OpenVPN® with SAML Authentication on OneLogin IdP¶
This guide provides an example on how to configure Aviatrix to authenticate against a OneLogin IdP. When SAML client is used, your Aviatrix controller acts as the Identity Service Provider (ISP) that redirects browser traffic from client to IdP (e.g., OneLogin) for authentication.
Before configuring SAML integration between Aviatrix and OneLogin, make sure the following is completed:
- Aviatrix Controller is setup and running.
- Have a valid OneLogin account with admin access.
- Download and install the Aviatrix SAML VPN client.
If you haven’t already deployed the Aviatrix controller, follow the Controller Startup Guide.
A valid OneLogin account with admin access is required to configure the integration.
Follow these steps to configure Aviatrix to authenticate against your OneLogin IDP:
OneLogin SAML App¶
Before you start, pick a short name to be used for the SAML application name. In the notes below we will refer to this as aviatrix_onelogin. But, it can be any string.
We will use the string you select for the SAML application name to generate a URL for OneLogin to connect with Aviatrix. This URL is defined below as SP_ACS_URL. This URL should be constructed as:
https://<your controller ip or host name>/flask/saml/sso/<aviatrix_onelogin>
Replace <your controller ip or host name> with the actual host name or IP address of your controller and <aviatrix_onelogin> with the string you chose to refer to the SAML application.
Login to OneLogin as an administrator
Add a new App (Apps* > **Add Apps)
Search for SAML Test Connector
Select SAML Test Connector (IdP)
Enter the Configuration values and click Save
Click on Configuration tab
Enter the values
Field Value RelayState Blank Audience SP_ACS_URL Recipient SP_ACS_URL ACS (Consumer) URL Validator SP_ACS_URL ACS (Consumer) URL SP_ACS_URL Single Logout URL Blank
Click on the Parameters tab
Add the following custom parameters (case sensitive)
Field Value Flags Include in SAML assertion FirstName First Name Include in SAML assertion LastName Last Name Include in SAML assertion
Optionally, add a field to map to the profile in Aviatrix
Field Value Flags Profile (User Defined) Include in SAML assertion
Click on SSO tab
Note the Issuer URL for the next step.
Aviatrix Controller SAML Endpoint¶
Login to your Aviatrix Controller
Expand OpenVPN, select Advanced in the navigation menu
Go to the SAML tab
Click + Add New button
Follow the table below for details on the fields in the table:
Field Description Endpoint Name Pick IPD Metadata Type URL IDP Metadata Text/URL Paste in the Issuer URL obtained from the OneLogin app. Entity ID Select Hostname Custom SAML Request Template Unchecked
You can quickly validate that the configuration is complete by clicking on the Test button next to the SAML endpoint.