Skip to main content

SAML

Tutorial: Authenticate Using SAML with Azure Active Directory (a.k.a. Microsoft Entra ID)

Abstract

This tutorial shows the steps to authenticate your Users using SAML. You can configure CloudConexa SAML authentication to use Azure Active Directory as the Identity Provider.

Configuring CloudConnexa User authentication to use SAML

The Administrator can configure CloudConnexa to authenticate access to User Portal, download of WPC Profile, and WPC connections using a SAML 2.0 compliant Identity Provider.

The Administrator needs to follow the steps below. The steps below use Azure Active Directory as the Identity Provider. Basic configuration guides for some of the other popular Identity as a Service (IDaaS) providers are provided separately.

  1. Login to CloudConnexa Administration portal at https://cloud.openvpn.com and do the following:

    1. Navigate to Settings section and click on the User Authentication tab

    2. Click on the Edit button positioned on the top right

    3. Click on the Configure button under the SAML option

    4. The SAML Configuration web page opens in a new browser window/tab and show the information needed to configure CloudConnexa as a Service Provider in your Identity Provider

  2. Login to the administration console of the Identity Provider to configure CloudConnexa as a SAML Provider. The steps for Azure Active Directory are below:

    1. On the Active Directory main page click on Enterprise application option.

    2. Click on the New application button

    3. Select the non-gallery application option in the Add your own app section

    4. Provide name for your app and click Add. On the home page of your app, select the Set up single sign on option.

    5. Then choose SAML option. On the Set up Single Sign-On with SAML page click on the Edit icon and:

      • Enter the Issue Name displayed in the SAML Configuration web page of CloudConnexa into Identifier (Entity ID) input field of Azure Active Directory

      • Enter the SSO URL displayed in the SAML Configuration web page of CloudConnexa into the Reply URL (Assertion Consumer Service URL) input field of Azure Active Directory

    6. Scroll down the page to SAML Signing Certificate section. In this section you can copy the link shown in the App Federation Metadata URL field this will be needed later

    7. Azure Active Directory will only provide the NameID value to the Service Provider by default which CloudConnexa will map to the username of the User. If you want CloudConnexa to have more information about the User and to use the value of a specific User attribute to map the User into a CloudConnexa User Group, you need to configure parameters to be sent from Azure Active Directory to App. You can do that by filling in the User Attributes & Claims section of your App

      • You can also configure Azure AD to send groups using Active Directory attributes synced from Active Directory instead of Azure AD objectIDs. Only groups synchronized from Active Directory will be included in the claims. For example, you can send the Mail-Enabled Security Groups synchronized from Office 365. See, Microsoft Documentation on how a group claim can return the ‘Security group’ for the ‘Group ID’ Source attribute.

        Note

        The User Attributes & Claims appear in a shortened format on some configuration web pages. The complete URL form is needed for configuration. Refer to Troubleshooting Azure AD.

    8. Now that CloudConnexa has been set up as an application, you need to provide applicable Users access to CloudConnexa application by doing the following:

      1. Go to the Enterprise application menu, choose your created app and select Assign Users and groups

      2. Click on Add User

      3. Click on Users, then choose the User you want to assign to application and click on the Select button

      4. Then at the bottom of the page you will find active Assign button, click on it. The User should appear among the list of assigned Users

  3. Go back to the browser tab/window displaying the CloudConnexa and take the following actions:

    1. Click on the Next button

    2. Provide an Idp Name, Select IdP Metadata URL, and paste the App Federation Metadata URL value copied earlier in step ‘2.f’ into the IdP Metadata URL text field

    3. If earlier in step ‘2.g’ you had set up additional parameters to map into CloudConnexa User information, do the following or else click on the Next button:

      1. Expand the Advanced settings section

      2. In the Attribute Mapping section provide the Identity Provider parameter names corresponding to the CloudConnexa User information fields that you want to be populated with information from the Identity Provider’s parameters (SAML attributes) and click on the Next button when done

