> ## Documentation Index
> Fetch the complete documentation index at: https://developer.watson-orchestrate.ibm.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify SSO authentication between Entra ID and Workday

This part is optional, but very recommended before you start the configuration to make sure that the SSO authentication is configured between Entra ID and Workday.

### Verify SSO authentication between Entra ID and Workday

Before configuring watsonx Orchestrate, verify the SSO authentication between Entra ID and Workday. Use `CURL` or `Postman` to run the commands.

<Steps>
  <Step title="Set your environment variables">
    Run the following commands in the terminal.

    ```bash BASH theme={null}
    export CLIENTID=<entra_app_client_id>
    export CLIENTSEC=<entra_app_client_secret>
    export WD_TENANT=<entra_directory_tenant_id>
    export SCOPE=http://www.workday.com/user_impersonation
    export WD_CLIENTID=<workday_api_client_id>
    export UNAME=<username_of_user>
    export PWD=<password_of_user>
    ```

    Replace `<entra_app_client_id>`, `<entra_app_client_secret>`, `<entra_directory_tenant_id>`, `<workday_api_client_id>`, `<username_of_user>` and `<password_of_user>` with the appropriate information.
  </Step>

  <Step title="Add permissions to access the Workday API">
    Before you can exchange tokens and access Workday APIs by using Entra ID, you need to configure the permissions for your app in Microsoft Entra.<br />

    a. Open Microsoft Entra admin center and navigate to **App registrations**.<br />

    b. Select your application used for token exchange.<br />

    c. Go to **API permissions** and select **Add a permission**.<br />

    d. Choose the Workday API.<br />

    e. Select **Delegated permissions** and add the required scopes.<br />

    For detailed steps, see [Configure an application to access a web API](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis) in the Microsoft documentation.
  </Step>

  <Step title="Get a login token from Entra ID">
    Use the following command to get a login token. The `password` grant type is used to simulate user logging in to Entra ID.

    ```bash BASH theme={null}
    curl -H 'Content-Type: application/x-www-form-urlencoded' \
      https://login.microsoftonline.com/$WD_TENANT/oauth2/v2.0/token \
      -d "grant_type=password&client_id=$CLIENTID&client_secret=$CLIENTSEC&scope=api://$CLIENTID/default&username=$UNAME&password=$PWD"
    ```
  </Step>

  <Step title="Exchange the login token for a SAML assertion">
    Use the following command to get SAML assertion from Entra ID. The `JWT bearer` grant type is used to exchange the access token for a SAML assertion.

    Replace the `$TOKEN` with the token you received in the Step 3.

    ```bash BASH theme={null}
    curl -H 'Content-Type: application/x-www-form-urlencoded' \
      https://login.microsoftonline.com/$WD_TENANT/oauth2/v2.0/token \
      -d "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&client_id=$CLIENTID&client_secret=$CLIENTSEC&assertion=$TOKEN&scope=$SCOPE&requested_token_use=on_behalf_of&requested_token_type=urn:ietf:params:oauth:token-type:saml2"
    ```
  </Step>

  <Step title="Exchange the SAML assertion for Workday access token">
    Run the following command to get SAML assertion. Replace the `$SAML_ASSERT` with the SAML assertion that you received in the Step 4.

    ```bash BASH theme={null}
    curl -X POST https://<workday_domain>/ccx/oauth2/<workday_tenant>/token \
      -H 'content-type: application/x-www-form-urlencoded' \
      -d 'grant_type=urn:ietf:params:oauth:grant-type:saml2-bearer&client_id=$WD_CLIENTID&assertion=$SAML_ASSERT'
    ```

    Replace the placeholders with your app’s details.

    | Parameter          | Description                                                                              |
    | ------------------ | ---------------------------------------------------------------------------------------- |
    | `<workday_domain>` | The domain of your Workday instance. This is where API requests are sent.                |
    | `<workday_tenant>` | Your Workday tenant identifier.                                                          |
    | `$SAML_ASSERT`     | The SAML assertion token received from Entra ID. Used to request a Workday access token. |
  </Step>

  <Step title="Trigger the Workday API">
    Use your access token received from Step 5 to call Workday API.

    ```bash BASH theme={null}
    curl --location 'https://<workday_domain>/ccx/api/common/v1/<workday_tenant>/workers' \
      --header 'Authorization: Bearer <workday_access_token>'
    ```
  </Step>

  <Step title="Result">
    If the token is valid and the API is correctly configured:

    * Workday returns a JSON response containing a list of workers for the specified tenant.
  </Step>
</Steps>