Loading ...

Setup Guide: OneLogin SAML SSO | Axero Documentation

Home » axero documentation » Wiki » Documentation » Login » Single Sign-On (SSO) » OneLogin » Setup Guide: OneLogin SAML SSO
Axero Documentation  Wiki
Public Space
Activity Stream Content
Version 5

Setup Guide: OneLogin SAML SSO

0 
 /5
0 (0votes)

This guide provides step-by-step instructions to configure OneLogin for Single Sign-On (SSO) with Axero using SAML 2.0. Users will authenticate using their OneLogin credentials, with account management handled in Axero.

Using a different identity provider? See Single Sign-On (SSO) for the other setup guides.

Overview

Preparation

Before you start, ensure you have:

  • Administrator access to your OneLogin portal
  • Site Administrator access to your Axero site
  • Confirmed the following Axero System Properties are configured:
    • Go to Control Panel > System > System Properties
    • EnableAutoLoginViaSaml = False
    • SAMLAutoUserCreation = True
    • SAMLAutoUserUpdate = True
    • SAMLUserEmailMatch = False
    • SAMLWantAssertionSigned = True
    • SAMLWantSAMLResponseSigned = True

    Note: Spell these values True and False. A numeric 1 or 0 is not read as a setting, and the property is then treated as False rather than reverting to its built-in value. For the two properties above that are True by default, SAMLAutoUserCreation and SAMLAutoUserUpdate, that silently turns them off.

    Note: The last two properties are what make Axero insist the sign-in it receives was really signed by OneLogin. Choosing SAML as the authentication method does not turn them on for you the way the Azure Active Directory method does, so set them yourself before you go live.

  • Adjusted the following settings for your planned usernames:
    • Go to Control Panel > System > General Settings > Advanced Settings.
    • Update Minimum length for username and Maximum length for username as needed to accommodate your planned username format.

Adjusting these settings will help prevent potential errors during user creation and login.

Step 1: Configure OneLogin

  1. Sign in to your OneLogin Admin portal.
  2. Go to Applications > Applications and click Add App.
    The OneLogin Applications list with the Add App button
  3. Search for and select SCIM Provisioner with SAML (SCIM v2 Core).
    OneLogin app search results with SCIM Provisioner with SAML (SCIM v2 Core) selected
  4. Enter a display name for your application (for example, "Axero") and click Save.
    The OneLogin app configuration page with the display name set to Axero
  5. On the Configuration tab, enter the following:
    1. SAML Audience URL: Enter your Axero site URL (for example, https://your-axero-site.com).
    2. SAML Consumer URL: Enter your Axero site URL followed by /SAML/AssertionConsumerService.aspx (for example, https://your-axero-site.com/SAML/AssertionConsumerService.aspx).
    3. SCIM Base URL: Enter your Axero site URL followed by /api/scim/v2 (for example, https://your-axero-site.com/api/scim/v2). OneLogin requires this URL to be set even though you're only setting up SAML SSO now.
      The OneLogin Configuration tab showing the SAML Audience URL, SAML Consumer URL, and SCIM Base URL fields
    4. Click Save.
      The OneLogin Configuration tab with the Save button
  6. On the Parameters tab, configure these required attributes:
    1. First Name
      1. Click + to add a new parameter.
        The OneLogin Parameters tab with the button that adds a new parameter
      2. Set Field name to "FirstName".
      3. Select "Include in SAML assertion".
      4. Click Save.
      5. Select "First Name" from the Value dropdown.
      6. Click Save.
        The OneLogin Edit Field dialog for FirstName, with Include in SAML assertion selected
    2. Last Name
      1. Click + to add a new parameter.
      2. Set Field name to "LastName".
      3. Select "Include in SAML assertion".
      4. Click Save.
      5. Select "Last Name" from the Value dropdown.
      6. Click Save.
        The OneLogin Edit Field dialog for LastName, with Include in SAML assertion selected
    3. Email
      1. Click + to add a new parameter.
      2. Set Field name to "Email".
      3. Select "Include in SAML assertion".
      4. Click Save.
      5. Select "Email" from the Value dropdown.
      6. Click Save.
        The OneLogin Edit Field dialog for Email, with Include in SAML assertion selected
    4. Click Save to save your changes.
      The completed OneLogin Parameters list with the Save button

    Note: Use the same name in OneLogin that you will use on the Axero side. Capitalization does not have to match, because Axero compares these names without regard to upper or lower case, but keeping them identical makes the two screens easier to read side by side.

  7. On the SSO tab:
    1. Under SAML Signature Algorithm, select SHA-256.
      The OneLogin SSO tab with SHA-256 selected under SAML Signature Algorithm
    2. Click Save.
    3. Return to the SSO tab.
    4. Record the following values:
      • Issuer URL
      • SAML 2.0 Endpoint (HTTP)
      • SLO Endpoint (HTTP)
        The OneLogin SSO tab showing the Issuer URL, SAML 2.0 Endpoint, and SLO Endpoint values
    5. Under X.509 Certificate, click View Details.
      The OneLogin SSO tab with the View Details link under X.509 Certificate
    6. Under X.509 Certificate, select "X.509 PEM" and click Download to download the certificate.
      The OneLogin certificate page with X.509 PEM selected and the Download button
    7. Share the certificate in your support ticket. OneLogin gives you the file in PEM form, and Axero expects it in a different form, so we convert it and install it for you. The Single Sign On screen does have a Partner Certificate field, but leave it alone for a OneLogin setup and let support place the converted file.

