Workfront

If you are seeing a discrepancy between WF active users and the Admin Console assigned users please submit a support case so we can investigate further. There are a variety of things that can cause this to occur so a support agent will need to access your console and WF. If you have some users who are showing as deactivated in WF but assigned in the AC provide the emails as examples to assist them.

As a note - I have investigated two admin consoles HOWEVER feedback from the community is that you need to keep logging in and out of Adobe products.

So for example Creative Studio who use Creative Cloud and Workfront for their job will need to keep logging in and out all day to get information on the artwork they are creating.

Kindest

Em

Hi @EmmaGr,

Suppose you set up SSO in the existing console. In that case, you can use SSO for all newly created users without converting any existing users to SSO (though you can convert Adobe ID users to Federated ID once it's been set up if desired). But if you set up SSO in that console, any new users would be created as Federated ID users and would have to log in via SSO, for all Adobe products in that console. 

If you do not want other Adobe product users to log in via SSO, the recommendation would be to use a separate admin console, but as you mentioned, this creates more work for end users as they have to manage signing into multiple accounts. 

Thanks! 

@McKayWh Thank you for the above.

Hey Cathy! I know that Rexx and McKay will have to handle technical questions, but Rexx sent me a Word doc that might help with the end user communication.  I'm uploading the Word version so that anyone who might need it can download it and edit it for their org.  Hopefully this helps!

Hi @CathyKe1 ,

It sounds like you have two instances of Experience League accounts tied to your current support account. I'd recommend you continue to use the "Personal Account" option since that is the one tied to your support cases. I believe Support cases can be moved with an account merge. Let me know if you'd like to move over all your account and support activity to your "Company or School Account" account instance and I'll connect with you after this event.

The username/password authenitcation only applies to WF modules. Existing connections will continue to work however, when setting up new connections you will not be able to authenticate with a WF username/password.

If you need to setup a new connection I recommend logging into WF first as the user you want to establish the connection through. Once logged into WF access Fusion and create the connect. This will recognize the active WF session and take care of all other authentication needs automatically.

If you do not use the above method, you will be prompted to sign into WF through the admin console while creating the connection. Enter in the AC credentials for the use you want to establish the connection through.

Once created the connection holds the credentials so you will not need to authenticate again.

You can still add users to WF through the API. When this is done the user needs a System Admin approval before they can be activated in WF and pushed to the AC.

You can also use the Admin Consoles UMAPI functionality to add users to the AC and assign the WF product. This does not require system admin approval and would only take a few minutes for the user to be added to the WF product. You would need to contact the AC team if you need assistance in setting that up.

There is no way to see this info from your side, but you can contact our support team if you ever have a specific need to track this kind of information down across multiple Admin Consoles across your org. 

Ultimately this is something you should make sure you test in a Sandbox environment and ensure it's working before you complete your Production migration, but I would expect you'll need to make some changes in this case. 

The sync between Workfront and the Admin Console is bi-directional, but for that to work the user has to have an active IMS session, which a bot account connecting to the Workfront API won't have - so the bot account can't create a user in the Admin Console this way. 

I suspect you will need to update your Fusion scenario to connect to our User Management API (https://adobe-apiplatform.github.io/umapi-documentation/en/UM_Authentication.html) and create the user in the Admin Console first, which you can then assign to Workfront and then use the Workfront modules to update any user details needed after they've been created. 

The WF SSO configuration will be going away and the AC SSO config will be the new way authentication is handled. You will want to setup that configuration to work with your orginizational needs. You can have more than one SSO configuration in the console but you can only have 1 configuration per claimed domain.

For example I can have an SSO configuration setup for @adobe.com users and then a different SSO configuration for @workfront.com users.
IF you are not using different domains then users will need to be updated based on what configuration the AC is using.

Your migration specialist can migrate users from WF into that Admin Console. You will just want to let them know you want to do that and for which environments.
Users do have to be added to the WF environment inside of the console before they can access WF. If you are looking for a way to automate this and get a Auo-provisioning like functionality that exists in WF you can setup AD Sync/ UMAPI in the AC to accomplish this. If you need assistance in setting this up you will submit a case with the AC team.

Documentation for AD Sync/UMAPI https://helpx.adobe.com/enterprise/using/user-sync.html

Thank you that helps. What about users who are external and can't authenticate using the AC SSO that's currently set up? Will I need to add them manually to AC and assign WF to them?

Similiar to WF with non SSO users they will need to be manually added to the AC and assigned to the WF product. They will be setup as an Adobe ID instead of a federated which will allow them to use a Username/Password to authenticate into the console and gain access to WF.

In order to access Workfront, a user must first be assigned to the Workfront product profile in the Admin Console. If you want users to get added to Workfront automatically, you'd need to set up something like AD Sync or a UMAPI integration in the Admin Console as Rexx mentioned in an earlier thread here. 

Thank you

My previous comment - https://experienceleaguecommunities.adobe.com/t5/workfront-events/workfront-coffee-break-wednesday-m...

When the user is migrated to the admin console (or when you add a new external user) they will receive an email from Adobe with a link to finish setting up their profile and set a password. Admins will no longer set passwords for users - users will set their own passwords. 

Our internal users will use SSO. Are they going to receive this email when we migrate them to the admin console? If so, it will be confusing to the users.