Authentication

In my limited experience with a Workday/Moodle SSO implementation, SSO was achieved by moving the authentication to a cloud based identity provider. Then, Moodle was configured via the SAML plugin to utilize that external identity provider, as well as Workday being configured to use the same external identity provider. https://community.workday.com/node/203 This framework allows you to bring additional services online in the future using the same SSO authentication framework.

If you have an existing identity provider framework, the above scenario could work for you. 

If you do not currently have identity provider infrastructure, and having one is outside the scope of what is possible for you, then the use case I described probably won't work so well for you. In this case it would seem you might want Workday to authenticate against Moodle, thereby having Moodle be the identity provider for Workday. I have done some analysis on making Moodle work as a SAML identity provider, as this is a somewhat frequent need that arises. I think I have even come across some project at one time that attempted to d this very thing. I have not gone any further than analysis and mini feasibility study, sometimes even wondering if doing it this way might be a "bad idea" for some reason. I am curious what others familiar with this even think about that idea...

Jamie