Recommended approach for Service Account authentication in WCC when SAML is enabled

Products

• Autosys Workload Automation

Issue/Introduction

An application team uses a service account with a username and password to perform routine health checks on the WCC GUI. Since enabling SSO-SAML disables traditional credential-based login, and the service account cannot interactively respond to MFA challenges, the account cannot be used to do the WCC job monitoring.

Cause

 If you do not enable  "Support non sso login" option in the WCC Configuration page,  a non SAML account would not have a way to login to WCC UI.

Resolution

When implementing SSO-MFA for WCC, service accounts that require non-interactive access should typically utilize one of the following strategies:

1.  If you enable "Support non sso login" option in the WCC Configuration page, then any user would then be able to access https://<example.com>:8443/wcc/ui/Login.html page and provide credentials manually to login to WCC.
NOTE:  With SAML configured and enable "Support non sso login"

• If users bookmarked Login.html,  they'll still get prompted to provide traditional user/pass,  even if they've been SAML tokened already.
• If users bookmark  https://alias-or-hostname.example.com:8443  they'll go through SAML

2.  Work with SAML admins to see if you can exclude Service Accounts from MFA Policy.  Configure the Identity Provider (IdP), to exclude specific service account IDs from the MFA requirement. This allows the account to authenticate via SSO using only its credentials without a secondary prompt. Access should be restricted to specific trusted source IP addresses to maintain security.