Axero connects to OneLogin so people sign in to Axero with their work account, and so accounts can be created and deactivated in Axero automatically. This page explains what each of the two integration paths covers, so you can pick one before following its setup guide.
OneLogin holds your organization's user accounts and decides what each person can open.
There are two integration paths:
People sign in to Axero with their OneLogin credentials rather than a separate Axero password, and signing out of Axero ends the OneLogin session too. Access stays managed in one place.
With SAML, the Axero account appears the first time the person signs in, and you maintain it from there. With SCIM, OneLogin creates, updates, and deactivates the Axero account as the matching change is made in OneLogin.
When provisioning fails for one person and works for everyone else, the first thing to try is on the OneLogin side, not in Axero. In the OneLogin admin portal, open Users, open the person, and open their Axero application assignment. If it shows a Pending or Failed provisioning state, use Reset Login there. That re-applies the provisioning for that one assignment. Do not delete and recreate the person in Axero to clear it; User Deprovisioning below explains why.
With SAML, the account is created on first sign-in. With SCIM, it is created as soon as the person is added in OneLogin, so they have access before they ever open Axero.
With SAML, you deactivate the Axero account yourself. With SCIM, deactivating or removing the person in OneLogin deactivates them in Axero.
On a site using SCIM, always do the removal in OneLogin and let it flow through. Deleting the Axero account directly does not tell OneLogin anything, and it also deletes the link between the two systems. OneLogin keeps sending updates for that person. Axero accepts each one, finds no account to apply it to, and replies that the update succeeded. Nothing is recreated and neither side raises an error. The person no longer exists in Axero, while OneLogin still reports them as provisioned. Removing them in OneLogin instead follows the proper path, which also reassigns their content rather than leaving it without an owner.
Both integrations keep the profile fields that ship with Axero up to date, including First Name, Last Name, and Email.
Custom attributes are the extra profile fields you add yourself. Both integrations carry them, and you can build Personas on their values.
Both integrations carry across who each person reports to, which is what builds the organizational chart in Axero.
Both integrations sync the person's start date with the organization. Use it in Personas to create New Hire cohorts.
Axero can turn OneLogin Roles into Axero roles, but only through the SAML sign-in.
Two things have to be in place. On the Axero side, check Sync roles on the Data Mapping tab. On the OneLogin side, add a parameter to the Axero application, set its Field name to exactly http://schemas.microsoft.com/ws/2008/06/identity/claims/role, and send the person's role names in it. Axero reads that one parameter, and it accepts a list, so all of a person's roles arrive together.
http://schemas.microsoft.com/ws/2008/06/identity/claims/role
At each sign-in, Axero matches the names it receives against Axero role names and assigns those roles. Know two behaviors before you turn this on. First, a name that does not match an existing Axero role is created as a new role rather than ignored, so a typo in OneLogin becomes a new empty role in Axero. Second, any role the person holds that is not in the list is taken away, apart from the roles every member gets by default. The Setup Guide: OneLogin SAML SSO covers the steps.
The SCIM connection provisions user accounts only. It does not read OneLogin Role or group membership, so role assignment always comes from the SAML sign-in, even on sites that use SCIM for everything else.
Axero roles set this way can be used with Personas to manage space membership.
Profile images can come across from OneLogin, and the two integrations handle them differently.
With SAML, Axero copies the image into the person's Axero profile at sign-in and keeps its own copy from then on. It accepts either image data sent directly in the sign-in or a web address pointing at the image, which Axero downloads. Both work from the first sign-in, including the one that creates the account.
With SCIM, Axero stores whatever value OneLogin sends and does not download a copy. If that value is a web address, the profile picture is only as reliable as that address: it has to stay reachable without a sign-in, or the picture will not appear. Sites that want a stored copy should let the SAML sign-in handle the picture.
Users can also upload an image themselves in Axero, and images can be set in code with the REST API: Add User Image method.
With SAML, a person's information is refreshed each time they sign in. With SCIM, OneLogin pushes each change as it happens, so Axero stays current in between.
If you get stuck, open a support case and include any error messages or screenshots from both OneLogin and Axero.
is requesting access to a wiki that you have locked: https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/86759/onelogin
Your session has expired. You are being logged out.