Set up SSO and SCIM with OneLogin

This topic walks you through the process of setting up SCIM and SSO in OneLogin.

Note:

• If you want to set up SSO without configuring SCIM, see Set up SSO with OneLogin.
• If you previously configured SSO using the Set up SSO with OneLogin instructions, you should follow this workflow to configure SSO and SCIM in a single OneLogin application:
  • Complete all of the tasks below to configure SSO and SCIM in a single OneLogin application.
  • Reassign users from the existing OneLogin SSO-only application to the new SSO and SCIM application.
  • Remove the initial SSO-only tile.

Important: Users will not be able to sign in to Alida while the initial provisioning process is running. Plan your user auto-provisioning roll-out at a time that minimizes user impact.

Create a OneLogin application

In this part of the workflow, you are creating the application tile that end-users will click to access the Alida platform.

1. Sign in to OneLogin as an Administrator.
2. Click Administration.
3. Click Applications > Applications.
4. Click Add App.
5. Find and select the SCIM Provisioner with SAML (SCIM v2 Core) app.
6. In Display Name, enter the display name for the application.
   The display name is the label for the SSO tile that end users will see. For example, Alida.
7. Click Save.

Copy SSO configuration settings from your app

After you create the application tile, you need to copy SSO configuration values. You will enter these values into Alida's SSO Setup page in the next section.

1. In the app you created, click SSO in the left-hand menu.
2. Copy the Issuer URL and store it for later use.
   
3. Below the X.509 Certificate field, click View Details.
4. Click Copy to Clipboard next to the X.509 Certificate to copy the certificate.
   

Configure SSO in your Community

Enter the SSO configuration values from your OneLogin app into Alida's SSO Setup page.

1. Select Product Settings > SSO.
   The SSO Setup page is displayed.
2. In the Identity Provider drop-down list, select OneLogin.
3. Under Issuer URL, enter the Issuer URL you copied earlier.
4. Under X.509 Certificate, enter the X.509 certificate you copied earlier.
5. Under Unique ID claim, enter userId.
6. Under Email claim, enter email.
7. Click Save and confirm.
8. Copy the Single Sign-On URL and store it for later use.
9. Copy the Audience Entity ID and store it for later use.

   Click the screenshot below to view a larger version.

   

Add and verify a domain

Add the registered domain that your company owns and that you use for employees' email addresses.

1. Open Product Settings > SSO.
2. Click the Domains tab.
3. In the Add new domain field, type the domain value, select the Type (CNAME or TXT), and click Add Domain.

   For example, if a potential SSO user's email is [e-mail], you'd type example.com as the domain.

   The new entry is added to the domains list as an Unverified domain.

4. Click the down-arrow to the left of the domain entry to display the DNS Record.
   
5. Keep the browser tab that has the Alida Domains page open. Open a new browser tab to access your DNS site.
6. Add the values from the Domains page to your DNS configuration.

   For both CNAME and TXT DNS records, the three required values are listed separated by spaces:

   • Add the first value as the owner or source name.
   • Add the second value as the DNS record type. It will either be CNAME or TXT.
   • Add the third value as the target or destination name.

   Example

   This example shows the two supported DNS record formats configured in AWS Route 53. The first is a TXT record, and the second is a CNAME record.

   • The first value in the DNS record is added as the Record Name field.
   • The second value in the DNS record is added as the Type field.
   • The third value in the DNS record is added as the Value/Route traffic to field.

   

7. On the Alida Domains page, select Verify from the domain's action menu.

   The domain's status changes to Verified.

8. Click Apply.
   The domain status changes from Verified to Active.

   

Add a user auto-provisioning group

Configure a group for each category of Alida user you want to provision with access to the Alida platform.

You must set up SSO before you can access the User Auto-Provisioning page where you complete this task. The sequence of configuration tasks depends on your Identity Provider (IdP):

• For Azure and Okta, you must complete the SSO set up for your IdP (Set up SSO with Azure or Set up SSO with Okta) before starting this task.

• For OneLogin, you will complete this task as part of the procedure for configuring SSO and SCIM in your IdP (Set up SSO and SCIM with OneLogin).

1. Select Product Settings > SSO
2. Click the User Auto-Provisioning tab.
3. Click Add Group.
   
4. Enter the Group Name.
   Note: To simplify SCIM configuration, use the same group names in Alida and your IdP whenever possible.
5. Select the role and permissions for the group.
   For information about the roles and permissions you can assign to user auto-provisioning groups, see User roles.
6. Click Done.

Set the default user auto-provisioning group

Specify the default group to use if an issue occurs mapping your Identity Provider (IdP) groups to Alida auto-provisioning groups.

The group you set as the default group should be the group you have defined with the least privileges. For example, if you are an Analytics customer assigning a group with the Dashboard Viewer role, users provisioned to this group are restricted to viewing dashboards.

This ensures that user provisioning defaults to a non-sensitive group with restricted access if the mapping between an IdP group and the Alida provisioning group fails.

Note: You cannot change the default group while an authentication token is active. The reason for this is to avoid unexpected user role assignments while the Identity Provider (IdP) is syncing user data with Alida.

The workflow you need to follow to change a group if a token is active is:

1. Delete any active tokens in the User Auto-Provisioning page.
2. Select the new group as the default group.
3. Generate a new token.
4. Update the token in your IdP.

1. Select Product Settings > SSO
2. Click the User Auto-Provisioning tab.
3. To select the default group, click the star to the left of the group name.
   

