Set Up OneLogin SAML Custom Connector (Advanced) Application¶

The steps to configure OneLogin integration in the Privacera Self-Managed (Portal).

Step 1: SSH into Privacera Instance¶

SSH into the instance where Privacera is installed.

Step 2: Navigate to Privacera Manager Directory¶

1

cd ~/privacera/privacera-manager

Step 3: Copy the saml Sample Configuration File¶

Copy the sample saml configuration file to the custom configuration directory.

1

cp config/sample-vars/vars.portal.saml.aad.yml config/custom-vars/

Step 4: Rename the downloaded metadata XML file from OneLogin¶

1. Locate the metadata file downloaded in Step 6, (usually in your Downloads folder or the folder where you saved it).
2. Rename the file to privacera-portal-aad-saml.xml

Step 5: Upload or Copy the File to Privacera Manager’s custom properties folder¶

Option 1: Using SCP (for Remote Servers)¶

1. Open a terminal and run the following command to upload the file to the Privacera Manager’s custom properties folder:

   Bash
   1	scp ./privacera-portal-aad-saml.xml user@<server-ip>:~/privacera/privacera-manager/config/custom-properties/

   Replace <server-ip> with your server’s IP address and user with your username.

Option 2: Copy-Paste Locally¶

1. If the file is on the same server, move the privacera-portal-aad-saml.xml file to the home directory.

2. Use the following command to copy it to the custom properties folder

   Bash
   1	cp ./privacera-portal-aad-saml.xml ~/privacera/privacera-manager/config/custom-properties/

   Ensure the privacera-portal-aad-saml.xml file is in the correct directory before running the cp command.

Step 6: Edit the Configuration File¶

Open the configuration file using a text editor and update the required fields.

1

vi config/custom-vars/vars.portal.saml.aad.yml

Uncomment and edit the following properties:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

SAML_ENTITY_ID: "privacera_portal"
SAML_BASE_URL: "https://{{app_hostname}}:{port}"
PORTAL_UI_SSO_ENABLE: "true"
PORTAL_UI_SSO_URL: "saml/login"
PORTAL_UI_SSO_BUTTON_LABEL: "Single Sign On"
AAD_SSO_ENABLE: "true"

SAML_EMAIL_ATTRIBUTE: "UserId"
SAML_USERNAME_ATTRIBUTE: "Email"
SAML_LASTNAME_ATTRIBUTE: "LastName"
SAML_FIRSTNAME_ATTRIBUTE: "FirstName"

If you have configured Group Attribute, uncomment and edit the following properties:

1

SAML_GROUP_ATTRIBUTE: "memberOfGroupNames"

Step 7: Update Privacera Manager¶

1
2

  cd ~/privacera/privacera-manager/
  ./privacera-manager.sh update

Step 8: Optional - Role Mapping For One Login¶

Role mapping allows you to translate roles or groups from your OneLogin Identity Provider (IdP) into specific roles within Privacera. This ensures that users have the correct permissions and access when they log into Privacera.

What is Role Name Attributes?¶

This attribute in your IdP contains the user's roles or group information. It is used to identify the roles or groups the user belongs to in the IdP.

What is Role Mapping?¶

This configuration maps Identity Provider roles/groups to Privacera Portal roles. Matching roles are assigned to users; otherwise, The default role configured in the property (PORTAL_SSO_DEFAULT_USER_ROLE) from Privacera Manager is applied, Or ROLE_USER if unspecified.

In Privacera, follow these steps to access the SAML Role mapping settings:

1. Go to the Settings menu.
2. Navigate to SSO Role Mapping.
3. Click on SAML tab.

Reference image of Role Mapping form Privacera:

Example:¶

• Mapped Privacera Role: ROLE_SYS_ADMIN
• Identity Provider (IdP) Role or Group: saml_admin

In this example, if a user has the role saml_admin in OneLogin, they will automatically be assigned the ROLE_SYS_ADMIN role in Privacera.

Step 9: Verify SSO Login¶

Once the setup is complete, navigate to the Privacera Portal login page. You should see an SSO Login button. Use this to log in with your OneLogin credentials.

In Privacera, follow these steps to access the Single Sign-On settings:

1. Go to the Settings menu.
2. Navigate to Identity.
3. Click on Single Sign-On.

Reference image from PrivaceraCloud for better guidance:

These variables ensure seamless integration between oneLogin and Privacera for SAML-SSO.

Role Mapping For OneLogin¶

Role mapping allows you to translate roles or groups from your OneLogin Identity Provider (IdP) into specific roles within Privacera. This ensures that users have the correct permissions and access when they log into Privacera.

What is Role Name Attributes?¶

This attribute in your Identity Provider (IdP) contains the user's roles or group information. It identifies the roles or groups the user belongs to in the IdP.

What is Role Mapping?¶

This configuration maps roles or groups from the Identity Provider (IdP) to corresponding roles in Privacera.If a specific role from the Identity Provider (IdP) matches a role defined in the role mapping configuration, that role is assigned to the user in Privacera. If no mapping is defined, the default role, ROLE_USER, is automatically assigned to the user.

Reference image of Role Mapping form PrivaceraCloud:

Example:¶

• Identity Provider (IdP) Role or Group: one_role_admin
• Mapped Privacera Role: ACCOUNT_ADMIN

In this example, if a user has the role one_role_admin in OneLogin, they will automatically be assigned the ACCOUNT_ADMIN role in Privacera.

By properly configuring role mapping, you ensure that users are granted appropriate access levels within Privacera based on their roles or group memberships from the Identity Provider (IdP). This simplifies user management and ensures seamless integration with your organization’s existing identity infrastructure.

Once the configuration is complete, you can test the setup by attempting to log in to PrivaceraCloud using your OneLogin credentials. This will help verify that the Single Sign-On (SSO) integration is working correctly.