OneLogin SCIM Configuration Guide | Communifire Documentation

Axero supports provisioning for OneLogin single-sign-on for your intranet. This page covers information about OneLogin provisioning and walks you through how to configure OneLogin provisioning on your intranet. For more information or assistance from the Axero team, submit a private case.

Features

Supported provisioning features:

• Create Users: Users assigned to the Axero app in OneLogin are automatically created in your Axero intranet.
• Update User Attributes: Updates made to users in OneLogin are automatically pushed to Axero.
• Deactivate Users: Users unassigned from the Axero app in OneLogin are automatically deactivated in Axero.
• Reactivate Users: Users re-assigned to the Axero app in OneLogin are automatically activated in Axero.

Requirements

An active OneLogin subscription.

Configuration Steps

1. Login to the admin console in OneLogin, and navigate to Administration section
2. Click Applications - Applications
   
   
3. Click Add App
   
   
4. Search and select SCIM Provisioner with SAML(SCIM v2 Enterprise)
   
   
   
5. Edit the Display Name if you want or leave it as default and click Save
   
   
6. Click Configuration and scroll down
   
   
   
7. Enter Application details
   
   SAML Audience URL: https://<domain_name>. Example https://yourintranet.communifire.com
   
   SAML Consumer URL: https://<domain_name>. This should be the same domain you used for SAML Audience URL.
   
   Under API Connection for SCIM Base URL type https://<domain_name/api/scim/v2>. Example https://yourintranet.communifire.com/api/scim/v2 
   
   
8. Click SSO and copy Issuer URL, SAML 2.0 Endpoint (HTTP), and SLO Endpoint (HTTP) save for later.
   
   
9. Open a new tab and log in to Axero. From the homepage click gear icon > Control Panel > System > Single Sign On.
10. Enter the following information:
    
    • Partner Identity Provider URL: Enter the Issuer URL you copied.
    • Single Sign On Service URL: Enter the SAML 2.0 Endpoint HTTP you copied.
    • Relying Party Trust Identifier: Enter your intranet URL.
    • Single Logout Service URL: Enter the SLO Endpoint HTTP you copied.
    • Partner Identity Certificate (CER): Upload the X.509 Certificate file. (Convert the OneLogin.pem to a .CER file).
      
      Example:
      
      
11. Expand the SCIM User Provisioning section.
12. Copy the Bearer token.
    
    
13. Go back to OneLogin and scroll to the bottom of Configuration page and find SCIM Bearer Token. Paste the Bearer Token you just copied from Axero.
    
    
    
    
14. Click Provisioning and under Workflow check Enable Provisioning and click Save
    
    
15. Add Parameters as shown
    
    
    

SCIM JSON

1. Copy and paste the JSON in SCIM JSON Template. For urn:scim:<DOMAIN>:custom:schema change the Domain value to your site name. Example urn:scim:axero.com:custom:schema
   

{
"schemas":[
"urn:ietf:params:scim:schemas:core:2.0:User",
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
"urn:scim:<DOMAIN>:custom:schema"
],
"userName":"{$parameters.scimusername}",
"id":"{$user.id}",
"externalId":"{$user.id}-external",
"userName":"{$parameters.scimusername}",
"name":{
"givenName":"{$user.firstname}",
"familyName":"{$user.lastname}",
"formatted":"{$user.display_name}"
},
"emails":[
{
"value":"{$user.email}",
"display":"",
"displayName":null,
"type":"work",
"primary":true,
"$ref":null
}
],
"photos":[
{
"value":"{$parameters.ThumbnailPhoto}"
}
],
"phoneNumbers":[
{
"value":"{$user.phone}",
"display":"",
"displayName":"",
"type":"",
"primary":true,
"$ref":null
}
],
"title":"{$parameters.title}",
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
"department": "{$parameters.department}",
"organization":"{$user.company}",
"manager": {
"value": "{$parameters.managerId}",
"displayName": "{$user.manager_firstname} {$user.manager_lastname}",
"display": "{$parameters.managerId}-external"
}
},
"urn:scim:<DOMAIN>:custom:schema":{
"CustomFields":[
{
"key":"costSheet",
"value":"{$user.custom_fields.costSheet}"
},
{
"key":"age",
"value":"{$user.custom_fields.age}"
},
{
"key":"carNumber",
"value":"{$parameters.carNumber}"
},
{
"key":"employeeNumber",
"value":"{$parameters.employeeNumber}"
},
{
"key":"languages",
"value":"{$user.custom_fields.languages}"
},
{
"key":"certifications",
"value":"{$user.custom_fields.certifications}"
}
]
}
}

2. In the schema above, 'Key' is the Axero Property Name and 'Value' is the Field response Axero will pull from OneLogin custom user fields.

Adding custom fields

Custom fields can be added in OneLogin and synced with Axero.

1. Go to Users - Custom User Fields
   
   
2. Click New User Field
   
   
   Add a custom user field and click Save
   
   
   

Adding Manager

Follow OneLogin - Sync Manager with Users  guide to sync Manager