Step 1 - Get Service Provider (SP) information from Workstars
- Login to your Workstars administrator account (must be the primary account or technical user)
- Click on System Settings at the top
- Then click Sign On from the left-hand menu
- Click the Setup button next to the Single Sign On (SAML) option
- Select PingOne
- From the Service Provider section save a copy of the ACS URL and Entity ID as you will need these in the Step 2
Step 2 - Add Workstars app to PingOne
- Login to the PingOne administrator console
- On the main navigation click Applications
- Click the Add Application button and select New SAML Application
- You should see the Application Details screen
- In the Application Name box enter the name you want to show your users
- In the Application Description box enter a brief description
- In the Category drop down select an appropriate category (e.g. Human Resources)
- Upload an appropriate logo
- Click Continue to Next Step
- You should see the Application Configuration screen
- Ensure the Protocol Version is set to SAML v2.0
- In the Assertion Consumer Service (ACS) box enter our ACS URL from Step 1
- In the Entity ID box enter our Entity ID from Step 1
- Ensure the Signing Algorithm is set to RSA_SHA256
- Click Continue to Next Step
- You should see the SSO Attribute Mapping screen
- Click Save & Publish
- You should see the Review Setup screen
- Save a copy of the Initiate Single Sign-On (SSO) URL as you will need it in Step 3
- Download the Signing Certificate as you will need it in Step 3
- Download the SAML Metadata file as you will need it in Step 3
- Click Finish
Step 3 - Configure Sign On to use PingOne
- In the top bar select System Settings
- On the left hand navigation select Sign On
- Click Setup next to the Single Sign On (SAML) option
- Select PingOne
- In the SAML SSO URL box enter the Initiate Single Sign-On (SSO) URL value you copied in Step 2
- Open the SAML Metadata file you downloaded in Step 2 with a text editor (e.g. Notepad). At the top of the file in the EntityDescriptor tag, find the value of entityID (it should be in the format https://pingone.com/idp/<YourCompany>) then copy and paste it into the Identity Provider Entity ID box.
- Open the x509 Certificate you downloaded in Step 2 with a text editor (e.g. Notepad). It should be in PEM format which looks like the following:
- Copy and paste the file contents into the x509 Certificate box
- In the Remote Logout URL box enter an appropriate URL (we suggest you use your PingOne Dock URL e.g. https://desktop.pingone.com/<your-company>). This is where you would like the user to be redirected when they logout. It should NEVER be the same as our SAML SSO URL or the user will just be logged back in and can never logout.
- Leave the NameID as the default Email. We also support EmployeeID but configuring PingOne is outside the scope of this document, please contact support.
- Click Confirm to save the settings
Step 4 - Test & Enable
The setup is now complete but it is NOT yet visible for employees on the login page.
Please ensure you have an account in PingOne which has the new App assigned to it and you have an account in our system with the same email address.
When you are ready you must enable it:
- On the Sign On page, click the Enable button next to Single Sign On (SAML)
- Copy the test link
- Open a Incognito/InPrivate browser tab and paste in the link
- You should be redirected to the PingOne login page
- If you login, you should be redirected back to our system and automatically logged in
If you haven’t already done so, we recommend that you log back in to PingOne and assign all your users and groups.
- If the test worked, go back to the other browser window and click the Enable button
- If you experience any errors please check the settings are correct. If you need further assistance please capture any error message screens and contact support
You have now enabled Single Sign On (SAML) for all employees, to check the login is working:
- Visit your login URL (not the test one), it should be something like: https://<your-sub-domain>.workstars.com. You should be redirected to the PingOne login page and asked to login. If you are already logged in, you should be redirected back and logged into our system.
- Employees can also login directly from the PingOne portal. To test this, login to the PingOne portal and click the app. You should be redirected to our site and logged in.
Below are a few possible errors and how to resolve them.
On our login page it says “Sorry we could not find your account, please contact your HR Team”
Strictly speaking this isn't an error. The reason is that you have tried to login via SAML but the account you have used does not have a matching account in our system. To resolve it simply create an account in our system with the same details. If you are not using email as the nameID please check that the alternative is the same in both systems (e.g. employeeID, extnernaID, etc.) and that it is being correctly sent in the SAML request.
On our login page it says “There is a problem with Single Sign On please contact your IT department.”
This is a general error and means that there is something wrong with the setup. Please check it is setup as described above, if you have followed a different guide (some providers also have their own guides) please start again using this document as a guide. If you have checked everything and cannot find any issues please contact support and we will help you resolve the problem.
I can login from the Identity Providers portal but when I try and login from the Workstars login page it redirects me to a message that says “page not found” or another error
This is usually because you have entered an incorrect SAML SSO URL, please check it is correct. If you have checked and cannot find any issues please contact support and we will help you resolve the problem.