SSO: OneLogin

This article describes how to configure OneLogin as your workplace's single sign-on identity provider (IdP). This process involves making modifications to your OneLogin environment and your digital workplace. Once complete, users of your digital workplace will be able to sign in to it using their OneLogin credentials.

To follow this process, you must be able to add applications to your OneLogin environment and be a workplace administrator in your digital workplace.

Sections in this article:

Configuring a OneLogin single sign-on application

Follow these steps to configure a SAML app in your OneLogin environment:

  1. Go to the Apps section of your OneLogin account and select Add App.

    The Add App button.

  2. Search for Igloo and select the option Igloo Branded Domain.

    The Igloo Branded Domain app.

  3. Select Save to add this app.
  4. Go to the Configuration tab and enter your digital workplace domain.

    The domain field.

  5. Go to the Parameters tab and record the names being used for:
    • Email
    • First Name
    • Last Name
    • NameID

      The parameters tab showing attribute mappings.

  6. Go to the SSO tab and record these values:
    • X.509 certificate
    • SAML 2.0 Endpoint
    • SLO Endpoint

      The SSO tab.

 

Configuring your digital workplace's single sign-on

  1. Go to your digital workplace and sign in.
  2. Select  Control Panel.
  3. Under Membership, select Sign In Settings.
  4. Select Configure SAML Authentication.
  5. Configure the settings as described in the Configuration settings table below.
  6. Select Save.
Setting Description
Connection Name Enter a name for this connection. If you configure Sign in Settings to Use SAML button on Sign in screen, this name will be displayed on the button.
IdP Login URL

Copy and paste the SAML 2.0 Endpoint from the OneLogin configuration instructions into this field.
IdP Logout URL Copy and paste the SLO Endpoint from the OneLogin configuration instructions into this field.
Logout Response and Request HTTP Type Select POST.
Logout Final Redirect URL Enter the URL of the location you want to send users to when they log out. If left blank, users will be redirected to your digital workplace's homepage. 
Binding Type

Select POST.
Public Certificate

Copy and paste the X.509 certificate from the OneLogin configuration instructions into this field.
Identity Provider

Select OneLogin.
Identifier Type

Select Email Address.
Email Attribute

Enter the value that matches the OneLogin Email value.

By default, this will be: Email.
First Name Attribute

Enter the value that matches the OneLogin Last Name.

By default, this will be: First Name.
Last Name Attribute

Enter the value that matches the OneLogin Last Name.

By default, this will be: Last Name.
Drift Time

Enter 5.
User creation on Sign in

Select how your digital workplace handles users who attempt to sign in when they have valid IdP credentials but are not members of the digital workplace.

Options include:

  • Create a new user in your site when they sign in (Users will be added to manage members on sign in)
  • Do not create new users when they sign in (Users not in manage members will be denied access)

When creating new users in your digital workplace this way, they will be created with the following details:

  • First Name (from First Name Path)
  • Last Name (from Last Name Path)
  • Email Address (from Email Path) 
  • CustomIdentifier (from Identifier Path if the Identifier Type is Custom Identifier) 
  • Membership to the All Members group.

If enabled, this option does not provide any additional user syncing functionality (e.g., additional fields, group membership, deprovisioning, etc.).

If your digital workplace uses the ILST to manage members, select Do not create new users when they sign in to avoid the creation of duplicate user accounts.
Sign in Settings

Select how users sign in to your workplace.

Options include:

  • Use SAML button on "Sign in" screen
  • Redirect all users to IdP

For setting up and testing the connection, it can be convenient to temporarily select Use SAML button on "Sign in" screen and then only switch to Redirect all users to IdP once you have confirmed that single sign-in is working correctly.
Configuration settings