WorkOS Docs Homepage
DashboardSign In


Learn how to configure a connection to VMware via SAML.

Each SSO Identity Provider requires specific information to create and configure a new Connection. Often, the information required to create a Connection will differ by Identity Provider.

WorkOS provides the SP Metadata link. It’s readily available in your Connection Settings in the WorkOS Dashboard.

A screenshot showing where to find the SP Metadata in the WorkOS dashboard.

Next, you will provide the Metadata URL from VMware.

Normally, this information will come from the organization’s IT Management team when they set up your application’s SAML 2.0 configuration in their VMware admin dashboard. But, should that not be the case during your setup, here’s how to obtain it.

In your Workspace ONE Catalog, click “New”. Give your application a descriptive name.

A screenshot showing how to create new application in VMware.

Click the “Configuration” tab from the left sidebar.

Copy the SP Metadata Link from your VMware connection in the WorkOS dashboard and paste it in the URL/XML field under Configuration in Workspace One.

A screenshot showing where to input WorkOS SP metadata when configuring VMware application.

Continue scrolling and expand “Advanced Properties”.

A screenshot showing where to find "Advanced Properties" dropdown in VMware application.

Enable “Sign Assertion” and “Include Assertion Signature”.

A screenshot showing where to enable "Sign Assertion" and "Include Assertion Signature" in VMware application.

Continue scrolling until “Custom Attribute Mapping”.

A screenshot showing where to find "Custom Attribute Mapping" in VMware application.

Fill in the following attribute mappings and select “Next” until you are prompted to “Save”.

  • id${user.objectGUID}
  • firstName${user.firstName}
  • lastName${user.lastName}
  • email${}
A screenshot showing how to configure attribute mappings in VMware application.

Some VMware configurations use user.ExternalId instead of user.objectGUID. In this case, you would map the id attribute to user.ExternalId.

Users can automatically be assigned roles within your application by sending their group memberships. To enable this, set up a group attribute statement following the guidance below.

This feature is currently in beta, contact customer support for more information.

To return this information in the attribute statement, map the groups in your identity provider to a SAML attribute named groups.

After saving your SaaS Application, click “Settings” then “SAML Metadata”. Click on “Copy URL” next to “Identity Provider (IdP) metadata”.

A screenshot showing where to find metadata URL in VMware application.

Back in the WorkOS Dashboard, click on “Edit Metadata Configuration” in the “Metadata Configuration” section of the Connection.

A screenshot showing where to edit the IdP metadata URL in the WorkOS dashboard.

Finally, input the Metadata URL and click “Save Metadata Configuration”. Your Connection will then be linked and good to go!

A screenshot showing how to configure IdP metadata URL in the WorkOS dashboard.