SSO and Provisioning Setup with OneLogin

Matthew Rawls

October 09, 2023 18:58

Create a new app for Simpplr in your OneLogin environment

Add OneLogin as an SSO source to Simpplr

Set up OneLogin as a provisioning source

Note:

The Simpplr App manager who also have admin permissions for OneLogin will need to configure the SSO.

Create a new app for Simpplr in your OneLogin environment

Log in to the OneLogin portal using your admin credentials.
Navigate to the Administration area.
Open Applications from the top navigation bar.
Select Create New App, then search for SAML Custom Connector (Advanced).
Here you'll have the option to add a custom app name, attach logo assets and a description as per your org's requirement.
To set up the service initiated SAML flow:
1. Add an ACS (Consumer) URL / Login URL / ACS (Consumer) URL Validator -
  Simpplr Internal App - https://<subdomain-api.app.simpplr.com>/v1/identity/accounts/login/saml
  Example - https://google-sso-4-api.dev.zeus.simpplr.xyz/v1/identity/accounts/login/saml
  
  Custom Domain - https://api.<domain>/v1/identity/accounts/login/saml
  Example - https://api.atshub.atszambia.com/v1/identity/accounts/login/saml
2. Select OneLogin as the SAML initiator from SAML initiator dropdown.
3. Add an Audience(EntityID) - This can be anything (Optional)
  Reference docs :- Knowledge Base - Customer Support
  
  Recommended -: OneLogin-${Client-Name}-Simpplr
To setup the Identity Provider initiated flow -
1. Configure Relay State:
  Base 64 encode - {"callback_url":"https://<account-domain>/home","v":"OL"}
  Example - {"callback_url":"https://google-sso-4.dev.zeus.simpplr.xyz/home","v":"OL"}
  Use - Base64 Encode and Decode - Online to convert the above attached string to Base64 and then paste under Relay State on OneLogin
One finished, click Save to update all the settings.
Under the Parameters tab in left panel, configure mandatory parameter required for just in time provisioning.
- There are four mandatory attributes used for provisioning:
  1. first_name
  2. last_name
  3. email
  4. username

Add OneLogin as an SSO source to Simpplr

Open Simpplr as an App manager. Head to Manage > Application > Security > External IdP (SSO).
Select OneLogin.
Enter your org's OneLogin URL retrieved from your OneLogin portal. To get this:
- Go to the OneLogin portal using your admin credentials
- Click on Administration > Applications > Select Applications
- Search for the SAML app (for example, Simpplr - Dev)
- Click the SAML app
- On the left side, Click the SSO tab
- Copy the SAML 2.0 Endpoint (HTTP) URL
Back in Simpplr, paste this URL in the OneLogin URL field.
Head back to OneLogin and select SHA-256 from the SAML Signature Algorithm dropdown list.
Under SSO > X.509 Certificate, click on View Details and download the PEM file.
Go back to Simpplr and upload the PEM file certificate.
Click Save.

Set up OneLogin as your provisioning source in Simpplr

In Simpplr, head to Manage > Application > Integrations > People data.
Select OneLogin > Provisioning.
Click Save. After clicking save, Simpplr provides you with OneLogin link and token. This token is only visible once. If the page is refreshed or exited, this token will not be displayed again. If a new token is required, uncheck the OneLogin provisioning box and select it again, then save. This will create a new token and invalidate the old one. Don't forget to change the token in this case in the older applications on OneLogin (OneLogin applications will be explained later).
Login to OneLogin. You will need administrator access to complete the next steps.
In the top right corner, click Administration.
To create a new application:
1. From the Main menu, select Applications, then choose Add App.
2. Search for SCIM.
3. Select SCIM Provisioner with SAML (SCIM v2 Enterprise) and click Save.
Configure the SCIM App:
1. Select the Configuration tab.
2. Let's suppose the base url of the tenant is https://ats-reg-testing.qa.simpplr.xyz/, then put simpplr.xyz in SAML Audience URL and put qa.simpplr.xyz in SAML Consumer URL.
In the SCIM Base URL, enter the OneLogin URL you got in step 3.
In SCIM JSON Template, copy and paste:
{
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User",
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
],
"externalId": "{$user.id}",
"userName": "{$parameters.scimusername}",
"name": {
"familyName": "{$user.lastname}",
"givenName": "{$user.firstname}"
},
"emails": [
{
"value": "{$user.email}",
"type": "work",
"primary": true
}
],
"displayName": "{$user.display_name}",
"locale": "{$user.locale_code}",
"phoneNumbers": [
{
"value": "{$user.phone}"
}
],
"roles": "{$user.custom_fields.Roles}",
"active": "{$user.status}"
}
In SCIM Bearer Token, paste the token you got from Simpplr in step 3 above.
In the API Status select Enable.
Select Save.
Configure provisioning for the SCIM App:
1. Select the Provisioning tab.
2. Check Enable Provisioning.
3. Under Require admin approval before this action, uncheck the Create, Delete, and Update checkboxes to have OneLogin provision new users and update users to the SCIM app without requiring administrative approval.
4. Select Save.
Test user provisioning with your SCIM app.
1. Select the Access tab.
2. In the Roles section, ensure Default is checked.
3. Select Save.
4. From the main menu, select Users.
5. Select the user to provision to the SCIM app.
6. Select the Applications tab for the user.
7. In the Roles section, select Default.
8. Select Save User to start the provisioning process.
View provisioning status:
1. From the main menu, select Users > Provisioning.
2. Refresh the page to view the updates.
3. Go to Applications and open the SCIM app.
4. Select the Users tab to see provisioned users.
To disconnect OneLogin SCIM, follow these steps:
1. Go to Simpplr. Click on Manage > Application > Integrations > People data.
2. Uncheck OneLogin and the provisioning option.
3. Click Save.
4. Login to OneLogin.
5. Click Administration from the main menu and then click on Applications > App name.
6. Select the Provisioning tab and uncheck the Enable provisioning in Workflow section.
7. Click Save.