SAML Setup (General)
Prerequisites
SSO Prerequisites
- Have sufficient privileges to create & configure a SAML application.
Moveworks SSO Prerequisites
-
Your Moveworks organization should be initialized (verify with your account team)
-
Note the following values.
-
data_center_domain
- the data center where your organization is hosted (see table below). -
subdomain
- your organization's login subdomain. This will generally match yourcustomer_id
, but you can verify or customize it in General Information.Warning
Make sure you ONLY note your unique subdomain. For example, if you're organization's login subdomain is acme.moveworks.com, then your
subdomain
is acme and yourdata_center_domain
is moveworks.com -
[Optional]
customer_id
- unique identifier for your organization (can not be changed). This is stored as Org Name under Organization Details > General Information
-
Data Center | data_center_domain |
---|---|
United States (default) | moveworks.com |
Canada | am-ca-central.moveworks.com |
EU | am-eu-central.moveworks.com |
Australia / Asia Pacific | am-ap-southeast.moveworks.com |
Government Secure Cloud | moveworksgov.com |
Configuration Steps
Create SAML Application
Go to your SSO Admin Portal & create a new "Security Assertion Markup Language" (SAML) application. Please configure your urls based on your Moveworks SSO properties.
-
App Name:
Moveworks
. -
Sign-in Method:
SAML 2.0
as the sign in method. -
SAML ACS URL:
https://{{subdomain}}.{{data_center_domain}}/login/sso/saml
Multiple URLs?
Moveworks uses the same url for sending and receiving SAML Assertions. So you can use this SAML ACS URL for the following URLs
- Single-sign on URL
- Destination URL
- Recipient URL.
-
Audience URI (also called SP Entity ID):
https://www.moveworks.com
. -
Relay State:
customer_id
-
Application Icon:
Add SAML Configuration in MyMoveworks
-
Note your SAML Configuration variables from your SSO platform
- Identity Provider SSO URL
idp_url
- Identity Provider Issuer:
idp_issuer
- X.509 Certification:
x509_certificate
- Identity Provider SSO URL
-
Navigate to SSO Settings in MyMoveworks
-
If you already see a
studio
config, edit it. Otherwise, choose Create. -
Add your configuration using the values you've noted above
- Moveworks Product:
studio
- Select Connector:
moveworks
or{{your_idp}}
- Authentication Protocol:
SAML
- IDP Sign On / SSO URL:
{{idp_url}}
(From Step 1) - IDP Issuer:
{{idp_url}}
(From Step 1) - IDP Public Certificate:
x509_certificate
(From Step 1)
- Moveworks Product:
-
Click Submit.
-
Wait a few minutes, then attempt to log into your instance at
https://{{subdomain}}.{{data_center_domain}}
Updated about 2 months ago