> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/configuration-center/sso/onelogin-configuration.md).

# OneLogin Configuration

Forestall ISPM can be integrated with the OneLogin system to simplify authentication. The following configurations must be completed for integration:

## SAML Connection Configuration

The OneLogin administrator dashboard must be accessed. Under **Applications → Applications**, the **Add App** option must be selected.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-40ca9535dfa9adef66351978e3e95fa01fe5740e%2Fsso-onelogin-configuration-image-1.png?alt=media" alt="New Application Page"><figcaption><p>New Application Page</p></figcaption></figure>

In the **Find applications** box, *SAML Custom Connector (Advanced)* must be searched and selected. A display name must be provided, and the configuration saved.

After saving, the **Configuration** tab of the new app must be opened. A SAML connection must be configured in OneLogin with the following parameters:

* **ACS URL**: Copied from Forestall after SSO settings are saved. The value must exactly match Forestall’s ACS URL.
* **ACS (Consumer) URL Validator**: The same value as the ACS URL.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-b647e4acdd31933de045a05b7dfa58f5e72001df%2Fsso-onelogin-configuration-image-2.png?alt=media" alt="Application Configuration Page"><figcaption><p>Application Configuration Page</p></figcaption></figure>

In the top-right **More Actions** dropdown, **SAML Metadata** must be selected to download the XML file. The file must be saved and uploaded to Forestall, where it will be parsed to pull in OneLogin’s endpoints and certificates.

## Role and Username Mapping Settings:

In OneLogin’s **Parameters** tab, the following assertion attributes must be added so Forestall can read them:

**Username Attribute Key**

* Name: `username`
* SAML Field Name: Exactly the value entered in Forestall’s Username Attribute Key field (e.g., `username`)
* Include in SAML Assertion: Checked

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-702302db6a7a091d94b42f7da64f01311e4b38ba%2Fsso-onelogin-configuration-image-3.png?alt=media" alt="Username Attribute Configuration Page"><figcaption><p>Username Attribute Configuration Page</p></figcaption></figure>

**Role Attribute Key**

* Name: `role`
* SAML Field Name: Exactly the value entered in Forestall’s Role Attribute Key field (e.g., `role`)
* Include in SAML Assertion: Checked

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-45a561e3ce7c27a4d07c45e78331f45415c76b16%2Fsso-onelogin-configuration-image-4.png?alt=media" alt="Role Attribute Configuration Page"><figcaption><p>Role Attribute Configuration Page</p></figcaption></figure>

Once the OneLogin app configuration has been saved:

1. The IdP Metadata XML must be downloaded from the **OneLogin SSO → View Details** panel.
2. In Forestall’s **New Provider** screen, the XML must be uploaded via the **XML Upload Field**.
3. The configuration must be saved in Forestall.
4. OneLogin users or groups must then be assigned to the app.

After these steps, Forestall SSO Login will function with correct username and role mappings.