Tutorial: How to Configure SAML with OneLogin
Overview
Access Server 2.11 and newer supports SAML-based authentication with OneLogin as the identity provider. You can configure this in OneLogin with Access Server as your service provider.
The following steps guide you through enabling SAML authentication for users and groups from OneLogin to Access Server.
Prerequisites
You need the following to get started:
A deployed OneLogin domain.
A deployed Access Server.
With OneLogin, you need to create an application for the SAML integration.
First, gather information about your Access Server as the service provider (SP).
Sign in to your Access Server Admin Web UI.
Select Authentication → SAML.
You'll need the following information:
SP Identity.
SP ACS.
Sign in to your OneLogin domain as an admin.
Select Menu → Applications → Applications.
Select Add App.
In the search, enter ‘SAML custom connector’ and select SAML Custom Connector (Advanced) from the results.
Enter the Display Name and ensure you enable Visible in portal.
Add icons and a description, then select Save.
Select Configuration from the menu on the left.
Enter your SP information as follows:
RelayState: Enter ‘cws’ if you want your users to sign in to the Client Web UI, and enter ‘profile’ if you want users to download a profile for their VPN client after they authenticate. For more information about RelayState, refer to the section below, “Set up IdP-initiated sign-on in OneLogin.”
Audience (Entity ID): Enter the SP Identity from Access Server.
ACS (Consumer) URL Validator: Enter the SP ACS from Access Server.
ACS (Consumer) URL: Enter the SP ACS again from Access Server.
Under SAML signature element, select Assertion from the drop-down.
Select Save.
You’ve added the SAML client for your OneLogin domain.
The simplest way to set up OneLogin SAML for Access Server is by providing metadata to Access Server. You can copy a metadata URL or download a metadata XML file.
Option 1: Copy the OneLogin metadata
From your SAML app integration created in Step 1, select SSO from the left menu.
Copy the Issuer URL.
Option 2: Download the OneLogin metadata file
From your SAML app integration created in Step 1, select the More Actions drop-down.
Select SAML metadata to download the XML file.
Now that you have the metadata, you can provide that to your Access Server through the Admin Web UI to automatically configure SAML.
If you copied the URL, follow the steps below to paste it into the SAML page for Access Server. If you downloaded the XML file, follow the steps below to upload it to the SAML page for Access Server.
Option 1: Paste the OneLogin metadata URL in the Admin Web UI
Sign in to your Access Server Admin Web UI.
Select Authentication→ SAML.
Select Configure Identity Provider (IdP) Automatically via Metadata to expand the section.
Paste the Issuer URL from OneLogin into the IdP Metadata URL field, select Get, and select Update Running Server.
The IdP fields are now populated under Configure Identity Provider (IdP) Manually.
Option 2: Upload the OneLogin metadata file in the Admin Web UI
Sign in to the Admin Web UI.
Select Authentication → SAML.
Select Configure Identity Provider (IdP) Automatically via Metadata to expand the section.
In the field Select IdP Metadata, select Choose File to upload the XML file you downloaded from OneLogin, then select Upload and Update Running Server.
The IdP fields are now populated under Configure Identity Provider (IdP) Manually.
After saving, you should see the following data populated automatically by either the URL or the XML file:
IdP EntityId.
Sign On Endpoint.
Certificate (PEM format).
Once you’ve provided the SAML configuration for your IdP, you can enable it for users.
Sign in to the Admin Web UI.
Select Authentication → SAML.
Select the toggle to turn on Enable SAML authentication.
Select Save Settings and Update Running Server.
You can now enable SAML as the global default authentication or for specific groups and users.
With SAML enabled for Access Server, you must add the app integration to your OneLogin users requiring access.
Sign in to your OneLogin domain as an admin.
From the menu, select Users → Users and select a user.
Select Applications.
Select the Add icon.
Select your SAML integration application from the Select application drop-down and select Continue.
Review the information for the user on the next screen, then select Save.
You can now test that the user can sign in to Access Server using SAML.
You can configure an IdP-initiated flow for signing into Access Server from OneLogin with the following steps:
Sign in to your OneLogin domain as an administrator.
Select Applications → Applications.
Select your SAML app integration.
Ensure that Visible in portal is enabled.
Select Configuration from the left menu.
Enter one of the following into the RelayState field:
cws: This directs your users to the Client Web UI after sign-in.
profile: This directs your users to a profile download after sign-in.
Save changes.
Test that the option displays for your users (for example, using the 'profile' relay state):
Sign in to your OneLogin portal as a SAML user.
Find the SAML app linked with Access Server and select it.
The user should be directed to the Import profile in App page without additional authentication requirements.
You can automate group assignments for access control rules using a post-authentication Python script.
Refer to the steps in this tutorial: