OneLogin Integration

Connect IronWiFi to OneLogin to authenticate WiFi users with their OneLogin credentials. This integration enables SAML single sign-on for captive portals and RADIUS authentication for WPA-Enterprise networks.

Features

• SAML Single Sign-On - Enterprise SSO for captive portals
• User Synchronization - Import users from OneLogin
• Group Synchronization - Sync roles and groups
• RADIUS Authentication - WPA-Enterprise with OneLogin credentials
• Auto-provisioning - Create users on first login

Prerequisites

• OneLogin administrator account
• IronWiFi account with Connector access
• OneLogin plan that supports SAML (Professional or Enterprise)

SAML Single Sign-On Setup

Step 1: Create OneLogin Application

1. Log into OneLogin Admin Portal
2. Navigate to Applications > Applications
3. Click Add App
4. Search for "SAML Test Connector (IdP w/ attr)" or "SAML Custom Connector (Advanced)"
5. Click on the connector
6. Click Save

Step 2: Configure Application Details

1. In the Configuration tab
2. Set Display Name: IronWiFi
3. Add Icon (optional)
4. Click Save

Step 3: Configure SAML Settings

Navigate to the Configuration tab and enter:

Field	Value
Audience (EntityID)	{Entity ID from IronWiFi}
Recipient	{ACS URL from IronWiFi}
ACS (Consumer) URL	{ACS URL from IronWiFi}
ACS (Consumer) URL Validator	{ACS URL regex from IronWiFi}

Step 4: Configure Parameters (Attributes)

In the Parameters tab, add custom attributes:

Field Name	Flags	Value
email	Include in SAML assertion	Email
firstName	Include in SAML assertion	First Name
lastName	Include in SAML assertion	Last Name

Step 5: Download SAML Metadata

1. Navigate to the SSO tab
2. Note these values:
   • Issuer URL (Entity ID)
   • SAML 2.0 Endpoint (HTTP) (SSO URL)
3. Download the X.509 Certificate

Alternative: Download the full metadata file

1. Copy the Issuer URL
2. Append

   /metadata

   to the URL
3. Download the XML metadata file

Step 6: Configure IronWiFi

1. Navigate to Connectors > Add Connector
2. Select OneLogin (SAML)
3. Choose upload method:
   • Upload Metadata File: Upload the XML file
   • Manual Configuration: Enter details manually:
     • IdP Entity ID:

       {Issuer URL}

     • IdP SSO URL:

       {SAML 2.0 Endpoint}

     • Certificate: Paste the X.509 certificate
4. Click Save

Step 7: Assign Users and Roles

In OneLogin:

1. Go to the IronWiFi application
2. Navigate to the Users tab
3. Click Add Users or Add Roles
4. Select users or roles to grant access
5. Save assignments

User Synchronization

Automatically sync users from OneLogin to IronWiFi.

Step 1: Generate API Credentials

1. In OneLogin, navigate to Developers > API Credentials
2. Click New Credential
3. Set Name: IronWiFi Connector
4. Grant permissions:
   • Manage users (Read users)
   • Manage roles (Read roles)
5. Copy the Client ID and Client Secret

Step 2: Configure IronWiFi Connector

1. Edit your OneLogin connector
2. Navigate to User Sync Settings
3. Enter:
   • OneLogin Subdomain (e.g.,

     yourcompany

     )
   • API Client ID
   • API Client Secret
4. Configure sync options:
   • Auto-sync: Enable scheduled synchronization
   • Sync interval: Hourly, daily, or weekly
   • Include disabled users: Yes/No
5. Click Save

Step 3: Run Initial Sync

1. Click Sync Now
2. Monitor progress in the sync log
3. Review imported users in Users section

Synchronization Mapping

User Attributes

OneLogin	IronWiFi
email	Username
firstname	First Name
lastname	Last Name
status	Status (enabled/disabled)
role	Group
custom_attributes	Custom Fields

Sync Settings

Setting	Description
Auto-sync	Scheduled automatic synchronization
Sync interval	Frequency: hourly, daily, weekly
Filter by role	Only sync users with specific roles
Include suspended	Import suspended OneLogin users

Group Mapping

Map OneLogin roles to IronWiFi groups:

1. In the connector, navigate to Group Mapping
2. Add mapping rules:
   • OneLogin Role → IronWiFi Group
   • Example: "WiFi Users" → "Guest WiFi"
3. Enable Auto-create groups
4. Save and run sync

RADIUS Authentication

Enable WPA-Enterprise authentication using OneLogin credentials:

Requirements

• OneLogin Professional or Enterprise plan
• RADIUS authentication add-on enabled

Step 1: Enable RADIUS in OneLogin

1. Navigate to Security > Authentication Factors
2. Enable RADIUS
3. Configure RADIUS settings:
   • Primary RADIUS server
   • Shared secret
4. Note the RADIUS server details

Step 2: Configure IronWiFi for RADIUS

1. In the OneLogin connector
2. Navigate to RADIUS Settings
3. Enter:
   • OneLogin RADIUS server IP/hostname
   • RADIUS shared secret
   • Authentication port: 1812 (default)
4. Enable RADIUS Proxy Mode
5. Save configuration

Step 3: Test RADIUS Authentication

1. Configure a test device for WPA-Enterprise (PEAP-MSCHAPv2)
2. Enter OneLogin username and password
3. Attempt to connect
4. Verify authentication in IronWiFi logs

