This article only applies to your community if your Firstup contract includes this functionality. Please contact your Customer Success Manager with any questions about feature availability for your community.

UKG Authentication is a change to the UKG tenant’s sign-in setup for UKG Pro Workforce Management. For tenants that UKG has migrated, this changes the way users authenticate with UKG, which in turn changes how that UKG tenant connects to Firstup.

The main difference with this flow is that the customer creates and configures their own OAuth app in their UKG tenant and shares the resulting details with Firstup. In the older flow, the customer obtained the app credentials through UKG Support. In the new flow, the customer sets up the app directly in UKG, and Firstup uses those details to connect securely through the OAuth authorization code flow on behalf of the signed-in user.

Use this guide if your UKG Pro Workforce Management tenant has been migrated by UKG to the new UKG Authentication sign-in flow (also known as Auth0). If you have not been migrated by UKG to the new sign-in flow, follow Enabling UKG Pro Workforce Management Integration for guidance.

Firstup supports both sign-in methods so customers can move to the new flow as their tenant is updated. It does not change what the integration can do. 

When this new flow is enabled for your tenant, Firstup uses the OAuth authorization code flow to connect securely to UKG on behalf of the signed-in user. 

Note: Signed-in users are automatically logged out by UKG after 24 hours.

Before You Start

Before you begin, make sure you have the following ready to share with Firstup:

• Your UKG tenant Base URL (do not include a trailing slash)
• Your UKG Authentication Auth Host (host only, with no extra path appended)
• Your Realm
• Your Organisation ID
• A Client ID and Client Secret from a new OAuth application created in your current UKG tenant
• Confirmation that your UKG tenant has been migrated to the new UKG Authentication sign-in flow
• The Firstup redirect URI / callback URL registered in your UKG OAuth application for your environment, provided by Firstup. Reach out to your Firstup representative if you do not have this

Important notes:

• The Base URL should be the tenant URL only, with no trailing slash
• The Auth Host should be the UKG Authentication host only, with no extra path appended
• Make sure the Client ID and Client Secret come from the OAuth app created in your current UKG tenant
• The Client Secret is sensitive and should be shared securely
• The integration uses the signed-in user’s own account, so each user signs in with their own UKG credentials

Enable UKG Pro Workforce Management (UKG Authentication / authO)

To enable the integration on a tenant that uses UKG Authentication, you will need to create an OAuth application in your UKG environment and send Firstup the configuration details below.

Create an OAuth application in UKG

1. Sign in to your UKG environment as an administrator.
2. Open WFM Client Management.
3. Create a new OAuth client / application for the Firstup integration.
4. Set the Application Flow to Interactive.
5. Set the Grant Type to Authorization Code.
6. Register the Firstup Redirect URI / callback URL for your environment. 
   • Firstup will provide you with the correct URI for your tenant. Reach out to your Firstup representative if you have not received one.
   • The redirect URI must match exactly. 
7. Save the OAuth application and note the values UKG generates.

Notes: 

• This authentication setup is not yet available for EU environment. 
• Your UKG UI and exact wording may differ from the steps above.

Send Firstup the required values

Please send Firstup the following information from your UKG tenant:

Confirm the redirect URI in UKG

Make sure the redirect URI you register in UKG matches the Firstup callback URL exactly. If the URLs do not match, sign-in will fail.

What happens after setup

Once you send Firstup the values above, Firstup will add the configuration to your integration and activate it for your program. After that, users can connect and use the integration through the new UKG Authentication flow.