    4. Click on the Finish button after reviewing the SAML configuration

    5. Now that the SAML configuration is done, we need to enable SAML as the User authentication method by clicking on the Edit button in the User Authentication tab

    6. Select the SAML option

    7. If earlier in step 2.g’you had setup an additional parameter with the intention to map the value of that parameter to OpenVPN Cloud User Group, do the following or else click on the Update Settings button:

      1. Click on the Add Rule button

      2. Enter in SAML IdP User Group(s) field one or more of the values that will present in the IDP provided parameter that you had mapped to the Group attribute in step ‘3.c.ii’and select the corresponding you want those values to map into. For example, the IdP User’s department value of ‘DEV’ could map to CloudConnexa User Group ‘Dev’ which has been configured to provide access to resources for developers. Repeat the step to add more rules as desired and click on the Update Settings button when done

      3. If you are passing attributes synced from Active Directory instead of Azure AD objectIDs as mentioned in step 2.g.i, you need to find the value of the EnternalDirectoryObjectID that will be sent accross. For example to find the EnternalDirectoryObjectID for an Office 365 Security Group named ‘Dev’, you would use PowerShell to connect and signin to Exchange Online and run the command below and use the value returned for EnternalDirectoryObjectID to map to CloudConnexa User Group ‘Dev’ Get-DistributionGroup "Dev" | Format-List Name,ExternalDirectoryObjectID

    8. Click the Confirm button on the confirmation dialog

    9. SAML is now enabled

Sign in to the User Portal

Now that SAML is enabled for the WPC when a User wants to sign in to the User Portal to download Connect Client or manage Devices etc., the User will sign in using SSO credentials. When the User visits the User Portal (for example, at https://test8.openvpn.com), the User will see the Identity Provider’s login screen

62eac7b0e8c85.png

On successful first authentication, the Administrator will see the User details show up in the Administration portal.

62eac7b452667.png

In the screenshot above, you can see that the user1 has been added after SAML authentication because the Auth Source is shown as SAML.

Tutorial: Authenticate Using SAML with G Suite

Abstract

This tutorial shows the steps to authenticate your Users using SAML. You can configure CloudConexa SAML authentication to use G Suite as the Identity Provider.

Configuring CloudConnexa User authentication to use SAML

The Administrator can configure CloudConnexa to authenticate access to the User Portal, download of a .ovpn Profile, and WPC connections using a SAML 2.0 compliant Identity Provider.

The Administrator needs to follow the steps below. The steps below use G Suite as the Identity Provider. Basic configuration guides for some of the other popular Identity as a Service (IDaaS) providers are provided separately.

  1. Sign in to the CloudConnexa Administration portal at https://cloud.openvpn.com/.

    1. Navigate to Settings section and click on the User Authentication tab.

    2. Click on the Edit button positioned on the top right.

    3. Click on the Configure button under the SAML option.

    4. The SAML web page opens and shows the information needed to configure CloudConnexa as a Service Provider in your Identity Provider.

  2. Log in to the Google administration console to configure CloudConnexa as a SAML Service Provider, and follow steps below:

    1. Click on the menu and navigate to Apps > Web and mobile apps, then Add App "Add custom SAML app".

      g_suite_saml_apps.png

    2. Then, follow this 4 step procedure:

      Step 1. Enter an App name with a description, and click Continue.

      Step 2. Here, you'll find the Identity Provider (IdP) information needed later to configure CloudConnexa. Download the IdP Metadata file. Click Continue.

      Step 3. Provide the Service Provider Details:

      1. Enter the Issuer Name displayed in the SAML Configuration web page of CloudConnexa into the Entity ID input field.

      2. Enter the Configuration SSO URL displayed in the SAML Configuration web page of CloudConnexa into the ACS URL input field.

      3. Click Continue.

      Step 4. Attribute Mapping. Google IdP will only provide the NameID attribute to the Service Provider by default, which CloudConnexa will map to the username of the User. If you do not want CloudConnexa to have more information about the User and to use the value of a specific User attribute configuration, you can skip this step. Click the Finish button.

