SSO with Onelogin

SAML

Configuration

1. Add the connector For a SAML provider setup, go to Applications and search for SAML Custom Connector (Advanced). Select the option, set a display name and save the application.
2. Set the Entity ID In the Configuration section, copy the Entity ID from the SSO provider form on the LocknCharge Cloud into the Audience (EntityID) field.
3. Set the ACS URL Copy the ACS URL from LocknCharge Cloud into both ACS (Consumer) fields. The validator should match the primary URL. The other settings in the configuration can be left as they are.
4. Map the attributes To map user attributes to LocknCharge on user sign-in, head to the Parameters section. The NameID attribute is defaulted to email given the format set in the configuration. Given no other parameters are set, the email will be mapped as the user id. The field name is the attribute mapping key to be set on the LocknCharge Cloud, ensuring the fields are included in the SAML assertion. Example: (name = name).
5. Add the metadata Next, copy the Issuer URL in the SSO section into the Metadata document form field on the LocknCharge Cloud. Alternatively, upload the SAML metadata which can be found in the More Actions dropdown in the SAML application.
6. Save Save the application.
7. Assign users To allow access for SSO users to the LocknCharge Cloud, each user will need to be assigned to the SAML application. This can be done by selecting a user in the Users section and assigning a new login to the application for the selected user.

Assigning custom roles for an SSO user

Before assigning a custom role to an SSO user, a Custom User Field will need to be created which can be found within the Users dropdown list.

1. Create a user field Create a new user field which can be of any value.
2. Set the user's role Select a user that you would like to assign a custom role to and update the new field. The value should be the ID of a role listed in the LocknCharge Cloud Roles section located within the accounts page.
3. Open Parameters Next, select the SAML application used for LocknCharge Cloud and head to the Parameters section.
4. Add the roles field Add a new field, the name should match the Roles attribute mapping set in LocknCharge Cloud and select the newly added custom user field as the value.
5. Include in the SAML assertion Enable the Include in SAML assertion flag and save.

It may take a few minutes for the changes to apply and should take effect on next login. Otherwise, re-apply the entitlement mappings under More Actions.

If an invalid role ID is assigned to a user, the SSO login to the LocknCharge Cloud will fail.

If the Roles attribute mapping is not set in LocknCharge Cloud, all SSO users will be granted the default Admin role.

Troubleshooting

If there are any issues signing in with SSO after following the instructions above, please contact support for assistance.

OIDC

Configuration

1. Add the OpenId Connect app For an OIDC provider setup, go to Applications and search for OpenId Connect, there should only be 1 result. Select the application and set a display name for it.
2. Set the redirect URI In the Configuration section, copy the callback URL from the SSO provider form on the LocknCharge Cloud and add it as part of the Redirect URI's list.
3. Copy the client details Next, copy the following details in the SSO section into the SSO provider form.
   1. Client ID
   2. Client Secret
   3. Issuer URL - domain
4. Leave the type as Web Leave the application type as Web. Native is not supported.
5. Set the authentication method Set the token endpoint authentication method to POST. Other methods are not supported.
6. Leave other fields as is All other fields in the OIDC application can be left as is.
7. Save Save the application.
8. Assign users To allow access for SSO users to the LocknCharge Cloud, each user will need to be assigned to the OIDC application. This can be done by selecting a user in the Users section. Ensure the Allow the user to sign in option is enabled on assignment.

Attribute mappings

Authorizing the profile scope will map the name user attribute to the LocknCharge Cloud. The name attribute will automatically be mapped and set by OneLogin as it concatenates first name and last name together.

Authorizing the email scope will map the email user attribute to the LocknCharge Cloud.

Assigning custom roles for an SSO user

Custom roles are currently not supported for OneLogin OIDC in LocknCharge Cloud. Please use SAML to allow custom roles for SSO users.

If the roles scope is authorized in LocknCharge Cloud, SSO logins will fail.

All SSO users will be granted the Admin role by default.

Troubleshooting

Issues signing in after entering the provider name:

Given the instructions above are followed, this error will occur if there is a recent update to the OIDC application configuration or a user's details. Usually, it takes a few moments before the LocknCharge Cloud is able to verify the SSO user credentials successfully on single-sign-on. If the problem persists, please contact support for further assistance.