Step 2: Configure Axero

  1. Sign in to your Axero site as a site administrator.
  2. Navigate to Control Panel > System > Single Sign On.
    The Axero Control Panel System menu with Single Sign On highlighted
  3. Select SAML as the authentication method and click Save.
    The Axero Single Sign On page with SAML selected as the authentication method
  4. Enter the following information from the OneLogin SSO tab:
    • Partner Identity Provider URL: Enter the Issuer URL.
    • Single Sign On Service URL: Enter the SAML 2.0 Endpoint (HTTP).
    • Relying Party Trust Identifier: Enter your Axero site URL.
    • Single Logout Service URL: Leave this empty unless you want signing out of Axero to also sign the person out of OneLogin. If you fill it in, you also need the Service Provider Certificate (PFX), because Axero signs its sign-out messages with that certificate. Contact Axero support to arrange it. Without it, signing in still works and only signing out fails, which is easy to mistake for an unrelated fault. The value to enter is the SLO Endpoint (HTTP).
      The Axero Single Sign On settings with the four OneLogin URL values entered
    • Partner Identity Certificate (CER): Upload the certificate you downloaded from OneLogin in step 1. Axero uses it to check that the sign-in really came from OneLogin, so signing in fails without it.
  5. Click Update to save your changes.
    The Axero Single Sign On settings with the Update button
  6. Click the Data Mapping tab and select SAML from the dropdown.
    The Axero Data Mapping tab with SAML selected in the Type dropdown
  7. Update the following mappings so that the property names match exactly as shown:
    SAML Attribute Mappings
    Property Name Field
    FirstName First Name
    LastName Last Name
    Email Email

    Note: Each Property Name has to match the parameter you created in OneLogin. Capitalization does not have to match on this screen, but if you also set up SCIM provisioning later, the names there do have to match exactly, so it pays to be consistent now.

  8. Delete any other mappings and click Update to save your changes.
    The Axero Data Mapping grid with the three required mappings and the Update button

Step 3: Test SSO Integration

  1. In OneLogin:
    1. Assign yourself to the Axero application.
      1. Go to Users > Users.
      2. Select yourself from the list.
      3. Click the Applications tab.
      4. Click +.
        A OneLogin user's Applications tab with the button that assigns an application
      5. Select Axero from the dropdown and click Continue.
        The OneLogin dialog that assigns the Axero application to a user
      6. Click Save.
    2. Ensure your user profile has the required attributes (first name, last name, email).
  2. Test SSO login:
    1. Follow the instructions for adding a "Login via SSO" button to your login page.
    2. Open a new incognito/private browser window.
    3. Navigate to your Axero site's login page.
    4. Click the Login via SSO button.
    5. Verify successful authentication and profile data mapping.

Optional: Add Custom Attributes

  1. In OneLogin, go to your application's Parameters tab.
  2. Click + to add a custom attribute.
  3. Enter the Field name from the following list:
    SAML Attribute Mappings
    Field Name Value
    ProfilePhoto Profile Picture
    Phone Phone
    ManagerEmail Manager Email
    Company Company
    Department Department
    Title Title
    HireDate Your OneLogin start-date field

    Note: A start date is not part of the standard OneLogin user profile. If you want to fill the Axero Hire date field, the value has to come from a custom user field in OneLogin or from the directory you sync into OneLogin. If your Value dropdown has no such entry, skip the HireDate row.

  4. Select "Include in SAML assertion".
  5. Click Save.
  6. Select the corresponding value for the field name in step 3 from the dropdown.
  7. Repeat steps 2-6 for each custom attribute.
  8. Click Save.
    The OneLogin Parameters tab for the app, showing the full field and value list
  9. In Axero, go to Control Panel > System > Single Sign On > Data Mapping.
  10. Select SAML from the dropdown.
  11. Click Add to add a new mapping.
    The Axero Data Mapping grid with the Add button
  12. Add a mapping for each desired attribute, ensuring the property names match precisely:
    SAML Attribute Mappings
    Property Name Field
    ProfilePhoto Profile photo
    Phone Phone
    ManagerEmail Reports to
    Company Company
    Department Department
    Title Occupation
    HireDate Hire date
  13. Click Update to save your changes.
    The completed Axero Data Mapping grid with every optional attribute mapped
  14. Test the new attribute mappings by signing in via SSO.

Troubleshooting

  • User Deprovisioning: OneLogin SAML integration does not automatically deactivate users in Axero. Deactivate users manually in Axero or use SCIM provisioning.
  • Role Mapping: To bring OneLogin Roles across as Axero roles, tick Sync roles on the Data Mapping tab, then add a parameter in OneLogin whose Field name is exactly http://schemas.microsoft.com/ws/2008/06/identity/claims/role and send the person's role names in it. One parameter carries the whole list. Axero applies it at every sign-in: names that match an Axero role assign that role, a name with no match creates a new Axero role, and any role the person holds that is missing from the list is taken away, apart from the roles every member gets by default. Test with one person before you switch it on for everyone, because a misspelled name in OneLogin creates a role rather than failing.
  • Roles and SCIM: The SCIM connection does not carry role or group membership. Even if you set up SCIM provisioning, role assignment still comes from the SAML sign-in described above.
  • Per-role true or false mapping: The Data Mapping tab shows a third column for picking an Axero role only when the Type is set to Azure Active Directory. It is not available for the SAML type, so use the Sync roles route above.

Wiki Index

Pages