Bamboo HR

This integration requires configurations on both Fixiamand BambooHR, with steps that loop between both systems. For best results, complete the entire process in one session, following each step in order to avoid misconfiguration or delays

Step 1: Fill SAML Configuration on Fixiam

1. Log in to Fixiam: https://iam.seamfix.com/auth/sign-in
2. Go to Applications > Apps > Add New Application
3. Select Custom Application and choose Configure SSO using SAML, then click Next

4. Once you’ve selected Configure SSO using SAML, you’ll be directed to the Single Sign-On Configuration page. Follow these steps in order:
   1. Enter Service Provider (SP) Details
      1. SP Entity ID: Enter BambooHR-SAML
      2. ACS URL: Enter your BambooHR Assertion Consumer Service URL (e.g., https://<yourdomain>.bamboohr.com/saml/consume.php)
      3. Audience URL (Optional): Leave blank or enter if specified by BambooHR
      4. Single Logout URL (Optional): Leave blank unless logout URL is available
   2. Public Certificate: This will be used later on BambooHR, so leave it for now.
   3. Click Export Metadata or Copy Metadata URL:
      1. If you export the file, save it locally
      2. If you copy the URL, open it in a new tab to view the metadata XML
      3. From the XML, you will need:
         1. SSO Login URL (SingleSignOnService location)
         2. X.509 Certificate (needed in the next step)
      4. Save the current IAM configuration before switching to BambooHR. You will return later to complete the process if needed.

Step 2: Configure SAML in BambooHR

1. Log in to your BambooHR admin account: https://app.bamboohr.com/login/
2. Click the gear icon (⚙️ Settings) at the top-right and select Apps
3. On the Apps page, find SAML and click Install
4. In the SAML setup screen, fill in the fields as follows:

   1. SSO Login URL:

      1. Open the metadata XML file you downloaded or accessed from Fixiam
      2. Locate the SingleSignOnService with the Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
      3. Copy the Location value (this is the SSO Login URL)
      

   2. X.509 Certificate:

      1. Go back to the Fixiam SSO configuration page
      2. Copy the Public Certificate shown there (starts with -----BEGIN CERTIFICATE-----)
5. Paste it into the x.509 Certificate field in BambooHR

6. Check the option: “Allow Optional Email and Password Login” (for fallback access)
7. Click Install to activate the SSO configuration

Step 3: Confirm Configuration

1. Create a Group in Fixiam — e.g., BambooHR Users
2. Assign the BambooHR Application (just created) to this group
3. Add users to the group who should have access to BambooHR via SSO
4. Test the SSO Setup:
   1. Ask a test user in the group to access your BambooHR login URL
   2. If configured correctly, they will be redirected to Fixiam for authentication and then logged into BambooHR seamlessly
   3. ✅ If the login works as expected, your SSO setup is successfully complete!