OneLogin SSO

About this document

Single Sign-On (SSO) enables organizations to use the SAML 2.0 authentication provider for authenticating login into SAFE. Admin can onboard and manage users right from their OneLogin SSO platform, eliminating the need to maintain a separate user authentication mechanism for SAFE.

This document describes the step-by-step procedure to configure Single Sign-On (SSO) for SAFE via OneLogin SSO.

Setting up OneLogin

1. Log in to OneLogin as an administrator.
2. Navigate to Applications >Applications.
   
3. Click the Add App button at the top right corner.
   
4. In the search bar under Find Applications, enter SAML, and then choose SAML Custom Connector (Advanced).
   
5. On the Configuration page, enter a name for the application (Example: Safe Security, Inc.).
   
6. Click the Save button.
7. Once saved, go to the Configuration page from the left navigation page and fill in the details as follows:
   1. Audience (EntityID) - Select the correct Entity ID for your regional instance.
   2. Recipient  - Select the correct Reply URL for your regional instance.
   3. ACS (Consumer) URL Validator - Select the correct Reply URL Validator for your regional instance.
   4. ACS (Consumer) URL - Select the correct Reply URL for your regional instance.
   5. Everything else - Leave as blank.
8. Click Save to store the app settings.
9. Click Parameters in the left navigation menu. 
10. Click the + button to add a new field.
    
11. Note: The Parameters page lists the parameter NameID (fka Email) by default.
12. Enter the following parameters:
    1. For Email:
       1. In the New Field dialogue box, for Field name, enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
       2. For Flags, select the Include in SAML assertion check box.
       3. Choose Save.
       4. For Value, choose Email from the list.
       5. Click on the Save button.
          
13. For First Name: (Optional)
    1. In the New Field dialogue box, for Field name, enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
       1. For Flags, select the Include in SAML assertion check box.
       2. Choose Save.
       3. For Value, choose the First Name from the list.
       4. Click on the Save button.
14. For Last Name: (Optional)
    1. In the New Field dialogue box, for Field name, enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
       1. For Flags, select the Include in SAML assertion check box.
       2. Choose Save.
       3. For Value, choose Last Name from the list.
       4. Click on the Save button.
15. You'll need to grant your users permission to access the application you just created, either by adding individual Users or by adding to Roles or Groups within OneLogin according to how you prefer to manage your Users there.
16. Navigate back to the application created in Step 6, and select SSO from the left side navigation.
17. Copy the Issuer URL and share it with SAFE’s support team at the Service Desk.
    
18. Click on the Save button to save the application.