    3. Now that CloudConnexa has been set up as an application, you can assign it to all Users. Access the created SAML App (Apps > Web and mobile apps. Select the created App), Under "User Access" select "ON for everyone", then click Save.

      google_app.png

  3. Go back to the browser tab/window displaying the CloudConnexa and take the following actions:

    1. Click on the Next button.

    2. Provide an IdP Name. Select IdP Metadata XML, and do the following:

      1. Open the IdP metadata file that you downloaded in step ‘2.b of Step 2’ and copy the XML text shown.

      2. Paste the text into the IdP Metadata XML text field.

    3. If earlier in step ‘2.b of Step 4′ you set up additional parameters to map to the CloudConnexa User information, do the following or else click on the Next button:

      1. Expand the Advanced settings section.

      2. In the Attributes Mapping section, provide the Identity Provider parameter names corresponding to the CloudConnexa User information fields that you want to be populated with information from the Identity Provider’s parameters (SAML attributes) and click on the Next button when done.

  4. Click on the Complete button after reviewing the SAML configuration.

  5. Now that the SAML configuration is done, we need to enable SAML as the User authentication method by clicking on the Edit button in the User Authentication tab.

  6. Select the SAML option.

  7. If earlier in step ‘2.b of Step 4’ you set up an additional parameter with the intention to map the value of that parameter to the CloudConnexa User Group, do the following or else click on the Update Settings button:

    1. Under SAML, click the View Group Mapping button.

      authenticate_users.png

    2. Click the "+" button to add Rule.

    3. Enter into the SAML IdP User Group(s) field one or more of the values that will be present in the IdP provided parameter that you mapped to the Group attribute in step "3.c.ii", and select the corresponding parameters you want those values to map into. For example, the IdP User's department value of 'DEV' could map to CloudConnexa User Group 'Dev' which has been configured to provide access to resources for developers. Repeat the step to add more rules as desired and click on the Update Settings button when done.

  8. Click the Confirm button on the confirmation dialog.

  9. SAML is now enabled.

Now that SAML is enabled for the WPC, when a User wants to sign in to the CloudConnexa Administration portal to download the Connect Client or manage Devices etc., the User will sign in using SSO credentials. When the User visits the User Portal (for example, at https://test8.openvpn.com), the User will see the Identity Provider's login screen.

google_sso_login.png

Log in to CloudConnexa Portal

Now that SAML is enabled for the WPC when a User wants to sign in to the User Portal to download the Connect Client or manage Devices etc., the User will sign in using SSO credentials. When the User visits the User Portal (for example, at https://test8.openvpn.com ), the User will see the Identity Provider’s login screen

62eac7f248653.png

On successful first authentication, the Administrator will see the User details show up in the Administration portal.

cloudconnexa_user_screen_1.png

In the screenshot above, you can see that the user1 has been added after SAML authentication because the Auth Source is shown as SAML.

Tutorial: Authenticate Using SAML with Keycloak

Abstract

This tutorial shows the steps to authenticate your Users using SAML. You can configure CloudConexa SAML authentication to use Keycloak as the Identity Provider.

Steps: Retrieve certificate value and IdP endpoint from Keycloak

  1. Navigate to Keycloak and sign in with your Administrator account.

    62eac8433bfd4.png

  2. Access Realm Settings > Endpoints and click SAML 2.0 Identity Provider Metadatal.

    62eac84524bf0.png

  3. Copy the IdP X.509 Public Certificate and the IdP Authentication Endpoint URL, which are used later in the CloudConnexa set up process.

