SSO with OneLogin

Introduction

This guide will take you through the steps required to perform integration of OneLogin with BMS.

Stage 1: Creating the app in OneLogin

  1. Log into OneLogin.
  2. Click Applications on the left panel and then click Add App.
    OneLogin1.png
  3. Enter Connector in the Search field.
  4. Select SAML Custom Connector (Advanced).
    OneLogin2.PNG
  5. You will need to configure SAML Custom Connector (Advanced). Enter a name in the Display Name field and save it.
    OneLogin3.PNG

Stage 2: Configuring the setup in the application

  1. Go to the Configurations page. 
  2. Audience (Entity ID): Enter the entity ID in the format: https://<bms server>/api/auth/saml2
  3. Recipient: Enter the recipient address in the format: https://global.api.<bms server>/auth/saml2
  4. ACS (Consumer) URL Validator: Enter the ACS URL validator address in the format: https:\/\/global.api.<bms server>\.com\/auth\/saml2\/$
  5. ACS (Consumer) URL: Ener the ACS consumer URL in the format: https://<bms server>/SAML/Connect.aspx
  6. Single Logout URL: Leave this blank.
  7. Login URL: Enter the gateway URL (that you find under Your profile name > My Settings in BMS) in the format https://<bms server>/Gateway.aspx?client=<company name>. See the second image below.
  8. SAML not valid before: Enter 3.
  9. SAML not valid on or after: Enter 3.
  10. SAML Initiator: Select OneLogin from the dropdown.
  11. SAML nameID format: Select Email from the dropdown.
  12. SAML Issuer Type: Select Specific from the dropdown.
  13. SAML signature element: Select Response from the dropdown.
  14. SAML encryption method: Select TRIPLEDES_CBC from the dropdown.
  15. SAML session NotOnOrAfter: Select 1440 from the dropdown.
  16. Click to select the checkboxes shown in the below screenshot.
    OneLogin4A.PNG
    OneLogin24.png

Stage 3: Adding the parameters

The list of the Parameters is given below that need to be added. For each and every parameter flag the (Include in SAML assertion).

IdP Attribute SAML Response Attribute Note
Company Name Company Name Click Macro and enter your company name
NameID value Email
email Email
first_name First Name
last_name Last Name
username userPrincipalName

OneLogin9.PNG

NOTE   You should create a custom attribute for the company Name in OneLogin as it is not provided by default in the application.

OneLogin10.PNG

Enter the company name and save. You can find the company name by navigating to Login > Your profilename > My Settings. You will find the company name just below your profile picture.
OneLogin24.PNG

Stage 4: Enabling SAML 2.0

  1. Go to the SSO page. 
  2. X.509 Certificate: Select Standard Strength Certificate (2048-bit).
  3. SAML Signature Algorithm: Select SHA-256.
  4. Enable login hint: Click to select this checkbox.
    OneLogin12.PNG
  5. Right-click View Details and click Open link in a new tab.
    OneLogin15.png
  6. Once you click Open link in the new tab, you will get the option to download the certificate. Select the SHA fingerprint as SHA1.
  7. Under X.509 Certificate section, select X.509 DER from the dropdown and click Download.
    OneLogin16.PNG

  8. IMPORTANT  Important:Once the file is downloaded, go to the Downloads folder, right-click and rename the file with .cer file extension in case it shows some other file extension.

  9. After the extension is changed, add the file to BMS.
    OneLogin16A.png
  10. Select the file, click Upload Certificate and click Save.

Stage 5: Adding the user to the application

  1. Go back to OneLogin > Users menu on the top.
  2. Click New User.
    OneLogin19.PNG
  3. Once the user has been created, open the user, click the application inside the user profile, click + to add the application to the user.
    OneLogin20.PNG

Stage 6: Configuration on the BMS side

  1. After the Onelogin SAML application is created, copy the highlighted URL (single sign-on) from OneLogin and paste it into BMS by navigating to Admin > My Company > Auth & Provision > SAML Login Endpoint URL.
    OneLogin21.PNG
    OneLogin22.PNG

    NOTE   The user details added in the application should be the same for which the SSO is going to be enabled.

  2. Navigate to HR > Employees. Open the user profile and enable the SSO for the user.
    OneLogin23.PNG
    Once the SSO has been enabled for the user, the user will be able to log into the BMS instance now.