# OneLogin
This doc describes how to create an OIDC app in OneLogin (opens new window) for Pomerium and connect to it. It assumes you have already installed Pomerium.
WARNING
While we do our best to keep our documentation up to date, changes to third-party systems are outside our control. Refer to Connect an OIDC enabled app (opens new window) from OneLogin's documentation as needed, or let us know (opens new window) if we need to re-visit this page.
# Create OpenID Connect App
Log in to your OneLogin (opens new window) account and click on Administration at the top.
Navigate to Applications on the top menu. Click the Add App button:
On the Find Application page, search for openid. Select Openid Connect by OneLogin, Inc.
On the App Configuration page, name the app and select a logo:
Select Save.
From the Configuration tab, set set the Redirect URI's to Pomerium's redirect url (
https://${authenticate_service_url}/oauth2/callback
):Select Save.
Navigate to the SSO page. This section contains the Client ID, Client Secret and Identity Provider URL you'll use to configure Pomerium:
Set the application type to Web and the token endpoint to be POST.
Under Token Timeout settings set Refresh Token to 60 minutes (or whatever value makes sense for your organization). Note, however, if you don't enable refresh tokens the user will be prompted to authenticate whenever the access token expires which can result in a poor user experience.
Select Save to complete the application configuration.
# Add Users
OneLogin will not make your new application accessible to members of your organization automatically. You can assign access to individual users (as shown below), or define rules / policies based on group membership.
# Service Account
To use allowed_groups
in a policy, an idp_service_account
needs to be set in the Pomerium configuration. The service account for OneLogin uses a different client ID and client secret from the one configured above.
From the Administration dashboard, navigate to Developers → API Credentials and select New Credential.
Name the new credential and rive it "Read users" access:
The format of the
idp_service_account
for OneLogin is a base64-encoded JSON document:{ "client_id": "...", "client_secret": "..." }
You can save the object as a temporary file to encode:
cat tmp.json | base64 -w 0
A Group's ID (opens new window) will be used to affirm user group membership.
# Pomerium Configuration
Update your Pomerium configuration:
After reloading Pomerium, you should be able to see any login events from your OneLogin events dashboard.