Steps: Configure and enable SAML in CloudConnexa

  1. Sign in to the CloudConnexahttps://cloud.openvpn.com/

  2. Access Settings > User Authentication and click Edit.

    saml_with_keycloak.png

  3. Click on Configure in the Authenticate Users Using > SAML section.

    • The SAML Configuration window opens. Click Next.

      saml_config.png

  4. Add your IdP Name (optional), and then select Manual Configuration.

    saml_config2.png

  5. Paste the previously copied IdP Authentication Endpoint URL and the IdP X.509 Public Certificate.

    62eac84b95b1c.png

  6. Click Next, review the displayed information, then click Finish.

    • You now have the option to use SAML to authenticate Users.

      saml_config3.png

Steps: Create a new Keycloak client

  1. Navigate to Keycloak and sign in as an Administrator.

    62eac84fb963c.png

  2. Access Clients and click Create.

  3. Set the Client ID to be the same as the Issuer Name that was displayed in the SAML configuration on the CloudConnexa portal:

    62eac85118508.png

  4. Select SAML as the Client Protocol.

  5. Enter the SSO URL for the Client SAML Endpoint:

    62eac85263f42.png

  6. Click Save.

    • The settings tab displays the default values.

  7. Enable Sign Assertions.

  8. Disable Client Signature Required and Force POST Binding.

  9. Set the Name ID format to email.

  10. Enter this value in Valid Redirect URIs, which allows redirects to the ACS URL:

    62eac853d34d8.png

    • All other values are left as default.

      62eac8555407c.png

Steps: Create a Keycloak User account

  1. Navigate to Keycloak, access Users, and click Add User.

  2. Fill out the form with your data.

    Note

    You can select Email Verified if you use a test email that doesn’t allow verification.

    62eac85890d93.png

  3. Open the Credentials tab and assign a password for the User account, and click Set Password.

    62eac85a1bb6f.png

Steps: Configure attributes and group mapping in Keycloak

  1. Navigate to Keycloak, access Clients, and click on your Client ID.

  2. Click on the Mappers tab, which allows you to create SAML attributes.

    Note

    At the time of publication, CloudConnexa only supports First Name, Last Name, Email, and Groups for mapping attributes.

  3. Click Create, and in Mapper Type select User Property.

  4. Add a separate attribute entry for each of First Name, Last Name, and Email.

    Note

    You must use these defined Property name values in the Property field.

    Attribute

    Property

    Purpose

    Email

    email

    To pass the email value to the service provider.

    First Name

    firstName

    To pass the first name value to the service provider.

    Last Name

    lastName

    To pass the last name value to the service provider.

  5. Set the SAML Attribute Name value to be the same as each corresponding Property name value.

  6. Click Create, and in Mapper Type select Group List to create a Group Mapper.

Note

You must use groups as the defined Group attribute name.

Attribute

Group attribute name

Purpose

Group

groups

To pass the groups value to the service provider.

62eac86100e09.png
62eac8629f97b.png
62eac8644d36a.png

Steps: Configure attribute mapping in CloudConnexa

To finalize your attribute mapping set up, you must ensure that the Property values and SAML Attribute values match the Attribute Mapping values in your SAML Configuration on CloudConnexa.

  1. Access CloudConnexa > Settings > User Authentication > SAML > View Attirbute Mapping to check that those values match :

62eac866528ae.png

Steps: Set up group mapping in CloudConnexa

  1. Access CloudConnexa Settings > User Authentication > SAML > View Group Mapping and click Add Rule.

  2. Enter the name of the group(s) from your identity provider under SAML IdP User Group(s) and then select a group from the CloudConnexa User Groups that you want to map to your IdP group(s).

62eac868e98bc.png

Steps: Sign in to User Portal with Keycloak

  1. Navigate to the CloudConnexa account page at: https://myaccount.openvpn.com/product-select

  2. Click Not an Owner? Sign In Here.

    • CloudConnexa recognizes that your domain uses SAML and displays the Single Sign On prompt.

      62eac85bef1d1.png

  1. Click Sign In.

    • The Keycloak Log In page opens.

  2. Enter the Keycloak test account email and password and click Log In.

    • The CloudConnexa Get Connected page opens with app download and installation instructions.

