IDP Integration

Brief Overview

Identity Providers store and manage digital identities, providing a way for companies to manage access and privileges, while maintaining high security standards.

IDP Integration can be used to take that information, validate end-users identity, enrich content segmentation capabilities and expand on user behavior monitoring. Providing one reliable and secure User ID across any system without the need of defining the unique user ID for each system with different variables.

Using IDP as a User Identifier should be the go-to solution for all new systems.

IDP Integrations are accessible from the Admin Center at admin.walkme.com.

Use Cases

• End-user IDP authentication as a prerequisite to present WalkMe content.
• Expanding content segmentation capabilities by IDP parameters (for example - groups, region, department, etc).
• Accurate data monitoring across systems.

Supported Platforms

WalkMe's IDP integration supports the use of several authentication protocol including OAuth 2.0, OpenID Connect, and SAML, in order to authenticate users with their organizational IDP vendor, and to obtain user attributes that can later be used for segmentation and analytics in WalkMe. Every IDP vendor that supports these protocols should work with WalkMe. WalkMe supports SP initiated flow.

What is OAuth 2.0?

OAuth 2.0, which stands for “Open Authorization”, is a standard designed to allow a website or application to access resources hosted by other web apps on behalf of a user. OAuth 2.0 is the industry-standard protocol for authorization.

What is OpenID Connect?

OpenID Connect is a simple identity layer on top of the OAuth 2.0 protocol, which allows computing clients to verify the identity of an end-user based on the authentication performed by an authorization server, as well as to obtain basic profile information about the end-user in an interoperable and REST-like manner.

IDP Integration currently supports the following vendors:

• Okta
• G-Suite
• ADFS
• AzureAD
• PingID
• Identity providers that use OpenID 

Other than OpenID Connect, the most common authentication protocol is SAML. For instructions on how to create and set an integration using SAML, please refer to our SAML IDP Integration article.

Pre-requisites

An IDP application needs to be created to serve as the "bridge" between IDP and WalkMe's Integration Center.

An instruction guide is available in the Admin Center configuration screen for all supported systems.

Adding an Identity Provider 

1. In the IDP Integrations tab of the Admin Center, click on the "+ Add Identity Provider" button

2. Select the OAuth 2.0 protocol type

3. Provide the appropriate configuration settings for the connection

1. 1. IDP vendor - Select a vendor from the list
   2. IDP Name - Connection name
   3. Client ID - Public identifier for apps
   4. Client Secret - Secret known only to the application and the authorization server
   5. IDP Provider Domain - Domain of your organization

• For OpenID Connect:
  1. IDP vendor - Select OpenID Connect from the Oath2.0 vendor list
  2. IDP Name - Connection name
  3. Client ID - Public identifier for apps
  4. Client Secret - Secret known only to the application and the authorization server
  5. IDP Provider Discovery URL
  6. IDP Provider Scope
  7. Content Security Policy
  8. Your IDP Provider
  9. Use ID Token For Getting End-Users Properties - Check the toggle to enable

4. Click "Save & Next" once ready

• Note that we do not require a Sign Logout URL

5. Choose a unique end-user identifier to identity users by

• You only need one identifier; we do not require any additional group information or other attributes

6. Select the desired properties and ensure the correct data type was chosen:

1. 1. String
   2. Number
   3. Date

7. Select which systems you want to assign the IDP Integration to

• For each system, you can separately enable IDP Integration on the desired environments

8. Use the toggle to Enforce SSO

9. Click "Finish"

10. A message will appear telling you whether your IDP was successfully added or not

• You can now segment content using the imported attributes in Insights and in the Editor under User Attributes > IDP with the suitable filter conditions according to the set data field type.
• Read more here.

Managing an Identity Provider 

Hovering over the row of an Identity Provider will provide you with several options:

• Delete
• Manage System Assignment
• Import Properties
• Edit
• Expand

Delete

• Click on the trash icon to "delete" an identity provider

Manage System Assignment

• Click on the "+" icon to open the Manage System Assignment screen
• Select or deselect the systems you want assigned to the identity provider
• You can also use the toggle to Enforce SSO
• Click on the "Save Changes" button once you are finished

Import Properties

• Click on the list icon and then the "Import Properties" button to edit or add additional imported properties

These attributes will be used for content segmentation and reporting in Insights.

Edit

• Click on the pencil icon to edit identity provider settings
• You will be able to be able to edit all of the fields filled out in the initial identity provider configuration

Expand / Collapse View

• Use the arrow icon to open and collapse the expanded view
• When expanded you will see all of the systems assigned to an identity provider and whether or not Enforce SSO has been enabled

Best Practices

"Enforce SSO" Configuration

• When Enabled - IDP authentication must occur before opening web page to end-user, if IDP token is not recognized then the end-user will be redirected to their IDP login page.
  • Each time the end-user fails to authenticate to the IDP due to reasons such as, IDP was down, customer forgot credentials, or end-user was not assigned to the IDP's app, SSO will be disabled for 1 hour and the User Identifier will be automatically downscaled to "WalkMe ID" method as fallback or WalkMe will not load, depending on the customer's configuration.
  • After 1 hour - if IDP token is still not recognized then the end-user will be redirected again to their IDP login page, otherwise, login to the IDP will not be needed. It is important to make sure this is absolutely clear to the customer. Otherwise, DO NOT enable this option.
• When Disabled - IDP authentication is attempted upon page load, but if there is no active token for IDP then the end-user won't be redirected to IDP. The User Identifier will be downscaled automatically to "WalkMe ID" method or WalkMe will not load, depending on the customer's configuration.

Limitations

• Safari browser extension is not supported with IDP
• Changing User Identifier impacts the way WalkMe identifies end-users and may reset "Play once" configurations

• User should have Admin permissions for Admin Center
• IDP must be configured on the required system
• End users should be using IDP to authenticate to that system
• If your company has CSP (Content Security Policy) it will block calls to the IDP provider
  • In order to overcome this, the right URL should be added in the CSP settings of the extension configuration

• After assigning systems, the UUID setting for the assigned systems is automatically set to IDP and settings are published so no further action is required
  • For the IDP changes to take effect, the customer's systems must be updated to the latest WalkMe version (this can achieved by doing a settings publish)
  • For Enterprise accounts you must check "Update to the latest WalkMe version" when publishing
• When importing a date type property, only the following formats are supported:
  • 2018-02-20
  •  2018-02-20T14:32:00
  • 12/30/2018
  • Importing a string or number as a date will fail to work in Insights filtering/Editor segmentation

Mobile Web:

• Mobile Web will be automatically activated after IDP setup is complete
• If Mobile Web is added after IDP / OneID has already been activated, users will need to deactivate and then reactivate IDP for Mobile Web support

Solving Common Issues

User is not assigned

To prevent this from occurring, all employees need to be assigned to WalkMe. The IT person at your company should be able to assist you with this by modifying the access setting to the WalkMe app in your IDP provider to all employees.

EUID was not found in the user profile

To address this, you can either select a different EUID, which is available to all employees assigned to WalkMe, or you can individually add the missing information to the relevant users.

Expired Client / Secret Keys

If the key is expired, you will have to recreate it and then update the new keys in the relevant IDP connection in the IDP Integrations page in the WalkMe Admin Center.

Invalid Client /Secret Keys

Ensure that you have copied the correct keys and then paste them in the relevant IDP connection in the IDP Integrations page in the WalkMe Admin Center.