> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Workfront

Workfront offers online work management and project management software (see <https://www.workfront.com/>). This integration provides instructions to integrate Workfront with Identity as a Service. Once integrated, users can use single sign-on to log in to their Workfront account using Identity as a Service

note

This integration was tested using Identity as a Service version 5.17 and Workfront March 2021. Other versions of Workfront may require integration and configuration steps that differ from those documented in this procedure. For other versions of Workfront, use this procedure as a starting point for integrating Workfront. In the event of other issues, contact <support@entrust.com> for assistance.

To integrate Workfront with Identity as a Service, you must do the following:

## Step 1: Download Workfront SAML 2.0 SP metadata from Workfront

Download the metadata

1. Log in to your Workfront account as an administrator. The **Setup** page appears.
2. From the **Setup** menu, select **System >** **Single Sign-on**. The **Single Sign-On (SSO)** page appears.
3. From the **Type** drop-down list, select **SAML 2.0**.
4. Click **Download SAML 2.0 Metadata**.

## Step 2: Add Workfront to Identity as a Service

Add Workfront as an application to Identity as a Service

1. Log into your Identity as a Service administrator account.

2. Click Menu icon **>** **Security > Applications**. The **Applications** **Lists** page appears.

3. Click **Add**. The **Select an Application Template** page appears.

4. Do one of the following:

   - Select **SAML Cloud Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

5. Click **Workfront**. The **Add Workfront** page appears.

6. Enter an **Application Name**.

7. Enter an **Application Description**.

8. Optional. Add a custom application logo.

   1. Click Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears.
   2. Click Upload icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image.
   4. If required, resize your image.
   5. Click **OK**.

9. Select the **Authentication Flow** that appears to users during login.

10. Click **Next**. The **General** page appears.

11. Click Upload icon to the **Upload Metadata XML** and browse to the location of the metadata file you downloaded. The **Metadata Configuration** dialog box appears.

12. If required, click **Merge with existing values** to merge new values with existing values for Alternative Assertion Consumer Services URLs and SAML attribute names.

13. Click **Save**.

14. Optional. Enter the **SAML Username Parameter Name** used to identity the user ID being requested for authentication. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identify the IDaaS userID.

15. Enter the **SAML Session Timeout** to the time when the SAML Assertion times out. The maximum is 720 minutes.

16. Enter the **Max Authentication Age (seconds)** to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.

17. From the **SAML NameID Attribute** drop-down list, select **Email**.

18. Select the **SAML Signing Certificate** from the drop-down list.

19. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the Workfront login page to log in.

20. Select **Show Default Assertion Consumer URL Service in the My Profile**. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.

21. Optional. Add **Alternative Assertion Consumer Service URLs**, as follows:

    1. Click **Add**.
    2. Enter a **Name**.
    3. Enter a URL **Value**.
    4. Select **Show in My Profile** to display the Alternative Consumer Service URL in a user's My profile page.
    5. Optional. **Add an Application Logo**.
    6. Click **Add**.
    7. Repeat these steps to add more Alternative Assertion Consumer Service URLs.

    Relay states apply to the Default Assertion Consumer Service URLs and not the Alternative Assertion Consumers URLs.

22. **Optional**. Include user attributes in the SAML assertion, as follows:

    Add a **First Name** user attribute:

    1. Under **SAML Attributes**, click **Add**. The **SAML Attributes** dialog box appears.
    2. In the **Name, enter** **First Name**.
    3. Click **Add** next to **Value(s)**.
    4. In the **Values** field type **<** and select **<First Name>**
    5. **Click** **Add.**

    Add a **Last Name** SAML attribute:

    1. Under **SAML Attributes**, click **Add**. The **SAML Attributes** dialog box appears.
    2. In the **Name** field enter **Last Name**.
    3. Click **Add** next to **Value(s)**.
    4. In the **Values** field type **<** and select **<Last Name>** from the drop-down list.
    5. Click **Add**.

    Add an **Email** SAML attribute:

    1. Under **SAML Attributes**, click **Add**. The **SAML Attributes** dialog box appears.
    2. In the **Name** field enter **Email**.
    3. Click **Add** next to **Value(s)**.
    4. In the **Values** field type **<** and select **<email>** from the drop-down list.
    5. Click **Add**.

    Attention: If you add SAML user attributes, you must also map them in Workfront. See S*tep 5: Configure Workfront for Identity as a Service single sign-on*.

