> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Aviatrix SAML Authentication on OneLogin IdP

> This guide provides an example on how to configure Aviatrix to authenticate against a OneLogin IdP. When SAML client is used, your Aviatrix CoPilot acts as the Identity Service Provider (ISP) that redirects browser traffic from client to IdP (e.g., OneLogin) for authentication.

This guide provides an example on how to configure Aviatrix to authenticate
against a OneLogin IdP. When SAML client is used, your Aviatrix CoPilot acts as
the Identity Service Provider (ISP) that redirects browser traffic from client
to IdP (e.g., OneLogin) for authentication.

## Pre-Deployment Checklist

Before configuring SAML integration between Aviatrix and OneLogin, make sure the
following is completed:

1. The Aviatrix Controller is deployed.
2. Have a valid [OneLogin Account](#onelogin-account) with admin access.
3. Download and install the
   <a href={"/docs/enterprise/" + "10.1" + "/guides/uservpn/user-vpn-client-download"}>Aviatrix SAML VPN client</a>
   .

### OneLogin Account

A valid OneLogin account with admin access is required to configure the
integration.

### Aviatrix CoPilot

All users must use the Aviatrix VPN client to connect to the system. Download
the client for your OS

<a href={"/docs/enterprise/" + "10.1" + "/guides/uservpn/user-vpn-client-download"}>here</a>
.

## Configuration Steps

Follow these steps to configure Aviatrix to authenticate against your OneLogin
IDP:

1. Create a [OneLogin SAML App](#onelogin-saml-app) for Aviatrix.
2. Create a [SAML Endpoint](#aviatrix-copilot-saml-endpoint) in Aviatrix
   CoPilot.

### OneLogin SAML App

Before you start, pick a short name to be used for the SAML application name. In
the notes below, we will refer to this as **aviatrix\_onelogin**, but it can be
any string.

We will use the string you select for the SAML application name to generate a
URL for OneLogin to connect with Aviatrix. This URL is defined below as
**SP\_ACS\_URL**. This URL should be constructed as:

```
https://<your coPilot ip or host name>/flask/saml/sso/<aviatrix_onelogin>
```

<Tip>
  Replace **\<your CoPilot IP or host name>** with the actual host name or
  IP address of your CoPilot and **\<aviatrix\_onelogin>** with the string
  you chose to refer to the SAML application.
</Tip>

1. Log in to OneLogin as an administrator.

2. Add a new App (Apps > Add Apps).

3. Search for "SAML Test Connector."

4. Select **SAML Test Connector (Advanced)**.

5. Enter the Configuration values and click **Save**.

   <img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/onelogin-new-app-step1.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=33f5a0927f87a197cf6aff24f8c80f0c" alt="OneLogin New App Step 1" width="1089" height="496" data-path="images/guides/uservpn/onelogin-new-app-step1.png" />

   You can download the rectangular image from here:

   <img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/aviatrix-logo-rect.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=f8f39cb8599f851754810895b4bc4a41" alt="Aviatrix Logo Rectangular" width="716" height="200" data-path="images/guides/uservpn/aviatrix-logo-rect.png" />

   You can download the square image from here:

   <img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/aviatrix-logo-square.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=c223dd333688cffe10635eeaabbb4376" alt="Aviatrix Logo Square" width="256" height="256" data-path="images/guides/uservpn/aviatrix-logo-square.png" />

6. Click on **Configuration** tab.

7. Enter the values.

   | Field                                        | Value                       |
   | -------------------------------------------- | --------------------------- |
   | RelayState                                   | Blank                       |
   | Audience(Entity ID)                          | **SP Entity ID**            |
   | Recipient                                    | **SP\_ACS\_URL**            |
   | ACS (Consumer) URL Validator                 | **SP\_ACS\_URL**            |
   | ACS (Consumer) URL                           | **SP\_ACS\_URL**            |
   | Single Logout URL                            | Blank                       |
   | Login URL                                    | **SP Login(Test) URL**      |
   | SAML not valid before                        | 3 (default)                 |
   | SAML not valid on or after                   | 3 (default)                 |
   | SAML initiator                               | Service Provider            |
   | SAML nameID format                           | Transient                   |
   | SAML issuer type                             | Specific (default)          |
   | SAML signature element                       | Assertion                   |
   | Encrypt assertion                            | Unmarked checkbox (default) |
   | SAML encryption method                       | TRIPLEDES-CBC (default)     |
   | Sign SLO Response                            | Unmarked checkbox (default) |
   | SAML sessionNotOnOrAfter                     | 1440 (default)              |
   | Generate AttributeValue tag for empty values | Unmarked checkbox (default) |
   | Sign SLO Request                             | Unmarked checkbox (default) |

   <img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/onelogin-configuration.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=dfe36ff497ff44e2b36dec49993c937f" alt="OneLogin Configuration" width="820" height="2017" data-path="images/guides/uservpn/onelogin-configuration.png" />

8. Click **Save**.

9. Select the **Parameters** tab.

10. Add the following custom parameters (case sensitive).

    | Field     | Value      | Flags                     |
    | --------- | ---------- | ------------------------- |
    | Email     | Email      | Include in SAML assertion |
    | FirstName | First Name | Include in SAML assertion |
    | LastName  | Last Name  | Include in SAML assertion |

    <img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/onelogin-parameters.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=7f2590b6784354529fb966c4b457ed3b" alt="OneLogin Parameters" width="853" height="484" data-path="images/guides/uservpn/onelogin-parameters.png" />

11. Optionally, add a field to map to the profile in Aviatrix.

    | Field   | Value          | Flags                     |
    | ------- | -------------- | ------------------------- |
    | Profile | (User Defined) | Include in SAML assertion |

12. Click **Save**.

13. Click on **More actions** dropdown menu.

14. Copy the **Metadata URL**.

    <img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/onelogin-issuer-url.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=e3daf10933639d4f2ba9610dcbc1892f" alt="OneLogin Issuer URL" width="447" height="230" data-path="images/guides/uservpn/onelogin-issuer-url.png" />

### Aviatrix CoPilot SAML Endpoint

1. Go to **Aviatrix CoPilot > CloudFabric > UserVPN > select the Settings tab**.
2. Under SAML, click **+ SAML Endpoint**.
3. Enter the following information:

   | Field                        | Description                                                   |
   | ---------------------------- | ------------------------------------------------------------- |
   | Name                         | Pick                                                          |
   | IPD Metadata Type            | URL                                                           |
   | IDP Metadata Text/URL        | Paste in the **Metadata URL** obtained from the OneLogin app. |
   | Entity ID                    | Select **Hostname**.                                          |
   | Custom SAML Request Template | Turn this setting off.                                        |

## Testing the Integration

1. Log into **Aviatrix CoPilot > Cloud Fabric > UserVPN > select the Settings
   tab**.
2. Under SAML, find the SAML endpoint. In the Test column, select the link
   provided.

## Creating a VPN User

<a href={"/docs/enterprise/" + "10.1" + "/guides/uservpn/user-vpn-saml-authentication"}>Create a new VPN user</a>
. Use the VPN gateway created above.

## Validating

1. Go to **Aviatrix CoPilot > CloudFabric > UserVPN > select the Users tab**.
2. Download the configuration for your test user created in the previous step.
3. Open the Aviatrix VPN Client application.
4. Click **Load Conf** and select the file downloaded.
5. Click **Connect**.