Skip to main content

Configure single sign-on for all providers

Lists the requirements for SSO with any OIDC or SAML provider, including Okta, Auth0, PingIdentity, OneLogin, WorkOS, and Rippling. Covers claims, metadata options, and configuration.

Supported identity providers

F5 Workforce AI Security supports OpenID Connect (OIDC) and Security Assertion Markup Language (SAML) 2.0 for single sign-on (SSO). Most major identity providers (IdPs) support one or both of these protocols. This list shows some of these providers:

  • Microsoft Entra ID, formerly Azure AD

  • Okta

  • Auth0

  • PingIdentity

  • OneLogin

  • WorkOS

  • Rippling

For Microsoft Entra ID, use Configure single sign-on for Microsoft Entra ID. With SAML, finish the Entra configuration before you add the metadata in Workforce AI Security.

Authentication protocols

Workforce AI Security supports OIDC and SAML. If your IdP supports OIDC, use OIDC.

Add the provider

  1. Log in to the Workforce AI Security admin interface.

  2. In CONFIGURE, go to Organization > Identity.

  3. Select Add Provider.

  4. In Provider Name, enter a name for the provider.

  5. From Provider Type, select OIDC or SAML.

  6. Select Save. The page shows the values to enter in the IdP.

Then do the steps for the provider type that you selected.

Configure OpenID Connect (OIDC)

Values Workforce AI Security provides

  • Authorization Callback URL

    • Also known as Redirect URI, Reply URL, or Callback URL

Enter this URL in the IdP configuration.

Values required from the identity provider

  • Client ID

    • Also known as Application ID

  • Client Secret

    • Also known as Application Secret or API Key

  • Issuer URL

    • Also known as Authority URL, OpenID Provider URL, or Issuer Identifier

Required claims

Workforce AI Security requires specific claims in the ID token. Most IdPs include the email claim by default. The display name of a user comes from one claim, or from a first name claim and a last name claim together. Workforce AI Security adds the display name to User Activity and Telemetry events for generative AI use.

Configure the IdP to include these claims:

  • Email claim

    • Standard claim name: email

    • Also known as mail, emailAddress, or preferred_username, depending on the IdP

  • Display name claim (recommended)

    • Standard claim name: name

    • Also known as displayName, display_name, preferred_username, or nickname, depending on the IdP

  • First name and last name claims (alternative, when your IdP doesn't have a single display name claim)

    • First name claim: given_name, also known as givenName, firstName, or first_name, depending on the IdP

    • Last name claim: family_name, also known as surname, lastName, last_name, or sn, depending on the IdP

Workforce AI Security combines the first name and the last name into one display name.

Configuration steps

  1. In Workforce AI Security, copy the Authorization Callback URL.

  2. In the IdP, enter the Authorization Callback URL as the redirect URI.

  3. In the IdP, get the client ID, the client secret, and the issuer URL.

  4. In Workforce AI Security, enter the IdP values in Client ID, Client Secret, and Issuer URL.

  5. Select Save.

  6. Turn on Enabled.

  7. Select Save.

Configure Security Assertion Markup Language (SAML)

Important: Finish the IdP configuration before you turn on the provider in Workforce AI Security.

Required claims

Workforce AI Security requires specific claims in the SAML response. Most IdPs include the email claim by default. The display name of a user comes from one claim, or from a first name claim and a last name claim together. Workforce AI Security adds the display name to User Activity and Telemetry events for generative AI use.

Configure the IdP to send these claims. The claims become attributes in the SAML assertion:

  • Email claim

    • Common claim or attribute names: email, mail, emailAddress, or EmailAddress

  • Display name claim (recommended)

    • Common claim or attribute names: displayName, name, or DisplayName

  • First name and last name claims (alternative, when your IdP doesn't have a single display name claim)

    • First name claim: givenName, firstName, first_name, or GivenName

    • Last name claim: surname, lastName, last_name, sn, familyName, or Surname

Workforce AI Security combines the first name and the last name into one display name.

Values Workforce AI Security provides

  • Service Provider Entity ID

    • Also known as Issuer URL, Metadata URL, Audience URL, or Provider ID

  • Authorization Callback URL

    • Also known as Assertion Consumer Service (ACS) URL, SAML Consumer URL, Service Provider (SP) Response URL, or SAML Endpoint

Enter these values in the IdP configuration.

Values required from the identity provider

Use one of these tabs to add the IdP values to Workforce AI Security:

  • Metadata: Enter the values manually:

    • Entity ID, also known as Issuer, IdP Entity ID, or Identifier

    • SSO URL, also known as SAML Endpoint, Login URL, or IdP Sign-in URL

    • Provider Certificate, also known as IdP certificate, SAML signing certificate, or encryption certificate

  • Load from XML: Paste the SAML metadata XML from the IdP admin console.

  • Load from URL: Enter the metadata URL from the IdP. The URL must be publicly accessible. Workforce AI Security gets the metadata from the URL and processes the metadata.

Configuration steps

  1. In Workforce AI Security, copy the Service Provider Entity ID and the Authorization Callback URL.

  2. Select the Metadata, Load from XML, or Load from URL tab.

  3. Enter the IdP values on that tab.

  4. Select Save.

  5. In the IdP, complete the configuration with the Service Provider Entity ID and the Authorization Callback URL.

  6. In Workforce AI Security, turn on Enabled.

  7. Select Save.

Give users access in the identity provider

Many IdPs limit login to the users and groups that you assign to an application. Make the application available to all users, or assign the users and groups that use Workforce AI Security. For Microsoft Entra ID, see Configure single sign-on for Microsoft Entra ID.

Related Articles
Did this answer your question?