OneLogin
OneLogin
Single sign-on (SAML 2.0)
In the portal, choose OneLogin under Enterprise SSO and Start with OneLogin. Then, in OneLogin:
- In OneLogin, go to Applications → Applications and click Add App.
- Select SAML Custom Connector (Advanced), give it a display name and Save. To provision over SCIM as well, pick SCIM Provisioner with SAML (SCIM v2 Enterprise, full SAML) instead.
- On the Configuration tab, enter Audience (EntityID), Recipient, ACS (Consumer) URL Validator and ACS (Consumer) URL below, and set SAML nameID format to Email.
- Save, then copy the Issuer URL from the SSO tab.
- Assign the app to the people who should sign in.
The values the portal shows
| OneLogin field | Value |
|---|---|
| Audience (EntityID) | The portal's entity ID (https://…/sso/saml/…) |
| Recipient | The portal's ACS URL (https://…/sso/saml/…/acs) |
| ACS (Consumer) URL Validator | A pattern matching exactly the ACS URL; the portal shows it |
| ACS (Consumer) URL | The portal's ACS URL (https://…/sso/saml/…/acs) |
| SAML nameID format | Email |
| Single Logout URL, optional | The portal's Single Logout URL (https://…/sso/saml/…/slo) |
What to bring back
Copy Issuer URL and paste it into the portal's Metadata URL or XML.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
OneLogin's own guide: https://docs.oneidentity.com/bundle/onelogin_app-integration/page/guides/appintegrations/advanced-saml-custom-connector.htm.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Directory Sync (SCIM)
In the portal, choose OneLogin under Directory sync and Create directory; copy the bearer token now, it is shown once. Then, in OneLogin:
- Add the app from SCIM Provisioner with SAML (SCIM v2 Enterprise, full SAML) — the SAML Custom Connector cannot provision.
- On the Configuration tab, under API Connection, enter the SCIM Base URL and SCIM Bearer Token below, and Save.
- Click Enable to connect, then on the Provisioning tab select Enable Provisioning and Save.
- Only then complete the SAML settings on the Configuration tab, as in the sign-in guide.
The values the portal shows
| OneLogin field | Value |
|---|---|
| SCIM Base URL (Configuration → API Connection) | The portal's SCIM base URL (https://…/scim/v2) |
| SCIM Bearer Token (Configuration → API Connection) | The bearer token the portal shows once |
OneLogin's own guide: https://docs.oneidentity.com/bundle/onelogin_app-integration/page/guides/appintegrations/creating-scim-custom-connectors.htm.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.
- Directory Sync — the portal's SCIM setup.