OneLogin

Steps not yet verified in the identity provider's current admin console.

Recommended protocol: SAML 2.0.

SAML 2.0

Connect OneLogin with SAML 2.0

1. In the OneLogin admin portal, add the application SAML Custom Connector (Advanced). Give it a display name, icon and description (for example KeenAuth) and save.
2. Go to Configuration. Enter the KeenAuth Entity ID SP entity ID in Audience (EntityID). If the service provider validates it, also enter the endpoint that receives the assertion in Recipient (required for some configurations).
3. In ACS (Consumer) URL Validator (required) enter a regular expression that matches exactly the KeenAuth ACS URL ACS URL and starts with ^ and ends with $ (without both anchors the check can be bypassed; do not use a * wildcard in production). Then enter ACS URL in ACS (Consumer) URL (required).
4. Optional: enter single logout URL in Single Logout URL if you use single logout. For SAML initiator (required) select OneLogin for an IdP-initiated flow, or Service Provider for an SP-initiated flow, and in the SP-initiated case enter the SP login URL in Login URL.
5. Select the SAML nameID format (required): Unspecified, Persistent, Transient or Email (default), matching the identifier KeenAuth should use for the user. Choose SAML signature element (required) as Response or Assertion, and optionally select Encrypt assertion and a SAML encryption method.
6. Set SAML not valid before, SAML not valid on or after and SAML sessionNotOnOrAfter (all required) in minutes, plus any other SAML settings your app needs; RelayState is optional.
7. Assign the application to your users, copy the OneLogin identity provider values for this app (issuer, SAML endpoint and certificate or metadata) into KeenAuth, and run the connection test.

Values in bold are shown on the connection's page in the Admin Portal, where this guide has them filled in.