Concept: VNDLY Authentication Methods

VNDLY supports 2 types of user authentication methods that provide different levels of security:

VNDLY sign-in with username and password.

SAML Single Sign-On (SSO).

Sign-in With Username and Password

This is the basic authentication method offered by VNDLY. Users input their assigned VNDLY username and their password. VNDLY verifies the password entered matches the user's record and grants them access. There's no additional verification or authentication unless multi-factor authentication (MFA) is also configured for the tenant.

Administrators can configure VNDLY to use MFA for enhanced security for client users, vendors and contractors. MFA is a method of confirming the identity of a user by requiring more than 1 type of identity verification. Workday recommends that you enable MFA in all of your tenants to provide additional security. When enabled, users must present a separate one-time password (OTP) token that validates their identity. This validation provides additional security by preventing unauthorized access in the event that a password is compromised. Most often, VNDLY users will download an authenticator app on their smartphone and use it to obtain the OTP token. Users without a smartphone can use a browser-based option. The OTP token is only available for a particular site and user account, and is only valid for a short period of time (usually 30 seconds).

Key Features: The username and password authentication method is VNDLY’s standard sign-in method and doesn’t include any other identity validation.
VNDLY stores user passwords in an AES-256 encrypted database and uses the PBKDF2 algorithm with a SHA256 hash, a password stretching mechanism recommended by the National Institute of Standards and Technology (NIST).
When implementing MFA, VNDLY administrators must configure MFA for each user type (client users, vendors and contractors) and users must set up MFA on their smartphone.
Users signing in with MFA can opt to trust the device they’re using to bypass the need for an OTP token at each sign-in for 30 days.
Multiple authenticator apps integrate with VNDLY.
Example Sign-in Process With MFA: The user must complete a one-time MFA setup prior to signing in with MFA.

A user signs into VNDLY from a browser with their username and correct password.
VNDLY verifies their password is the expected password and displays the token login window.
The user accesses the designated 3rd party authenticator app (or designated website) and obtains the OTP token.
The user inputs the token (usually 6 digits) into the token login window.
VNDLY verifies the token is valid and grants the user access.

SAML Single Sign-On (SSO)

Security Assertion Markup Language (SAML) is an XML-based framework for transferring identity data between 2 entities: a service provider (SP) and an identity provider (IdP). VNDLY is considered an SP. With SAML, the SP (VNDLY) agrees to trust the IdP to authenticate users. In return, the IdP performs the authentication and generates an authentication assertion, which indicates that a user has been authenticated.

Key Features: Ease of access for users.
Increased security with a single point of authentication.
Reduced costs for user maintenance in VNDLY.
VNDLY administrators must configure SSO for the user type (client users, vendors and contractors).
VNDLY supports the SAML 2.0 SSO standard for signing in to VNDLY from other identity providers.
Example of Sign-in Process With SAML SSO: A user signs into VNDLY from a browser with their username, which is configured to use SSO.
The browser redirects the request to the IdP.
The IdP authenticates the user (through username and password or two-factor authentication) and generates a SAML response.
The IdP sends the SAML response to the SP for verification.
If the verification is successful, the SP grants the user access to VNDLY.

Clients can also set up links within their intranet portal to authenticate and log users into VNDLY using SSO.