      62eac85d5587d.png
      62eac85f0aed1.png

Tutorial: Authenticate Using SAML with Okta

Abstract

This tutorial shows the steps to authenticate your Users using SAML. You can configure CloudConexa SAML authentication to use Okta as the Identity Provider.

Configuring CloudConnexa User authentication to use SAML

The Administrator can configure CloudConnexa to authenticate access to the User Portal, download of WPC Profile, and WPC connections using a SAML 2.0 compliant Identity Provider.

The Administrator needs to follow the steps below. The steps below use Okta as the Identity Provider. Basic configuration guides for some of the other popular Identity as a Service (IDaaS) providers are provided separately.

  1. Sign in to the CloudConnexa Administration portal at https://cloud.openvpn.com/.

    1. Navigate to Settings section and click on the User Authentication tab.

    2. Click on the Edit button positioned on the top right

    3. Click on the Configure button under the SAML option

    4. The SAML Configuration web page opens in a new browser window/tab and shows the information needed to configure CloudConnexa as a Service Provider in your Identity Provider.

  2. Login to the administration console of the Identity Provider to configure CloudConnexa as a SAML Service Provider. The steps for Okta are below:

    1. Navigate to Applications tab, Add Application and click on the Create New App button.

    2. Select Platform as Web and SAML 2.0 as Sign on method then click on the Create button.

    3. Provide an Application Name and click on the Next button. In the General tab:

      • Enter the Issuer Name displayed in the SAML Configuration web page of CloudConnexa into the Audience URI (SP Entity ID) input field of Okta

      • Enter the SSO URL displayed in the SAML Configuration web page of CloudConnexa into the Single Sign On URL Validator and ACS (Consumer) URL input field of Okta

      • Checkmark the Use this for Recipient URL and Destination URL option

      • Select EmailAddress as the Name ID format

      • Click on the Next button

    4. On the last page, select I'm an Okta customer adding an internal app, and click on the Finish button.

    5. Click on the Sign On tab and click on the View set up Instructions button.

    6. The X.509 Certificate and the Identity Provider Single Sign-On URL will be needed later. Copy and paste this information for use later or keep this browser window open.

    7. Now that CloudConnexa has been set up as an application, you need to provide applicable Users access to CloudConnexa application. Click on the Assignment tab of the application and assign it to applicable Users or select the User and assign the application.

    8. Okta will only provide the NameID value to the Service Provider by default which CloudConnexa will map to the username of the User. If you want CloudConnexa to have more information about the User and to use the value of a specific User attribute to map the User into a CloudConnexa User Group, you need to configure parameters to be sent from Okta to App See, https://help.okta.com/en/prod/Content/Topics/Users-groups-profiles/usgp-map-attributes.htm. In addition, refer to this support document.

  3. Go back to the browser tab/window displaying the CloudConnexa and take the following actions:

    1. Click on the Next button

    2. Provide an IdP Name Select Manual Configuration, and do the following:

      1. Click on the Next button

      2. Provide an IdP Name, Select Manual Configuration, and do the following:

        1. Paste the Identity Provider Single Sign-On URL value copied earlier in step ‘2.f’ into the IdP Authentication Endpoint

        2. Paste the X.509 Certificate copied earlier in step ‘2.f’ into theIdP X.509 Public Certificate

    3. If earlier in step ‘2.h you had set up additional parameters to map into CloudConnexa User information, do the following or else click on the Next button:

      1. Expand the Advanced settings section

      2. In the Attribute Mapping section provide the Identity Provider parameter names corresponding to the CloudConnexa User information fields that you want to be populated with information from the Identity Provider’s parameters (SAML attributes) and click on the Next button when done

    4. Click on the Finish button after reviewing the SAML configuration

    5. Now that the SAML configuration is done, we need to enable SAML as the User authentication method by clicking on the Edit button in the User Authentication tab

    6. Select the SAML option

    7. If earlier in step ‘2.h’ you had set up an additional parameter with the intention to map the value of that parameter to CloudConnexa User Group, do the following or else click on the Update Settings button:

