Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
OneLogin - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="onelogin-jupiterone-integration-benefits">OneLogin + JupiterOne Integration Benefits</h2> <ul><li><p>Visualize OneLogin users, groups, roles, devices, applications, and services<br> in the JupiterOne graph.</p></li> <li><p>Map OneLogin users to employees in your JupiterOne account.</p></li> <li>Map OneLogin users to their AWS IAM Roles where applicable.</li> <li><p>Monitor changes to OneLogin users and access management data using JupiterOne<br> alerts.</p></li> <li><p>Create an employee entity that is used to map users across your organization<br> to an employee via a matching email property.</p></li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li><p>JupiterOne periodically fetches OneLogin users, groups, and access management<br> data to update the graph.</p></li> <li><p>Write JupiterOne queries to review and monitor updates to the graph.</p></li> <li>Configure alerts to take action when the JupiterOne graph changes.</li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li><p>JupiterOne requires the API client id and API client secret used to<br> authenticate with OneLogin.</p></li> <li><p>You must have permission in JupiterOne to install new integrations.</p></li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <h3 data-id="in-onelogin">In OneLogin</h3> <ol><li>Log in to OneLogin as an administrator.</li> <li>Navigate to <strong>Administration</strong> > <strong>Developers</strong> > <strong>API Credentials</strong></li> <li>Create a new API credential with the <strong>Read All</strong> scope.</li> </ol><p>Further instructions on creating an API token within your OneLogin account can<br> be found <a rel="nofollow" href="https://developers.onelogin.com/api-docs/1/getting-started/working-with-api-credentials">here</a>.</p> <h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>OneLogin</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this OneLogin<br> account in JupiterOne. Ingested entities will have this value stored in<br><code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Enter the <strong>API Client ID</strong> used to authenticate with OneLogin.</p></li> <li>Enter the <strong>API Client Secret</strong> associated with the client ID.</li> <li>Enter your <strong>Organization URL</strong> in the format YOURDOMAIN.onelogin.com.</li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol><h3 data-id="troubleshooting">Troubleshooting</h3> <h4 data-id="authentication-errors">Authentication Errors</h4> <p>This integration's authentication is achieved by fetching an OAuth token from<br> OneLogin. You can reproduce this authentication strategy by running the<br> following curl, replacing <code class="code codeInline" spellcheck="false" tabindex="0"><CLIENT_ID></code> and <code class="code codeInline" spellcheck="false" tabindex="0"><CLIENT_SECRET></code> with your own.<br><code class="code codeInline" spellcheck="false" tabindex="0"><API_HOSTNAME></code> defaults to <code class="code codeInline" spellcheck="false" tabindex="0">https://api.us.onelogin.com</code>:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">curl --request POST \ --url <API_HOSTNAME> \ --header 'authorization: client_id:<CLIENT_ID>, client_secret:<CLIENT_SECRET>' \ --header 'content-type: application/json' \ --data '{ "grant_type":"client_credentials" }' </pre> <h2 data-id="how-to-uninstall">How to Uninstall</h2> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>OneLogin</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><h2 data-id="notes-on-mapping-to-aws-iam-roles">Notes on mapping to AWS IAM roles</h2> <p>The integration assumes that users who map to AWS IAM Roles do so via Role ARNs<br> included in the SAML Role parameter. It is further assumed that these ARNs are<br> mapped to the user by a Rule in the OneLogin AWS application. Currently, the<br> integration supports mapping by Rule conditions based on OneLogin Roles, Group,<br> or MemberOf properties.</p> <h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entities are created:</p> <table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Onelogin Account</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>Onelogin Application</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_application</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Application</code></td> </tr><tr><td>Onelogin Application Rule</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_application_rule</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>Onelogin Group</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_group</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">UserGroup</code></td> </tr><tr><td>Onelogin Personal Application</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_personal_application</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Application</code></td> </tr><tr><td>Onelogin Personal Device</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">mfa_device</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Key</code>, <code class="code codeInline" spellcheck="false" tabindex="0">AccessKey</code></td> </tr><tr><td>Onelogin Role</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_role</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">AccessRole</code></td> </tr><tr><td>Onelogin Service</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_service</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Control</code></td> </tr><tr><td>Onelogin User</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_application</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_service</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_application</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_application_rule</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_group</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_application</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">mfa_device</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">onelogin_personal_application</code></td> </tr></tbody></table> </article> </main>
.png)