This article describes how to integrate RSA with BambooHR using SAML Relying Party.

Configure RSA Cloud Authentication Service

1. Sign in to the RSA Cloud Administration Console.
2. Navigate to the Authentication Clients menu, and from the dropdown, select Relying Parties.
3. In the Relying Party Catalog, select Add a Relying Party and click Add for Service Provider SAML.
4. On the Basic Information page, enter a name for the application in the Name field and click Next Step.
5. In the Authentication tab, select SecurID manages all authentication.
6. Select the Primary Authentication Method and Access Policy for Additional Authentication as required and click Next Step.
7. Specify the Service Provider details in the following format: 
   1. Assertion Consumer Service (ACS) URL: https://<tenant>.bamboohr.com/saml/consume.php.
   2. Service Provider Entity ID: <BambooHR Entity ID>.

8. In the SAML Response Protection section, select IdP signs assertion within response, and download the certificate by clicking Download Certificate.
9. Under the User Identity section, select Show Advanced Configuration, then configure Identifier Type and Property as follows: 
   1. Identifier Type: Auto Detect 
   2. Property: Auto Detect

8. Click Save and Finish.
9. On the My Relying Parties page, click Edit dropdown and select Metadata option to download the metadata.
10. Click Publish Changes to save your settings. After publishing, your application will be enabled for SSO.

Notes

• The ACS URL can be constructed by replacing the value in the tenant tag. The tenant value is most likely the company name or domain -- https://<tenant>.bamboohr.com/saml/sp_metadata.php
• The default Entity ID for BambooHR is BambooHR-SAML.

Configure BambooHR

1. Log in to BambooHR with admin credentials.
2. Click the Gear icon in the top right corner and select Apps.
3. If the SAML Single Sign-On app is not pre-installed, search SAML Single Sign-On and click Install.
4. Click the SAML icon, then click Settings.
5. Provide the required details and click Save.
   1. SSO Login URL - The value of SingleSignOnService URL, obtainable from the metadata file downloaded from the RSA platform.
   2. x.509 Certificate - Upload the certificate downloaded from the RSA platform.

The configuration is complete.
Return to BambooHR - RSA Ready Implementation Guide