# OneLogin

{% hint style="success" %}
**Access Type**: Organization Settings - Editor

**Premium Feature**: SSO
{% endhint %}

Single Sign-On (SSO) is an authentication process that allows users to access multiple applications or systems with one set of login credentials. In this article, we will cover how to configure SSO using the SAML 2.0 standard protocol with OneLogin.

* [Retrieve SSO SAML identifiers](#retrieve-sso-saml-identifiers)
* [Create Didomi console app in OneLogin](#create-didomi-console-app-in-onelogin)
* [Configure Didomi console app in OneLogin](#configure-didomi-console-app-in-onelogin)
* [Retrieve OneLogin metadata](#retrieve-onelogin-metadata)
* [Add OneLogin metadata](#add-onelogin-metadata)
* [Test and complete SSO configuration](#test-and-complete-sso-configuration)
* [Assign user access](#assign-user-access)

***

### Retrieve SSO SAML identifiers

To start, your organization needs to retrieve the SSO SAML identifiers from the Didomi console to continue setup in your identity provider.

Click **My organization** and selecting **Single Sign-on** from the drop-down menu.

<figure><img src="/files/xYTfkcoJha4cIEPxiw4C" alt="" width="563"><figcaption></figcaption></figure>

Use the provided fields in the **Get your SSO SAML identifiers** step to record the following:

<table><thead><tr><th width="210">Identifier</th><th>Description</th></tr></thead><tbody><tr><td>Configured issuer</td><td>Your organization's identity provider's unique identifier within the Didomi console.</td></tr><tr><td>Login URL</td><td>Where user will be redirected after successful login on the identity provider.</td></tr><tr><td>Logout URL</td><td>Where user will be redirected after successful logout on the identity provider.</td></tr></tbody></table>

<figure><img src="/files/Ntpfh2tkie9RRqTgsLoD" alt="" width="375"><figcaption></figcaption></figure>

Click **Continue** when finished.

### Create Didomi console app in OneLogin

Navigate to the **Administration** section of your organization's OneLogin portal and navigate to the following:

1. Select **Applications > Applications**.
2. Click **Add App**.
3. Search for **SAML Custom Connector (Advanced)** and select it from the list.
4. For the **Display Name** field, enter a name for your new application that is recognizable as being for the Didomi console (e.g. Didomi Console). This is where your organization will configure the SSO SAML.&#x20;
5. Click **Save** when finished.

A new app will be created in your OneLogin account.&#x20;

### Configure Didomi console app in OneLogin

From your newly created Didomi console app in One Login, navigate to the **Configuration** tab on the left-hand panel.

Use the provided fields to input the following values:

{% hint style="info" %}
Some values are retrieved from the [Didomi SSO SAML identifiers](#retrieve-sso-saml-identifiers).
{% endhint %}

<table><thead><tr><th width="272">OneLogin field</th><th>Values</th></tr></thead><tbody><tr><td>Audience (EntityID)</td><td>Configured issuer</td></tr><tr><td>ACS (Consumer) URL Validator</td><td><em>[-a-zA-Z0-9@:%.\+~#=]{2,256}\.[a-z]{2,6}\b([-a-zA-Z0-9@:%\+.~#?&#x26;//=]*)</em></td></tr><tr><td>ACS (Consumer) URL</td><td>Login URL</td></tr><tr><td>Single Logout URL</td><td>Logout URL</td></tr><tr><td>SAML initiator</td><td>Service Provider</td></tr></tbody></table>

<figure><img src="/files/uu0m9gIyYiqOnF04wu1R" alt="" width="563"><figcaption></figcaption></figure>

Next, click **Parameters** from the left-hand panel and click **+** inline with the **SAML Custom Connector (Advanced Field)** header.&#x20;

<figure><img src="/files/P08JqpVfTo6yxACPEnVi" alt="" width="563"><figcaption></figcaption></figure>

In the subsequent modal:

1. Input `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` in the **Field name** field.
2. Select **Email** in the **Value** field.
3. Enable the checkbox for **Include in SAML assertion** and click **Save**.

<figure><img src="/files/CrUg2qhWo4E1QXAJHsIp" alt="" width="375"><figcaption></figcaption></figure>

### Retrieve OneLogin metadata

From your newly created Didomi console app in One Login, navigate to the **SSO** tab on the left-hand panel. Record the values for the following fields (collectively Didomi refers to these values as metadata):

* X.509 Certificate (under **View Details**)
* SAML 2.0 Endpoint (HTTP)
* SLO Endpoint (HTTP)

<figure><img src="/files/DyAttl3YnJlpE96nC5jQ" alt="" width="563"><figcaption></figcaption></figure>

### Add OneLogin metadata

With the metadata from OneLogin copied, navigate back to the SSO configuration within the Didomi console and input those values in the provided fields for the **Setup SSO settings** step.

<table><thead><tr><th width="299">Didomi metadata</th><th>Google values</th></tr></thead><tbody><tr><td>X509 certificate</td><td>X.509 certificate</td></tr><tr><td>Login URL</td><td>SAML 2.0 Endpoint (HTTP)</td></tr><tr><td>Logout URL</td><td>SLO Endpoint (HTTP)</td></tr></tbody></table>

<figure><img src="/files/CVOXd09VnoRe3zbsJNSI" alt="" width="563"><figcaption></figcaption></figure>

### Test and complete SSO configuration

Didomi will verify the identity provider metadata. When successful, utilize the **Domain(s)** field to add email domains to which the SAML authentication will be restricted (*i.e. only users whose emails have this domain will be allowed to login with SSO SAML*).&#x20;

{% hint style="warning" %}
For security, the domain added to the **Domain(s)** field must match the email domain of the user performing the configuration (e.g.  `didomi.io` can only be added if the user adding it is signed into the Didomi console using an `@didomi.io` email address.

To add more than one domain, please contact the Didomi support team via chat or email at <support@didomi.io>.
{% endhint %}

<figure><img src="/files/ob57E1LLIGN3HtBqgZWS" alt="" width="563"><figcaption></figcaption></figure>

Click **Save settings**.

### Assign user access

Navigate to the **Administration** section of your organization's OneLogin portal and navigate to **Users > Users**.

Follow the instructions to assign users to the Didomi console application created in OneLogin.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.didomi.io/organization-and-account-settings/single-sign-on-sso/onelogin.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.