First some clarification: The path that you are rewriting to is not a URL, it is a local server filepath. Further, it is more accurate to call example.com/sub/workflow "the URL to be rewritten," while index.php?option=com_user&view=login&return=aHR0cDovL3d is the "rewritten filepath" after this rule is invoked.
Sticking with the proper terms here may make the problem (or at least the responses you get here) easier to understand.
So this rule rewrites *from* the client-requested URL-path example.com/sub/workflow *to* the server local filepath /sub/index.php?option=com_user&view=login&return=aHR0cDovL3d
Note that I removed the trailing "=" in the following discussion and code, as it seems to have no "name" or "value" associated with it.
I don't see anything blatantly 'wrong' with this code, but there are several 'red flags' that may indicate errors.
First, you should not be needing to use RewriteBase here, unless *all* requests to this server are aliased by the server configuration to resolve to the "/sub" subdirectory.
Second, you have no [L] flag on the end of this rule, meaning that any subsequent rules will also be processed after this rule executes, possibly further changing the target path, corrupting it (due to a knowm Apache mod_rewrite bug), or even changing it to an external client redirect, exposing your filepath as a URL in the process -- with bad effect on your search results listings.
Problems may also accrue if you don't have [L] flags on rules preceding this one, or if any of your rules are not in the correct order. Generally, you want all redirects first, in order from most-specific patterns and conditions (affecting the fewest requested URLs) to least-specific patterns and conditions (affecting more URLs), followed by all internal rewrites, again in order from most- to least-specific.
I would suggest trying the following in example.com/.htaccess :
Options +FollowSymLinks -Indexes -MultiViews
RewriteEngine on
RewriteBase /
#
RewriteRule ^sub/workflow$ sub/index.php?option=com_user&view=login&return=aHR0cDovL3d [L]
Also, be sure to delete your browser cache before testing any changes to this code. Otherwise you will likely see stale pages and server responses cached by your browser, confusing and invalidating your test results.
Jim