Unsuccessful Responses** to return to the application immediately after a login failure, rather than allow user to try again with a different userID.

20. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the Asana Enterprise login page to log in.

21. Select **Show Default Assertion Consumer URL Service in the My Profile**. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.

22. Optional. Add **Alternative Assertion Consumer Service URLs**, as follows:

    1. Click **Add**.
    2. Enter a **Name**.
    3. Enter a URL **Value**.
    4. Select **Show in My Profile** to display the Alternative Consumer Service URL in a user's My profile page.
    5. Optional. **Add an Application Logo**.
    6. Click **Add**.
    7. Repeat these steps to add more Alternative Assertion Consumer Service URLs.

23. Leave the remaining settings at the default values.

24. Click **Submit**.

## Step 7: Add a resource rule

See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md).

## Step 8: Test the integration

### Testing Service Provider Login

1. Open a Web browser and enter the URL for your Asana account. You are directed to Identity as a Service.

   For SP-initiated login, use the Asana SP URL with your domain appended to it

   **Example**: `https://app.asana.com/a/<domain>` where if your domain is `mycompany.com`, use URL `https://app.asana.com/a/mycompany.com`.

2. Enter your Asana account **User ID** and click **Next**.

3. Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to Asana.

### Testing Identity as a Service redirect log in

1. Log in to your Identity as a Service account.
2. Go to your **My Profile** page if you are not already there.
3. Under **Applications**, click **Asana**.
4. Respond to the second-factor authentication challenge. If you respond successfully, you are logged into Asana.