OneLogin SSO Setup
If you use OneLogin as your Single Sign-On provider, here are the steps you or your IdP admin need to complete in order to create an integration between your OneLogin and Criteria accounts.
Create a OneLogin SAML application
- On the OneLogin portal page (https://your-new-domain.onelogin.com/portal/), choose Administration.
- At the top of the Administration page click on Applications and then click on Add App at the top left.
- In the search bar under Find Applications, enter saml, and then choose OneLogin SAML Test (IdP) to open the Add OneLogin SAML Test (IdP) page.
- For Display Name enter Criteria.
- Choose Save.
Edit your OneLogin application configuration
- Choose Configuration.
- On the Configuration page, do the following:
- For Audience, enter urn:amazon:cognito:ap-southeast-2_htcOeRF9C
- Leave Recipient blank.
- For ACS (Consumer) URL Validator, enter https://app-au.auth.ap-southeast-2.amazoncognito.com/saml2/idpresponse
- For ACS (Consumer) URL, enter https://app-au.auth.ap-southeast-2.amazoncognito.com/saml2/idpresponse
- Leave Single Logout URL blank.
- Edit your OneLogin application's parameter
- Choose Parameters. (Note: One parameter (NameID (fka Email)) is already listed—this is expected.)
- Choose Add parameter to create a new, custom parameter.
- In the New Field dialog, for Field name, enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
- For Flags, select the Include in SAML assertion check box.
- Choose Save.
- For Value, choose UUID from the list.
- Choose Save.
- Do the same for the following and make sure to select Include in SAML assertion like above:
- http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress with value Email
- http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstname with value First Name
- http://schemas.xmlsoap.org/ws/2005/05/identity/claims/lastname with value Last Name
- The parameters should look like the image below:
Copy the IdP metadata for your OneLogin application
- Choose SSO
- Under Issuer URL, copy the URL and send to Criteria Corp.
- Choose Save to save all your changes to your OneLogin application.
Click here for the next steps in the SSO integration setup process.
Parameters Needed
Here is a recap of the parameters required to set up an integration between OneLogin and Criteria.
Criteria Provided Parameters
- Entity ID (Audience URI): urn:amazon:cognito:ap-southeast-2_htcOeRF9C
- Assertion Consumer Service URL: https://app-au.auth.ap-southeast-2.amazoncognito.com/saml2/idpresponse
- First-Time Sign-On URL/BookMark: https://app-au.criteriacorp.com/?companyAccountId=<companyAccountId>
- Our Required SAML Attributes
- Idp Immutable Global Unique Identifier (Varies by Idp)
- First Name
- Last Name
- Email Address
- Optional Recommended SAML Attribute
- Job Title
Customer Provided Parameters
- Federation Metadata Document endpoint URL (Can also be an XML Document but URL preferred)