How to configure single sign-on for WorkPlace?

ADSelfService Plus supports Active Directory (AD)-based single sign-on (SSO) for WorkPlace and many other SAML-enabled applications.  If SSO is enabled for WorkPlace, users only have to login once into ADSelfService Plus - the identity provider. After logging in, users can securely access their WorkPlace account without having to enter their username and password again.

Service Provider (SP)-initiated SSO is supported by ADSelfService Plus for WorkPlace.

SP-initiated SSO for WorkPlace: When users access WorkPlace via a URL or bookmark, they are routed to the login page of ADSelfService Plus. After they log in, they will be redirected and logged into WorkPlace automatically.

Follow the step-by-step guide given below to configure SSO for Evernote Business

Before you begin

Download and install ADSelfService Plus if you haven’t already.

Configuring your Active Directory domain in ADSelfService Plus

ADSelfService Plus utilises the existing AD domain credentials for authenticating users during SSO. This makes the configuration of AD domains in ADSelfService Plus necessary before enabling SSO for WorkPlace.

By default, ADSelfService Plus will try to add all the domains that it can discover in the network. If the required domains are automatically added, skip to step 9; otherwise, follow the steps 1-8 to add the domains manually.

1. Log into ADSelfService Plus web console using admin credentials.
2. Click the Domain Settings link located on the top-right corner of the page.
3. An Add Domain Details window will appear.
4. In the Domain Name field, enter the name of the domain you want to add.
5. In the Add Domain Controllers field, click Discover. ADSelfService Plus will try to automatically discover the domain controllers associated with the specified domain.
6. If the domain controllers are not discovered automatically, enter the domain controller name in the field provided, and click Add.
7. You can leave the authentication fields empty if you're not going to use the end user self-service features of ADSelfService Plus.
8. In the Add Domain Details window, click Add.

Getting the SSO/SAML Details from ADSelfService Plus

9. Navigate to Configuration → Self-Service → Password Sync/Single Sign On.
10. In the dashboard which displays the list of applications supported by ADSelfService Plus, click WorkPlace.
11. Click Download SSO Certificate located on the top-right corner of the page.

    

12. In the pop-up that appears, copy the Login URL and click the Download SSO Certificate link to download the SSO certificate.

Configuring SSO settings in WorkPlace

13. Log in to WorkPlace with administrator credentials.
14. Navigate to Settings → Company Dashboard.

    

15. Select the Authentication tab from the Settings module.
16. In the SAML Authentication field, select SSO only.
17. In the SAML URL and the SAML Issuer URL fields, enter the Login URL copied in step 12.
18. Open the downloaded SSO certificate from step 12 and paste its content in the SAML Certificate field.

    

19. Copy the ACS (Assertion Consumer Service) URL.
20. Click Test SSO and Save.

Adding WorkPlace in ADSelfService Plus and enabling SSO

21. Navigate to ADSelfService Plus’ WorkPlace configuration page.
22. In the Domain Name field, enter the name of the domain for which you have enabled SSO.
23. In the Display Name field, provide an appropriate display name.
24. In the SAML Redirect URL, paste the ACS URL copied in step 19.
25. Provide an appropriate description in the Description field.
26. In the Available Policies field, select the policies for which SSO must be enabled.

    Note: ADSelfService Plus allows you to create OU and group-based policies for your AD domains. To create a policy, go to Configuration > Self-Service > Policy Configuration > Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature.

    

27. Click Save.

That’s it! Now users can log into their WorkPlace accounts automatically using single sign-on.