Skip to main content
This guide provides an example on how to configure Aviatrix to authenticate against a OneLogin IdP. When SAML client is used, your Aviatrix CoPilot acts as the Identity Service Provider (ISP) that redirects browser traffic from client to IdP (e.g., OneLogin) for authentication.

​
Pre-Deployment Checklist

Before configuring SAML integration between Aviatrix and OneLogin, make sure the following is completed:
  1. The Aviatrix Controller is deployed.
  2. Have a valid OneLogin Account with admin access.
  3. Download and install the Aviatrix SAML VPN client.

​
OneLogin Account

A valid OneLogin account with admin access is required to configure the integration.

​
Aviatrix CoPilot

All users must use the Aviatrix VPN client to connect to the system. Download the client for your OS here.

​
Configuration Steps

Follow these steps to configure Aviatrix to authenticate against your OneLogin IDP:
  1. Create a OneLogin SAML App for Aviatrix.
  2. Create a SAML Endpoint in Aviatrix CoPilot.

​
OneLogin SAML App

Before you start, pick a short name to be used for the SAML application name. In the notes below, we will refer to this as aviatrix_onelogin, but it can be any string. We will use the string you select for the SAML application name to generate a URL for OneLogin to connect with Aviatrix. This URL is defined below as SP_ACS_URL. This URL should be constructed as: 
https://<your coPilot ip or host name>/flask/saml/sso/<aviatrix_onelogin>
Replace <your CoPilot IP or host name> with the actual host name or IP address of your CoPilot and <aviatrix_onelogin> with the string you chose to refer to the SAML application.
  1. Log in to OneLogin as an administrator.
  2. Add a new App (Apps > Add Apps).
  3. Search for “SAML Test Connector.”
  4. Select SAML Test Connector (Advanced).
  5. Enter the Configuration values and click Save. OneLogin New App Step 1 You can download the rectangular image from here: Aviatrix Logo Rectangular You can download the square image from here: Aviatrix Logo Square
  6. Click on Configuration tab.
  7. Enter the values.
    FieldValue
    RelayStateBlank
    Audience(Entity ID)SP Entity ID
    RecipientSP_ACS_URL
    ACS (Consumer) URL ValidatorSP_ACS_URL
    ACS (Consumer) URLSP_ACS_URL
    Single Logout URLBlank
    Login URLSP Login(Test) URL
    SAML not valid before3 (default)
    SAML not valid on or after3 (default)
    SAML initiatorService Provider
    SAML nameID formatTransient
    SAML issuer typeSpecific (default)
    SAML signature elementAssertion
    Encrypt assertionUnmarked checkbox (default)
    SAML encryption methodTRIPLEDES-CBC (default)
    Sign SLO ResponseUnmarked checkbox (default)
    SAML sessionNotOnOrAfter1440 (default)
    Generate AttributeValue tag for empty valuesUnmarked checkbox (default)
    Sign SLO RequestUnmarked checkbox (default)
    OneLogin Configuration
  8. Click Save.
  9. Select the Parameters tab.
  10. Add the following custom parameters (case sensitive).
    FieldValueFlags
    EmailEmailInclude in SAML assertion
    FirstNameFirst NameInclude in SAML assertion
    LastNameLast NameInclude in SAML assertion
    OneLogin Parameters
  11. Optionally, add a field to map to the profile in Aviatrix.
    FieldValueFlags
    Profile(User Defined)Include in SAML assertion
  12. Click Save.
  13. Click on More actions dropdown menu.
  14. Copy the Metadata URL. OneLogin Issuer URL

​
Aviatrix CoPilot SAML Endpoint

  1. Go to Aviatrix CoPilot > CloudFabric > UserVPN > select the Settings tab.
  2. Under SAML, click + SAML Endpoint.
  3. Enter the following information:
    FieldDescription
    NamePick
    IPD Metadata TypeURL
    IDP Metadata Text/URLPaste in the Metadata URL obtained from the OneLogin app.
    Entity IDSelect Hostname.
    Custom SAML Request TemplateTurn this setting off.

​
Testing the Integration

  1. Log into Aviatrix CoPilot > Cloud Fabric > UserVPN > select the Settings tab.
  2. Under SAML, find the SAML endpoint. In the Test column, select the link provided.

​
Creating a VPN User

Create a new VPN user. Use the VPN gateway created above.

​
Validating

  1. Go to Aviatrix CoPilot > CloudFabric > UserVPN > select the Users tab.
  2. Download the configuration for your test user created in the previous step.
  3. Open the Aviatrix VPN Client application.
  4. Click Load Conf and select the file downloaded.
  5. Click Connect.