Azure-docs: Login Redirect URL is incorrect (cannot be https://login.microsoftonline.com/{tenant-id}/saml2)

[cap273]

In the Workday Redirection URLs section, this page says the following:
"In the Login Redirect URL, Timeout Redirect URL and Mobile Redirect URL textbox, paste the Login URL which you have copied from the Set up Workday section of Azure portal."

The "Login URL which you have copied from the ... Azure portal" is https://login.microsoftonline.com/{tenant-id}/saml2. However, this is the login/logout SAML endpoint for Azure AD.

Configuring the Login Redirect URL with this URL leads to the error "AADSTS750054: SAMLRequest or SAMLResponse must be present as query string parameters in HTTP request for SAML Redirect binding." Screenshot: https://i.imgur.com/JXT2Pm2.png

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 18eabd03-e535-e846-e4ad-c4394f581013
• Version Independent ID: 1d98ce13-5bb7-9cb8-c2b7-3c711a7e03e1
• Content: Tutorial: Azure Active Directory integration with Workday
• Content Source: articles/active-directory/saas-apps/workday-tutorial.md
• Service: active-directory
• Sub-service: saas-app-tutorial
• GitHub Login: @jeevansd
• Microsoft Alias: jeedes

[FrankHu-MSFT]

@cap273 Thanks for your feedback! We will investigate and update as appropriate.

[kulbirjandoria]

Having the same error, when integrating workday with Azure AD, Is there any solution for this error ?

[kulbirjandoria]

Is there any update on it?

[pbburkhalter]

I am having this issue as well, please update with the correct URL to use in the Workday IdP SSO Service URL textbox.

[jeevansd]

@kulbirjandoria and @pbburkhalter I will provide the screenshot for your reference.

[pbburkhalter]

Do you have a timeline for when you will provide the screenshot?

[jeevansd]

You shoudl configure it in this way.

[pbburkhalter]

I am pretty sure that's wrong. What you provided is basically what I am already using, except my tenant ID is obviously different than whatever you have in your link. Can you please double check?

[pbburkhalter]

@jeevansd the link that you posted is the exact same format as what is currently wrong in the documentation. You closed my other ticket and I'm happy to open a ticket with you guys but the documentation is wrong regardless.

[kulbirjandoria]

In Azure, under Basic SAML Configuration using an identifier as http://www.workday.com , resolves the problem. So please correct this documentation.

This was confirmed by workday support team, Please find the response from Workday Support team as below:
"Invalid Audience in SAML token: URL should start with http://www.workday.com, or end with /tenantname/login-saml.htmld

Your 'Audience' in Azure should match your "Service Provided ID" on the Workday side. It looks like both match but should be "http" instead of "https". I see Azure's documentation calls for "https", which is incorrect but their screenshot has the correct formatting of "http". Can you please update that in your "Edit Tenant Setup - Security", as well as in your Azure setup and try logging in again? "

[jeevansd]

@v-viinde and @v-nagta Can you please correct the Identifier value in this doc as stated above? I think this got changed in some other updates.

[pbburkhalter]

@kulbirjandoria This is also incorrect. That is a problem in the documentation but not what this original issue was opened for.

[jeevansd]

@pbburkhalter What the other issue you are referring to?

[jeevansd]

@chetansriv and @v-nagta for visibility.

[ayakimov]

We have our own backend which should talk with Azure AD. If i press test button on saml tab my non-galery app i see in log correct request from MS side to us. But then i open Login url I see the same issue as topic starter.

[jakobli]

Any update on this, having the same issue with a customer

[ayakimov]

@jakobli we solved it. We use python sdk (from OneLogin) and it have .login method which generate valid SamlRequest string (based on provided config). We just added it to https://login.microsoftonline.com/{tenant-id}/saml2SamlRequest= and now things works fine.

[jakobli]

To get this to work we had to configure the Login Redirect URL to https://wd3-impl.workday.com/{tenant}/login-saml2.htmld.

[prvb120793]

Hey Guys, i'm not sure if this is a right chain for this question. Hopefully someone can help me.
Were trying to configure Azure SSO for Workday-Test and once Workday is timeout were getting an error message. Is there a specific link to direct it to the myapps.microsoft.com after it Timeout?

[cap273]

@prvb120793 see this thread: https://social.msdn.microsoft.com/Forums/SECURITY/en-US/eb2d06e3-1a85-4a70-bf3d-7ed606e58000/workday-sso-with-azure-ad-mobile-app-login-redirect-url-and-timeout-redirect-url?forum=WindowsAzureAD

[gabrielmccoll]

@jeevansd Hi there, I'm getting the above issue following the documentation for workday too.
Not had any update in a while. Can you confirm please

of your support we provide an upgrade service for EV which is required now to ensure you stay in support and to resolve any potential performance issues.

[aaroncalderon]

@ayakimov Did you mean https://login.microsoftonline.com/{tenant-id}/saml2?SamlRequest=<base64_data>?

Adding the __question mark__ after sml2.

And, How else can one get a __SamlRequest__ string?

[aaroncalderon]

So, I solved my issue by updating the values of:

• __Login Redirect URL__
• __Mobile App Login Redirect URL__ and
• __Mobile Browser Login Redirect URL__

To https://<workdayhost>/<tenantname>/login-saml2.htmld.

Apparently I was '__Configure Service Provider-Initiated SAML Authentication__'

[v-nagta]

No action item is required

please-close