      1. Click on the Add Rule button

      2. Enter in SAML IdP User Group(s) field one or more of the values that will present in the IDP provided parameter that you had mapped to the Group attribute in step ‘3.c.ii’and select the corresponding you want those values to map into. For example, the IdP User’s department value of ‘DEV’ could map to CloudConnexa User Group ‘Dev’ which has been configured to provide access to resources for developers. Repeat the step to add more rules as desired and click on the Update Settings button when done

    8. Click the Confirm button on the confirmation dialog

    9. SAML is now enabled

Login to User Portal

Now that SAML is enabled for the WPC when a User wants to sign in to the User Portal to download Connect Client or manage Devices etc., the User will sign in using SSO credentials. When the User visits the User Portal (for example, at https://test8.openvpn.com), the User will see the Identity Provider’s login screen

62eac8a30b7e5.png

On successful first authentication, the Administrator will see the User details show up in the Administration portal.

62eac8a4c1d74.png

In the screenshot above, you can see that the user1 has been added after SAML authentication because the Auth Source is shown as SAML.

Tutorial: Authenticate Using SAML with OneLogin

Abstract

This tutorial shows the steps to authenticate your Users using SAML. You can configure CloudConexa SAML authentication to use OneLogin as the Identity Provider.

Configuring CloudConnexa User authentication to use SAML

The Administrator can configure CloudConnexa to authenticate access to User Portal, download of WPC Profile, and WPC connections using a SAML 2.0 compliant Identity Provider.

The Administrator needs to follow the steps below. The steps below use OneLogin as the Identity Provider. Basic configuration guides for some of the other popular Identity as a Service (IDaaS) providers are provided separately.

  1. Sign in to the CloudConnexa Administration portal at https://cloud.openvpn.com.

    1. Navigate to Settings section and click on the User Authentication tab

    2. Click on the Edit button positioned on the top right

    3. Click on the Configure button under the SAML option

    4. The SAML Configuration web page opens in a new browser window/tab and show the information needed to configure CloudConnexa as a Service Provider in your Identity Provider

  2. Sign in to the OneLogin administration console to configure CloudConnexa as a SAML service provider.

    1. Navigate to Applications tab and click on the Add App button

    2. Enter SAML Test Connector (Advanced) in the search bar to find the application and click on it

    3. Provide a Display Name and click on the Save button to add the application and start configuring it

    4. Navigate to Configuration

    5. Enter the Issuer Name displayed in the SAML Configuration web page of CloudConnexa into Audience (Entity ID) input field of OneLogin

    6. Enter the SSO URL displayed in the SAML Configuration web page of CloudConnexa into both the ACS (Consumer) URL Validator and ACS (Consumer) URL input fields of OneLogin

    7. Select Assertion as the drop-down list value for the SAML signature element field and click on the Save button

    8. OneLogin will only provide the NameID value to the Service Provider by default which CloudConnexa will map to the username of the User. If you want CloudConnexa to have more information about the User and to use the value of a specific User attribute to map the User into a CloudConnexa User Group, you need to configure additional parameters to be sent by navigating to the Parameters tab and clicking on the Add (+ icon)

    9. Click on the Include in SAML assertion checkbox, provide a Field Name, and click on the Save button

    10. Choose and select a Value that is one of the attributes of the User. You can search for the attribute too.

    11. Click on the Include SAML assertion checkbox and click on the Save button

    12. Repeat the above process for adding more parameters that will correspond to the username, email, first name, last name, and User Group of CloudConnexa User. Once done, navigate to the SSO tab

    13. Click on the copy/paste icon next to the Issuer URL in order to copy the value in the field. This will be used later in the CloudConnexa configuration.

