Skip to main content

OneLogin

This doc describes how to create an OIDC app in OneLogin for Pomerium and connect to it. It assumes you have already installed Pomerium.

caution

While we do our best to keep our documentation up to date, changes to third-party systems are outside our control. Refer to Connect an OIDC enabled app from OneLogin's documentation as needed, or let us know if we need to re-visit this page.

Create OpenID Connect App​

  1. Log in to your OneLogin account and click on Administration at the top.

  2. Navigate to Applications on the top menu. Click the Add App button:

    One Login Add a New App

  3. On the Find Application page, search for openid. Select Openid Connect by OneLogin, Inc.

    One Login Add a New App

  4. On the App Configuration page, name the app and select a logo:

    One Login select logo

    Select Save.

  5. From the Configuration tab, set set the Redirect URI's to Pomerium's redirect url (https://${authenticate_service_url}/oauth2/callback):

    One Login set callback url

    Select Save.

  6. Navigate to the SSO page. This section contains the Client ID, Client Secret and Identity Provider URL you'll use to configure Pomerium:

    One Login SSO settings

  7. Set the application type to Web and the token endpoint to be POST.

  8. Under Token Timeout settings set Refresh Token to 60 minutes (or whatever value makes sense for your organization). Note, however, if you don't enable refresh tokens the user will be prompted to authenticate whenever the access token expires which can result in a poor user experience.

    Select Save to complete the application configuration.

Add Users​

OneLogin will not make your new application accessible to members of your organization automatically. You can assign access to individual users (as shown below).

One Login Application Access

Pomerium Configuration​

Update your Pomerium configuration:

idp_provider: 'onelogin'
idp_provider_url: 'https://awesomecompany.onelogin.com/oidc/2'
idp_client_id: 'REDACTED' # Your OneLogin application ID
idp_client_secret: 'REDACTED' # Your OneLogin application secret

After reloading Pomerium, you should be able to see any login events from your OneLogin events dashboard.

One Login Events Dashboard

Groups​

A groups claim can be added to tokens returned from Okta by following the Okta documentation.

Now when users login they will have a claim named groups that contains their groups and the claim PPL criterion can be used for authorization:

routes:
  - from: 'https://verify.localhost.pomerium.io'
    to: 'https://verify.pomerium.com'
    policy:
      - allow:
          and:
            - claim/groups: admin

Custom Claim (Open Source)​

Unfortunately, OneLogin does not yet support getting groups data using a custom claim. Groups must be loaded by using a plugin to fetch directory information (see Enterprise's Directory Sync).