OneLogin

Configure SURF to authenticate and provision users against OneLogin. This page covers user sign-in via SAML, user and group provisioning via the SCIM API, group sync, and conditional access.

Before you start

Two OneLogin applications are involved. A SAML Test Connector (IdP) app handles user sign-in. A separate SCIM Provisioner with SAML (SCIM v2 Core) app handles provisioning. They are configured independently.

Step 1: Configure user authentication with SAML

SURF supports SP-initiated SSO, meaning the sign-in flow starts from SURF rather than the OneLogin portal.

In OneLogin

1. Navigate to the OneLogin admin console.
2. Go to Applications → Add App and search for SAML Test Connector (IdP).
3. Click the app to begin configuring it.
4. Set the display name, for example SURF User Login, and upload an app icon if wanted.
5. Click Save.
6. Open the Configuration tab and enter:

1. Open the SSO tab, select More Actions in the top right and download the SAML Metadata.

In SURF Admin

1. Go to Settings → Integrations and locate the SAML integration.
2. Click the gear icon and choose Add integration.
3. Upload the XML metadata file downloaded from OneLogin. Entity ID, Single SignOn URL and Public Certificate populate from the file.
4. Set Use as Default.
5. Click Submit on the SAML2 SSO config.
6. Turn the integration on.

Step 2: Provision users with the SCIM API

All SCIM API operations authenticate with a bearer token, which is the SURF company secret.

Retrieve the company secret

1. Log in to the SURF Admin console at https://admin.surf-admin.link/
2. Go to Settings → Additional Setup → Company Secret and copy the value.

Create the SCIM app in OneLogin

1. Log in to OneLogin as an administrator.
2. Go to Applications → Applications and click Add App.
3. Search for and select SCIM Provisioner with SAML (SCIM v2 Core).
4. Give the app a display name, for example Surf Security SCIM API, and click Save.
5. Open the Configuration tab and enter:

1. Click Enable on the API connection, then Save.
2. Go to Provisioning and tick Enable provisioning.

Assign users for provisioning

1. Go to Users → Users and open the user to assign.
2. In the user menu, open Applications, click +, select the SCIM app, then Continue and Save.
3. Return to the application's Users tab. The provisioning state reads Pending.
4. Click Pending and select Approve. The state changes to Provisioned.
5. Verify the user appears under SURF Admin → Users and Groups.

Step 3: Sync groups

Group membership is driven by OneLogin roles. The role name becomes the group name in SURF.

1. In the SCIM application, open Rules and add a new rule.
2. Select Set Groups in SCIM and set the role value to match .*, so every role is mapped.
3. Go to Users → Roles, create a new role and assign it to the application.
4. When creating users, make sure the email address and username are identical.
5. Under Users → Applications, assign each user to a role and to the application.
6. Sync the users.

Step 4: Configure conditional access

Restricts sign-in so OneLogin only authenticates users arriving through the SURF proxy.

4.1 Configure the proxy in SURF

1. In SURF Admin, go to Policy management → Proxy Access Management.
2. Configure the proxy:

1. Click Set.
2. Under Additional affected URLs, add your OneLogin domain, for example yourcompany.onelogin.com, so the sign-in flow itself is proxied.
3. Turn Proxy Access Management ON.

4.2 Create the IP allow list in OneLogin

1. Log in to the OneLogin admin console and go to Security → Policies.
2. Create a user policy, or edit an existing one. Policies can also be applied per application.
3. Open the IP Addresses section.
4. Under IP Address Allow List, enter the SURF proxy address. Multiple addresses or ranges are separated by spaces.
5. Save the policy.

Reference

Troubleshooting

For anything not covered here, contact the SURF support team.