    14. Now that CloudConnexa has been set up as an application, you need to provide applicable Users access to CloudConnexa application. One of the ways to do this is to:

      1. Select the User and click on the Applications tab

      2. Click on the Add (+ icon) to add an Application for the User

      3. Select the newly configured CloudConnexa application and click on the Continue button

  3. Go back to the browser tab/window displaying the CloudConnexa and take the following actions:

    1. Click on the Next button

    2. Provide an IdP Name and paste the Issuer URL value copied earlier in step ‘2.m’ into the IdP Metadata URL

    3. If earlier in step ‘2.h’ you had set up additional parameters to map into CloudConnexa User information, do the following or else click on the Next button:

      1. Expand the Advanced settings section

      2. In the Attribute Mapping section provide the Identity Provider parameter names corresponding to the CloudConnexa User information fields that you want to be populated with information from the Identity Provider’s parameters (SAML attributes) and click on the Next button when done

    4. Click on the Finish button after reviewing the SAML configuration

    5. Now that the SAML configuration is done, we need to enable SAML as the User authentication method by clicking on the Edit button in the User Authentication tab

    6. Select the SAML option

    7. If earlier in step ‘2.h’ you had set up an additional parameter with the intention to map the value of that parameter to CloudConnexa User Group, do the following or else click on the Update Settings button:

      1. Click on the Add Rule button

      2. Enter in SAML IdP User Group(s) field one or more of the values that will present in the IDP provided parameter that you had mapped to the Group attribute in step ‘3.c.ii’and select the corresponding you want those values to map into. For example, the IdP User’s department value of ‘DEV’ could map to CloudConnexa User Group ‘Dev’ which has been configured to provide access to resources for developers. Repeat the step to add more rules as desired and click on the Update Settings button when done

    8. Click the Confirm button on the confirmation dialog

    9. SAML is now enabled

Login to User Portal

Now that SAML is enabled for the WPC when a User wants to sign in to the User Portal to download Connect Client or manage Devices etc., the User will sign in using SSO credentials. When the User visits the User Portal (for example, at https://test8.openvpn.com), the User will see the Identity Provider’s login screen

62eaddf999381.jpg

On successful first authentication, the Administrator will see the User details show up in the Administration portal.

saml_user.png

In the screenshot above, you can see that the user1 has been added after SAML authentication because the Auth Source is shown as SAML.

Authentication during Profile download

Now that SAML is enabled for the WPC when a User wants to add the WPC Profile using Connect Client, the User will sign in using SSO credentials.

62eaddfccabe5.jpg

Authentication during WPC connection

Now that SAML is enabled for the WPC when a User belonging to a User Group whose Authentication Type parameter is set as Password and Profile wants to connect to the WPC using Connect Client, the User will sign in using SSO credentials.

62eaddfec93f5.jpg

Tutorial: Login to User Portal From SAML Identity Provider

Abstract

You can have your users to sign in to the CloudConnexa User Portal directly from your SAML IdP application dashboard.

If you want your Users to sign in to the CloudConnexa User Portal directly from your Identity Provider’s application dashboard, please follow the steps below:

Note

Sign in from the Identity Provider’s dashboard will not result in a WPC connection. Users will still need to establish a WPC connection using OpenVPN Connect client.

  1. First, carry out the steps below to find the value of the Relay State used during the SAML authentication:

    1. Install and open SAML extension (https://chrome.google.com/webstore/detail/saml-devtools-extension/jndllhgbinhiiddokbeoeepbppdnhhio?hl=en-US) using Chrome web browser

    2. Login to CloudConnexa as a User by opening https://[cloud-id].openvpn.com using the Chrome web browser

    3. Find and click on the resulting SAML response/request in the opened SAML extension

    4. Find and copy the value for Relay State (see the screenshot below)

      62eac7855c49a.png

    5. Paste the copied value into https://www.urldecoder.org/ and decode

  2. Log into the Identity Provider’s Administration portal and carry out these steps:

    1. Open the settings for the application configured to represent CloudConnexa

    2. Copy decoded value from step 1.e and paste it in the Relay State or equivalent field

  3. After some time, changes will take effect on IdP side and Users will be able to login to the CloudConnexa User Portal from the Identity Provider’s application dashboard.

In this section: