Seamless login through WIA and SAML

Seamless login through WIA and SAML

WIA (Integrated Windows Authentication) allows users to perform SSO without manually entering a login and password. In this scenario, Passwork is the SP, and your IdP verifies the user through SAML.

What must be provided in the infrastructure

• The IdP accepts the AuthnRequest from Passwork and returns a SAML Response to the Passwork ACS.
• Trust to the SP is configured correctly on the IdP: Entity ID, ACS URL, certificates/signatures.
• Clients trust the IdP TLS certificate, and DNS and the network do not break SAML redirects/POST requests.
• Browser/OS policies for Integrated Auth are applied centrally (GPO/MDM).
• The IdP defines the conditions for using WIA and the fallback behavior when those conditions are not met.

Advanced settings in Passwork

In SSO settings -> Advanced settings, set the SAML configuration for the SP:

JSON

{
  "sp": {
    "entityId": "https://passwork.example.com/api/v1/sso/metadata",
    "assertionConsumerService": {
      "url": "https://passwork.example.com/api/v1/sso/acs"
    },
    "singleLogoutService": {
      "url": "https://passwork.example.com/api/v1/sso/sls"
    }
  },
  "NameIDFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
  "security": {
    "requestedAuthnContext": ["urn:federation:authentication:windows"]
  }
}

requestedAuthnContext with urn:federation:authentication:windows requests Windows authentication. The IdP decides whether to use WIA according to its policies.

Universal authentication flow

1. The user clicks Sing in with SSO in Passwork.
2. Passwork creates a SAML AuthnRequest and redirects the browser to the IdP.
3. The IdP checks the conditions and performs WIA (or fallback).
4. The IdP returns the SAML Response to the Passwork ACS (/api/v1/sso/acs).
5. Passwork validates the response, maps the user, and opens a session.

LLM version