Overview | SAML vs Single Sign-On (SSO) | Supported Identity Providers (IdP) | Locally Hosted Workamajig Server | DNS Subdomain | Logging Into Workamajig | Client / Vendor Users | General Setup Steps | Limitations And Notes
Security Assertion Markup Language (SAML) Workamajig End User Guide
- This feature requires your IT staff for set up and proper implementation.
- SAML Support is a Platinum only feature. Users are free to set up SAML in Workamajig Platinum while still accessing Workamajig Classic using their Workamajig credentials. Please note that once SAML is enabled in Workamajig Platinum, all outbound emails will be generated using the SAML URL prefix.
- If you need further help with this feature, please contact firstname.lastname@example.org.
SAML vs Single Sign-On (SSO)
While SAML and SSO provide a similar function and are sometimes conflated together. We should make a distinction. As far as Workamajig is concerned SSO means LDAP Authentication directly against the LDAP server. LDAP Authentication is only available to on-premise clients and is the recommended way to enable SSO for on-premise clients. If your LDAP server offers a SAML service and you wish to setup SAML contact Workamajig support.
Supported Identity Providers (IdP)
The following Supported Identity Providers have been successfully configured and are in use with Workamajig Platinum
- GSuite (google)
- Okta - https://www.okta.com/
- Active Directory
Locally Hosted Workamajig Server
If you host your own Workamajig sever. Then you can refer those guide for steps on that specific setup.
Workamajig uses subdomains to delineate between Workamajig authentication and SAML authentication. Clients wishing to use SAML authentication will access Workamajig Platinum using a custom subdomain. A client may choose the subdomain. Subdomains for hosted clients will be set up and managed by Workamajig. Sub-domains for on-prem clients will be created and managed by the client.
If the user normally accesses Workamajig using:
To trigger SAML authentication, they would use:
Typically the IdP will provide a dashboard of some sort with a link to the Workamajig “app”. The “app” link will use the URL with your custom subdomain.
Logging Into Workamajig
Users are still able to access Workamajig Platinum using their Workamajig credentials via the original Workamajig URL. For example https://app.workamajig.com/platinum
Accessing the custom subdomain will trigger the SAML authentication and users will be redirected to your Identity Provider before accessing Workamajig Platinum.
Client / Vendor Users
Client / Vendor users will access Workamajig using the non-SAML URL. For example https://app.workamajig.com/platinum
General Setup Steps
- Decide on the Subdomain.
- Configure your identity provider.
- Your IdP will require a couple of pieces of information,
- An Entity ID. https://www.workamajig.com
- An Access URL. https://YOUR_SUBDOMAIN.workamajig.com/platinum/sso/SAMLService.aspx
- Export the metadata file and send it back to Workamajig support.
- Once the Workamajig server has been configured you will need to enable SAML in Workamajig Platinum > System Setup.
- Navigate to System Setup -> Connections -> Single Sign-On and enter the subdomain into the URL prefix field. This field acts as a flag to enable/disable SAML.
- On the Connections screen enter the SAML Configuration Identifier. This will be provided to you by Workamajig after the Workamajig server has been configured.
- Save and Exit the Admin screen.
Limitations And Notes
- SAML Support is a Platinum only feature.
- Any changes to existing and/or expiring connections should be planned ahead of time. Feel free to contact email@example.com with any questions around this.
- Emails sent out of the system containing links will use the SAML URL once SAML is enabled (the URL Prefix is set in the Admin > Connections > Single Sign-On screen.
- Emails sent out to Client / Vendor Logins will contain the SAML URL.