OneLogin

1. Select Enable Administrators to log in to the portal using this IdP.

2. Select one of these options:

   • Login based on domain verification - Infinity Portal Administrators can log in to this Infinity Portal account with SSO from the Identity Provider A system entity that creates, maintains, and manages identity information for principals and also provides authentication services to relying applications within a federation or distributed network. Acronym: IdP or IDP.. Administrators log in through the Infinity Portal login page.

   • Login with a unique URL - Infinity Portal Administrators can log in to multiple Infinity Portal accounts with SSO from the Identity Provider. Administrators log in using the URL that appears at the bottom of the Login with a unique URL button. Copy this URL and keep it in a safe place.

1. In the Service(s) Integration section, select one of these options:

   • No Services - End users of Infinity Portal services cannot authenticate with SSO from the Identity Provider. This is the default configuration.

   • All Services - End users can log in with SSO from the Identity Provider to all Check Point services that support SSO.

   • Specific Service(s) - From the list of services, select service(s) to allow end users to log into with SSO from the Identity Provider. Available services:

     • Harmony Connect

     • Quantum Gateways

2. Click Next (or, if you are editing a configuration, Apply) to complete the Integration Type configuration.

IdP Initiated lets you connect directly to Infinity Portal from your OneLogin Admin Console. To do this, you must create an Infinity Portal app card in your OneLogin Admin Console. See the OneLogin documentation.

Step 1: In Infinity Portal, enable IdP Initiated flow:

1. In the Infinity Portal > IdP Integration Allow Connectivity step, select the checkbox Enable IDP initiated flow.

   The Relay State field appears.

Step 2: In your OneLogin account, configure the IdP Settings:

1. Navigate to your OneLogin Admin Console.

2. Click Applications.

3. Open the application object for the SAML Security Assertion Markup Language. An XML-based, open-standard data format for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. connection to Infinity Portal.

4. From the left toolbar, click Configuration.

5. In the Relay State field, enter the Relay State from Infinity Portal

6. Click Save.

Important - Before you can test the connectivity between OneLogin and the Infinity Portal, you must complete all of the IdP integration steps in the Infinity Portal.

1. In OneLogin, log in to your admin account.

2. From the menu bar, click Developers > API Credentials.

   

   The API Access page opens.

3. Click New Credential.

   

   The Create new API credential window opens.

4. Enter a name for the new API credential.

   

5. Select Read all.

6. Click Save.

   A window with the client credentials opens.

   

7. Copy these values to a separate file:

   • Client ID

   • Client Secret

   Best Practice - Check Point recommends that you save the Token Value in a separate, secured file to retrieve it when necessary.

8. In the Infinity Portal IdP wizard, do these steps:

   1. Go to the Set Directory Integration page.

   2. In the Client ID field, paste the Client ID you copied from OneLogin.

   3. In the Client Secret field, paste the Client Secret you copied from OneLogin.

   4. In the Sub Domain field, paste the part of the URL for your OneLogin account that comes before ".onelogin.com".

      Example: the Sub Domain for "theGreatCompany.onelogin.com" is "theGreatCompany".

9. To test the users and group synchronization between the Infinity Portal and the IdP, click Test Connectivity.

   If the test is unsuccessful, repeat the Set Directory Integration step to configure the user and group synchronization parameters.

10. Click Next.

Note - SCIM is supported only for the OneLogin application type SCIM Provisioner with SAML (SCIM v2 Core).

Step 1 - In the Infinity Portal, copy values and complete the IdP Integration Wizard:

1. In the Infinity Portal > Directory Integration step, select Automatic Sync (SCIM).

2. Copy these values and keep them in a safe place:

   • SCIM API Token

   • URL

3. Click Next.

   The Confirm Identity Provider step opens.

4. Click Submit.

   OneLogin is now integrated with the Infinity Portal. The OneLogin integration appears in the gallery in the Infinity Portal. Complete the SCIM (Automatic Sync) configuration in the OneLogin Portal.

Step 2 - In the OneLogin Application > Configuration section, paste values:

1. In the OneLogin application you created for the Infinity Portal, from the left menu, click Configuration.

2. In the SCIM Base URL field in the OneLogin Portal, paste the URL you copied from the Infinity Portal.

3. In the SCIM Bearer Token field in the OneLogin Portal, paste the SCIM API Token you copied from the Infinity Portal.

4. In the Custom Headers field, enter:

   Copy

   Value for OneLogin Portal > "Custom Headers" field

   Content-Type: application/scim+json

5. In the API Connection section, below API Status, click Enabled.

6. In the SCIM JSON Template field, enter:

   Copy

   Value for OneLogin Portal > "SCIM JSON Template" field

   {
       "schemas": [
       "urn:ietf:params:scim:schemas:core:2.0:User"
        ],
       "userName": "{$parameters.scimusername}",
       "displayName": "{$user.display_name}",
       "externalId": "{$user.id}",
       "phoneNumbers":    [{
           "value": "{$parameters.phone}",
           "type": "work",
           "primary": true
       }]
   }

7. Click Save.

Step 3: In the OneLogin Application, configure parameters:

1. In the OneLogin application you created for the Infinity Portal, from the left menu, click Parameters.

2. In the Credentials are section, make sure that Configured by admin is selected. This option is selected by default.

3. In the table, click the + button.

   The New Field window opens.

4. For Field name, enter phone.

5. Press "Enter" on your keyboard.

6. For Value, select phone.

7. In the Flags section, select Include in User Provisioning.

8. Click Save.

   The window closes. The phone parameter appears in the table.

9. In the table, click the Groups table row.

   The Edit Field Groups window opens.

10. Select Include in User Provisioning.

11. Click Save.

    The window closes.

12. Click Save.

Step 4: In the OneLogin Application, create rules:

1. In the OneLogin application you created for the Infinity Portal, from the left menu, click Rules.

2. Click Add Rule.

   The New mapping window opens.

3. For Name, enter roles.

4. In the Actions section, select Set Groups in [NAME OF YOUR APPLICATION].

5. Create a rule to assign OneLogin roles to the application. To assign all OneLogin roles to the application, create this rule:

   For each role with value that matches .*

6. Click Save.

   The window closes.

Step 5: In the OneLogin Application, enable provisioning:

1. In the OneLogin application you created for the Infinity Portal, from the left menu, click Provisioning.

2. In the Workflow selection, select Enable provisioning.

3. Click Save.

Step 6: In the OneLogin Portal, add users to the application:

You must add OneLogin users individually to the application you created for the Infinity Portal.

1. In the OneLogin Portal, from the top menu, click Users.

2. Select a user.

3. From the left menu, open the Applications tab.

4. Click the + icon.

   The Assign new login to [NAME OF THE USER] window opens.

5. Select the application you created for the Infinity Portal.

6. Click Continue.

7. From the top menu, select Users > Provisioning.

8. In the table, click the provisioning task for the user that you added.

   A window opens.

9. Click Approve.

   The window closes.