23. Click **Submit**.

## Step 3: Add a resource rule

See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md).

## Step 4: Download the metadata from Identity as a Service

Download the Metadata file from Identity as a Service

1. In Identity as a Service, click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

2. Do one of the following:

   - Click Cloud Download icon next to the application you are integrating with Identity as a Service.
   - Click Ellipsis Vertical icon next to the application you are integrating with Identity as a Service and select **SAML IDP Metadata**.

   The **SAML Application Metadata** dialog box appears.

3. **Select the certificate to include in the SAML IDP Metadata file** from the drop-down list.

4. If applicable, **Select the domain to include in the SAML IDP Metadata** file from the drop-down list.

5. Enter the **Lifetime, in days, for the SAML IDP Metadata file**. The value must be between 2 and 730.

6. Do one of the following, as required:

   - Copy the **Public Endpoint** to paste into your SAML application being used Identity Provider authentication.
   - Click **Download**.

note

If you are using multiple domains, you must download each domain's metadata file separately because the values in the metadata file vary for each domain.

## Step 5: Configure Workfront for Identity as a Service single sign-on

Configure Workfront for single sign-on

1. Log in to your Workfront account as an administrator.

2. From the **Setup** menu, select **System >** **Single Sign-on**. The **Single Sign-On (SSO)** page appears.

3. From the **Type** drop-down list, select **SAML 2.0**.

4. Select the **Service Provider ID** check box.

5. Select **POST** as the **Binding Type**.

6. Under **Populate fields from Identity Provider Metadata**, click **Choose File**.

7. Browse to select the metadata file you downloaded in _Step 4: Download the metadata from Identity as a Service_. The **Login Portal URL** displays the Identity as a Service Single Sign-on Service URL.

8. From the **Secure** **Hash Algorithm**, select **SHA-256**.

9. Optional. If you mapped user attributes in Step 2: Add Workfront to Identity as a Service, you need to map them in Workfront. To map user attributes:

   1. Click **Map User Attributes**.

   Add a **Last Name** user attribute:

   1. Click **+ Add Mapping**. The Workfront User Attributes fields appear.
   2. In the **Workfront User Attribute** field, enter select **Last Name**.
   3. In the **Directory Attribute** field, enter **SN**.

   Add a **First Name** user attribute:

   1. Click **+ Add Mapping**. The Workfront User Attributes fields appear.
   2. In the **Workfront User Attribute** field, enter select **First Name**.
   3. In the **Directory Attribute** field, enter **displayName**.

   Add an **Email** user attribute:

   1. Click **+ Add Mapping**. The Workfront User Attributes fields appear.
   2. In the **Workfront User Attribute** field, enter select **First Name**.
   3. In the **Default Value** field, enter **Email Address**.
   4. When you have finished adding all the required user attributes, click **Save**.

10. Click **Test Connection**. You are redirected to Identity as a Service.

11. Respond to Identity as a Service first and second-factor authentication. Once complete, you see a **Success** page.

12. Return to the Workfront **Single Sign-On (SSO)** page, and select the **Enable** check box.

13. Click **Save**.

Once you enable Single Sign-On (SSO), you need to update users for SSO.

To enable Single Sign-On for users:

1. Click and select **Users** from the menu. The **Users** page appears.
2. Click the check box next to **Photo** to select all users.
3. Click **Edit**. The **Edit Person** page appears.
4. Scroll to **Access**, select the **Only Allow SAML 2.0 Authentication** check box and then select **Yes** from the drop-down list.
5. Click **Save Changes**.
6. Communicate to your users SSO log in instructions.

note

If you want to enable SSO only for specific users, on the **Users** page, do the following:

1. Click the check box next to the user's name.
2. Click **Edit**. The **Edit Person** page appears.
3. Select the **Only Allow SAML 2.0 Authentication** check box.
4. Click **Save Changes**.

## Step 6: Test the integration

Testing Service Provider Login

1. Open a Web browser and enter the URL for your Workfront account. You are directed to Identity as a Service.
2. Enter your Workfront account **User ID** and click **Next**.
3. Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to the Workfront.

Testing Identity as a Service redirect log in

1. Log in to your Identity as a Service account.
2. Go to your **My Profile** page if you are not already there.
3. Under **Applications**, click **Workfront**.
4. Respond to the second-factor authentication challenge. If you respond successfully, you are logged into Workfront.