Authentication ​

Select Yes.

Paste your metadata URL into the Metadata URL field. Workato uses this URL to automatically import your SAML configuration.

You can find this URL in your IdP's SAML setup:

• Okta: Go to your app's Sign On tab and scroll to Metadata URL. It typically follows this format: https://{your-okta-domain}/app/{app-name}/{app-id}/sso/saml/metadata
• Microsoft Entra ID: Go to your app's Single sign-on settings and scroll to SAML Certificates. The URL is labeled App Federation Metadata URL and typically follows this format: https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml?appid={app-id}
• Google Workspace: Go to your app's SSO Configuration and scroll to IDP metadata. Click Download metadata to get the XML file, or use the URL directly if your Google admin has published it.

Select No.

Paste your IdP SSO URL into the Identity provider single sign-on URL field.

Provide your IdP unique identifier in the Identity provider issuer field. This is the Entity ID your IdP uses to identify itself and must match exactly what your IdP is configured to send in SAML assertions.

You can find this value in your IdP's SAML setup instructions:

• Okta: Go to your app's Sign On tab and click View SAML setup instructions. The value is listed as Identity Provider Issuer and typically uses the following format: http://www.okta.com/examplekey123
• Microsoft Entra ID (Azure AD): Go to your app's Single sign-on settings. The value is listed as Microsoft Entra Identifier and typically uses the following format: https://sts.windows.net/{tenant-id}/
• Google Workspace: Go to Apps > Web and mobile apps, select your app, and open SSO Configuration. The value is listed as Entity ID and typically uses the following format: https://accounts.google.com/o/saml2?idpid={idp-id}

Paste your IdP X509 certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines in the X.509 certificate field. This is the public certificate Workato uses to validate that SAML responses genuinely came from your IdP.

You can find your X509 certificate in your IdP app:

• Google Workspace: Go to Apps > Web and mobile apps, select your app, and open SSO Configuration. Go to the SSO certificate section and click Download certificate. Open the downloaded .pem file in your text editor to copy the certificate.
• Microsoft Entra ID: Go to your Microsoft Entra ID app's Single sign-on section. Go to the SAML Certificates section and download the Certificate (Base64) file. Open the downloaded .cer or .pem file in your text editor to copy the certificate.
• Okta: Go to your Okta app's Sign On tab and scroll to SAML Signing Certificates. Click Actions next to the active certificate and click Download certificate. Open the downloaded .cer or .pem file in your text editor to copy the certificate.
• OneLogin: Go to the SSO section and click More Actions. Right-click SAML Metadata and select Copy link address.