Captive Portal Integration

Enable OneLogin SSO for guest WiFi:

1. Navigate to Captive Portals > your portal
2. Go to Authentication Providers
3. Enable OneLogin SAML
4. Select your OneLogin connector
5. Configure post-authentication behavior:
   • Auto-approve authenticated users
   • Create user accounts automatically
6. Add OneLogin domains to Walled Garden:
7. Save portal configuration

Testing the Integration

SAML Testing

1. Open your captive portal URL
2. Click the OneLogin login button
3. Enter OneLogin credentials
4. Verify redirect back to portal
5. Confirm WiFi access granted

User Sync Testing

1. Create a test user in OneLogin
2. Run manual sync in IronWiFi
3. Verify user appears in Users list
4. Check user attributes are correct
5. Verify group membership

RADIUS Testing

1. Configure device for WPA-Enterprise:
   • SSID: Your network
   • Security: WPA2-Enterprise
   • Authentication: PEAP
   • Inner authentication: MSCHAPv2
2. Enter OneLogin credentials
3. Connect to network
4. Verify authentication in IronWiFi logs

Advanced Configuration

Conditional Access

Enforce OneLogin policies for WiFi access:

1. In OneLogin, create a Policy
2. Set conditions:
   • IP address ranges
   • Device compliance
   • MFA requirements
3. Apply policy to IronWiFi application
4. Users not meeting conditions are denied

Multi-Factor Authentication

Require MFA for WiFi access:

1. In OneLogin, enable MFA for the IronWiFi app
2. Configure MFA factors:
   • OneLogin Protect (push notifications)
   • SMS
   • Authenticator apps
3. Users must complete MFA during login
4. RADIUS authentication may not support MFA

Custom Attribute Mapping

Map custom OneLogin fields to IronWiFi:

1. In OneLogin, create custom user fields
2. In IronWiFi connector, add attribute mappings:
   • OneLogin custom field → IronWiFi custom field
3. Save and sync
4. Verify attributes in user profiles

Session Management

Control user session behavior:

Setting	Description	Configuration
Session duration	How long users stay logged in	Set in Captive Portal settings
Re-authentication	Force re-login interval	Configure in OneLogin policy
Simultaneous sessions	Multiple device limits	Set in IronWiFi user group
Session timeout	Idle timeout period	Configure in portal settings

Troubleshooting

SAML Authentication Errors

Error: Invalid SAML Response

• Verify the ACS URL is correct in OneLogin
• Check Entity ID matches between systems
• Ensure certificate is valid and not expired

Error: User Not Found

• Verify user is assigned to IronWiFi app
• Check attribute mapping (email must be provided)
• Confirm user status is active in OneLogin

Error: Invalid Signature

• Re-download X.509 certificate from OneLogin
• Verify certificate format (PEM)
• Check for whitespace or formatting issues

User Sync Issues

No Users Syncing

• Verify API credentials are correct
• Check API permissions (Manage users, Manage roles)
• Review sync filters and role restrictions
• Check network connectivity to OneLogin

Partial User Sync

• Review role filter settings
• Check for suspended users if excluded
• Verify attribute data exists in OneLogin
• Review sync logs for specific errors

Group Mapping Not Working

• Confirm role names match exactly
• Enable auto-create groups
• Check group mapping rules
• Verify roles are assigned to users

RADIUS Authentication Failures

Authentication Rejected

• Verify RADIUS server details are correct
• Check shared secret matches
• Confirm user credentials in OneLogin
• Review IronWiFi authentication logs

Timeout During Authentication

• Check network connectivity to OneLogin RADIUS
• Verify firewall allows UDP 1812/1813
• Test RADIUS server availability
• Check for NAT/routing issues

Certificate Validation Errors

• Ensure trusted root certificates are installed
• Verify certificate chain is complete
• Check certificate hasn't expired

Performance Issues

Slow SAML Login

• Check network latency to OneLogin
• Verify DNS resolution works
• Review OneLogin policy evaluation complexity

Sync Taking Too Long

• Reduce sync frequency
• Filter users by role
• Enable incremental sync
• Review API rate limits

Security Best Practices

1. Use Strong Shared Secrets - Generate random, complex RADIUS secrets
2. Enable MFA - Require multi-factor authentication where possible
3. Rotate Credentials - Regularly rotate API credentials and secrets
4. Monitor Logs - Review authentication and sync logs regularly
5. Apply Least Privilege - Grant minimal API permissions needed
6. Test Regularly - Verify integration after OneLogin updates
7. Restrict by Role - Only sync and allow necessary user roles
8. Use HTTPS - Ensure all communications use TLS/SSL
9. Backup Configuration - Document all settings and credentials
10. Implement Alerts - Set up notifications for sync and auth failures

Rate Limits and Quotas

Be aware of OneLogin API limits:

Resource	Limit
API Calls	5,000 per hour (Professional plan)
SAML Assertions	Unlimited
User Sync	Depends on plan and user count

To avoid rate limiting:

• Adjust sync frequency based on user count
• Use incremental sync where available
• Monitor API usage in OneLogin dashboard

Support Resources

• OneLogin Developer Documentation
• OneLogin SAML Toolkit
• OneLogin API Reference
• IronWiFi Support: support@ironwifi.com

Related Documentation

• Okta Integration
• Microsoft Entra ID Integration
• Google Workspace Integration
• WPA-Enterprise Setup
• Captive Portal Configuration