> For the complete documentation index, see llms.txt.
Skip to main content

Check out Port for yourself ➜ 

Onelogin

Follow this step-by-step guide to configure the integration between Port and Onelogin.

Port-Onelogin integration benefits​

  • Connect to the Port application via a Onelogin app;
  • Your Onelogin roles will be automatically synced with Port, upon user sign-in;
  • Set granular permissions on Port according to your Onelogin roles.
Contact Port for setup

In order to complete the process you will need to contact Port to deliver and receive information, as detailed in the guide below.

Create a new Onelogin application​

  1. In the Admin Console, go to Applications -> Applications.
  2. Click Add App.
OneLogin Applications page with the Add App button
  1. In the search box type OpenID Connect, then select OpenId Connect (OIDC):
OneLogin application search showing the OpenID Connect OIDC result

  1. Define the initial Port application settings:

    1. Display Name: Insert a name of your choice for the Port app, like Port.
    2. Add rectangular and square icons (optional):
    Rectangular Port wordmark for the OneLogin application icon Square multicolor Port icon for the OneLogin application
OneLogin OpenID Connect application form with Port display name and uploaded rectangular and square icons

Click Save.

Find your Port app

Most of the following steps involve editing the initial Port app you created. Keep in mind you can always go back to it by opening the admin console and going to Applications -> Applications, the Port app will appear in the application list.

Configure your Onelogin application​

In the Port app, go to the Configuration menu and follow these steps:

  1. Under Login URL paste the following login URL:
Set authorization endpoint based on account region

Port exposes two API instances, one for the EU region and one for the US region. Use the correct endpoint based on your account region, replacing company-<companyID>-SSO with your actual connection name.

To find your connection name: open the Credentials modal, go to the Organization tab, and copy the Company ID. Use only the ID portion. For example, if your Company ID is company_123456789, your connection name is company-123456789-SSO.

https://auth.getport.io/authorize?response_type=token&client_id=96IeqL36Q0UIBxIfV1oqOkDWU6UslfDj&connection=company-<companyID>-SSO&redirect_uri=https%3A%2F%2Fapp.port.io

  1. Under Redirect URI's set: https://auth.getport.io/login/callback.

    • The Redirect URI is where Onelogin sends the authentication response and ID token for the sign-in request.

Click Save.

Save redirect URI first

Be sure to click save before moving on to the next step because without the Redirect URI's filled in, trying to save any other application parameter will result in an error.

Configure OIDC settings​

In the Port app, go to the SSO menu and follow these steps:

  1. Copy the Client ID and the Client Secret and send it to Port (on the slack channel).

  2. Click on the Well-known Configuration Link, and send the page address to Port (its format will be https://{YOUR_DOMAIN}.onelogin.com/oidc/2/.well-known/openid-configuration)

  3. Change the Token Endpoint - Authentication Method to None (PKCE):

OneLogin OIDC settings showing the client credentials and None PKCE token endpoint authentication method

Click Save.

Add email_verified custom property to all users​

The use of OpenID requires that Onelogin passes to Port an email_verified field upon user login. Onelogin does not store and expose that field by default, so in this step, you are going to configure that field and apply it to all users in your Onelogin account. The steps outlined here can also be found in the Onelogin documentation.

  1. In the Admin Console, go to Users -> Custom User Fields.
  2. Click on New User Field.
  3. Enter the following details:
    1. Name: Email Verified
    2. Shortname: email_verified
OneLogin New User Field form with Email Verified name and email_verified shortname

The custom field is null by default, in order to change its value to true you will create a custom mapping rule:

Per-user setting doesn't scale

It is also possible to manually change the value of the Email Verified field to true for each user that requires access to Port in your organization. However, granting access manually to a large number of users is not scalable.

email_verified auto-mapping

The mapping specified here will set the value of the Email Verified custom field to true for every user whose Status is Active in your Onelogin organization. Feel free to use a different mapping if you seek a specific mapping.

  1. Go to Users -> Mappings
  2. Click on New Mapping
  3. Enter mapping details:
    1. Name: Insert a friendly name for the mapping, like Set Email Verified;
    2. Conditions: Set the condition: - Status - is - Active;
    3. Actions: Set the action: Set Email Verified - true.
  4. Click Save.
OneLogin mapping that sets Email Verified to true when a user status is Active

After creating the mapping rule, go back to Users -> Mappings and click on Reapply All Mappings. The new mapping might process for a few minutes before it is applied. You can check the mapping job status either by going to Activity -> Jobs or by looking at a specific user and verifying that it has the Email Verified field set to true (and not the default empty field).

Configure OpenID claims​

In the Port app, go to the Parameters menu and follow these steps:

  1. Click on the + button;
  2. In the form that appears, under Field Name write: openid and click save;
  3. In the value drop down that appears, select OpenID name.

Repeat the process two more times and add the following additional parameters:

  1. Field Name: email, Value: Email
  2. Field Name: email_verified, Value: Email Verified (Custom)

At the end of the process, your Parameters section will look like this:

OneLogin OIDC Parameters table mapping Groups, email, email_verified, and openid claims

Click Save.

Expose the application to your organization​

  1. In the Application page, select the Port app and go to the Access menu.

  2. In the Roles section, select the roles you want to expose the Port app to:

    OneLogin Access settings with Default, onelogin, and Onelogin 2nd Role selected for the application

  3. Click Save.

After completing these steps, users with roles that the Port app was assigned to, will see the Port app in their Portal and upon clicking it, will be logged in to Port:

Onelogin Portal With Port App

Direct access via URL

After configuring the SSO connection, you can initiate the login flow directly via URL. Use the following URL based on your account region, replacing company-<companyID>-SSO with your actual connection name. You can find your connection name in the Single Sign-On URL shown during the self-serve SSO setup flow - look for the connection parameter in the URL.

https://auth.getport.io/authorize?response_type=token&client_id=96IeqL36Q0UIBxIfV1oqOkDWU6UslfDj&connection=company-<companyID>-SSO&redirect_uri=https%3A%2F%2Fapp.port.io

Pull Onelogin roles into Port​

Onelogin roles (optional)

This stage is OPTIONAL and is required only if you wish to pull all of your Onelogin roles into Port inherently.

Benefit: managing permissions and user access on Port.
Outcome: for every user that logs in, we will automatically get their associated Onelogin roles, according to your definition in the settings below.

To allow automatic Onelogin roles support in Port, please follow these steps:

  1. In the Application page, select the Port app and go to the Parameters menu;

  2. Click on the Groups claim:

    OneLogin OIDC Parameters table with the Groups claim available for editing

  3. Update the groups claim:

    1. Change the value of Default if no value selected to User Roles;
    2. From the dropdown, select Semicolon delimited input:
    OneLogin Groups claim editor with User Roles as the default and semicolon-delimited multi-value output
    1. Click Save.

  4. Click Save.