How to setup SAML with Onelogin as IdP (4353707)

In KACE SMA

• Enable SSL
  SSL configuration guide for KACE SMA
• Enable SAML

1. Browse to Settings | SAML Settings.
2. Select “Enable SAML Service Provider”.
3. (Optional) Check the "Require SAML Login" box (If set, users will only be allowed to use SAML to access the SMA. Local logins will be denied for all users except for the Primary Admin user and the KACE Support account (only when a Support Tether is active).
4. Select "IdP Does Not Support Passive Authentication".
5. Scroll Down to “Local Service (SP) Settings” and click on “View Metadata”.
6. Copy the link below “SP Assertion Consumer Service (url)” and “SP Entity Identifier (uri)” you will need these links on the Next steps on Azure. Make sure that all the links are "secure" shown as “https”. Add the “s” manually if the link is shown as “http”.

1. Stand by in KACE SMA and let's move to the steps in Azure.

In OneLogin

1. Add a new application, and search for "SAML Custom Connector (Advanced)".

1. Set the Name of your Application and click SAVE.
2. Click on the Configuration Section.
3. On the Audience (EntityID) field, paste the SP Entity Identifier (uri) from the SMA.
4. On the ACS (Consumer) URL Validator and the ACS (Consumer) URL fields paste the SP Assertion Consumer Service (url) from the SMA.
5. On the Single Logout URL field paste the SP SLO Endpoint (url) from the SMA.
6. Click on Save.

1. Click on the Parameter Section.
2. Create the attributes you will be sending to the SMA by clicking on the plus sign next to SAML Custom Connector (Advanced) Field.  (Please check the box to Include in SAML assertion for every attribute).

1. Click on Save.

1. Remember to grant Access to the users to the application on OneLogin.
2. Click on the SSO Section and copy the Issuer URL.

Back to KACE SMA

1. Paste the Issuer URL from OneLogin on the SMA on the IdP Metadata URL field and click on Import IdP Metadata.
2. Click on Save.

1. On the IdP Attribute Mapping section use the attributes created on OneLogin to map correctly the information sent from the IdP to the KACE SMA.

1. On Role Mapping section use the attribute created on OneLogin to correctly Assign Roles to the users that are login to the KACE SMA.

1. Click on Save