Generate a SCIM authentication token

You can manage the credentials your identity provider (IdP) needs to authenticate with the Alida platform.

You must set up SSO before you can access the User Auto-Provisioning page where you complete this task. The sequence of configuration tasks depends on your IdP:

• For Azure and Okta, you must complete the SSO set up for your IdP (Set up SSO with Azure or Set up SSO with Okta) before starting this task.

• For OneLogin, you will complete this task as part of the procedure for configuring SSO and SCIM in your IdP (Set up SSO and SCIM with OneLogin).

You can access the two pieces of information required to authenticate with the AIida SCIM API in the User Auto-Provisioning page:

• Base URL: This is the URL your Identity Provider (IdP) will use to connect to the Alida SCIM API endpoints. You will copy this value and configure it in your IdP as part of the SCIM provisioning setup.
• Tokens: You need to generate a unique token that enables you to securely access the Alida SCIM API and configure it in your IdP.

1. Select Product Settings > SSO
2. Click the User Auto-Provisioning tab.
3. Click Generate Token.
4. In the Generate New Token dialog, enter the token details:
   1. In Token Name, enter a unique name for the token.
   2. In Token Expiration drop-down list, select one of the preset options (1 year, 3 years, 5 years) or select Custom Date and then select a specific expiry date from the calendar.
      Note: The Custom Date you select must be at least 30 days in the future.
   3. Click Generate.
5. Copy the new SCIM Access Token you generated and save it securely.

   The token is only displayed when it is initially generated. It is not available after you navigate away from the User Auto-Provisioning page, or the page refreshes.

   

You can use the token to securely access the SCIM API until it expires. You must create a new token and update the value in your IdP before the expiration date.

Note:

• You can delete tokens that you are no longer using. If you delete a token that is in use, your IdP will no longer be able to access the SCIM API.

  To delete a token, click Remove next to the token, and click Delete in the confirmation dialog.

  

• You can edit the name of a token, but you cannot modify the expiration date after it has been generated.

  To edit the token name, click Edit next to the token, and then enter a unique name in the Token Name text box and click Update.

  

Configure SCIM in OneLogin

This topic walks you through the process of setting up SCIM in OneLogin.

1. Log in to OneLogin.
2. Click Administration.
3. Select Applications > Applications.
4. Click the application you want to configure (for example, Alida).
5. Enable provisioning:
   1. In the application connector's settings, click the Configuration tab.
   2. Under the Application Details section, enter the following information:
      • SAML Audience URL: Enter the Single Sign-On URL from the SSO Information page in Alida.
      • SAML Consumer URL: Enter the Audience Entity ID value from the SSO Information page in Alida.

      If SSO is set up for your Alida community, you can view these settings by signing in and selecting Product Settings > SSO.

   3. Under the API Connection section, enter your credentials:
      • In the SCIM Base URL field, paste the Alida Base URL value.

        This is the Base URL value displayed in the Authentication Credentials section on the User Auto-Provisioning page in Alida.

      • In the SCIM Bearer Token field, paste the Alida Token value.

        This is the token you previously generated in the User Auto-Provisioning page in Alida.

      • In the SCIM JSON Template field, paste the following SCIM schema:

        {
          "active": "{$user.status}",
          "emails": [
            {
              "value": "{$user.email}",
              "primary": true,
              "type": "work"
            }
          ],
          "name": {
            "familyName": "{$user.lastname}",
            "formatted": "{$user.display_name}",
            "givenName": "{$user.firstname}"
          },
          "schemas": [
            "urn:ietf:params:scim:schemas:core:2.0:User"
          ],
          "userName": "{$parameters.scimusername}"
        }

   4. At the top of the API Connection section, click Enable.
      OneLogin will attempt to connect to the API. If the connection is successful, you will see a green "Enabled" status.
   5. Click Save in the top-right corner.
6. Enable provisioning and configure provisioning rules:
   1. Click the Provisioning tab.
   2. Click the Enable provisioning checkbox.
   3. Deselect the Create user, Delete user, and Update user checkboxes.
   4. In the When users are deleted in OneLogin... drop-down list, select Delete.
   5. In the When user accounts are suspended in OneLogin... drop-down list, select Suspend.
   6. Below Entitlements, click Refresh.
      
   7. Click Save in the top-right corner.
7. Map attributes:
   1. Click the Parameters tab.
      This is where you map OneLogin user attributes to the application's SCIM attributes. The application connector will have a default set of fields.
   2. Click the plus sign to add a new parameter.
   3. Enter email in the Field name, select the Include in SAML assertion and click Save, and then select Email as the Value and click Save again.
   4. Add a second parameter with userId as the Name, OneLogin ID as the value and the Include in SAML assertion checkbox enabled.
      
   5. Click the Groups parameter, select the Include in User Provisioning checkbox and click Save.
   6. Click the Value drop-down list and verify that all six Alida groups are displayed.
      The list should include these groups:

      • Admin
      • Analyst
      • Author
      • CM_Agent
      • Dashboard_Viewer
      • PowerUser

      If any of these groups are not displayed, go back to the Provisioning tab and click Refresh again.

   7. Click Save in the top-right corner.
8. Assign your SCIM app to user roles:
   1. In the main menu, select Users > Roles.
   2. Select a role, go to its Applications tab, and click Add Apps to add your newly configured application to that role.
      Alternatively, you can manually assign the application to a user by going to their profile's Applications tab.

      Once assigned, provisioning will begin. You can check the status on the Users > Provisioning page.