Configuring OneLogin as an identity provider
You can use OneLogin as an identity provider to access SC//Nexus™. To do this, you create a SAML Custom Connector on the OneLogin platform.
SC//Nexus service provider details
SC//Nexus publishes the following service provider details for your identity provider. The steps on this page show which of them OneLogin uses and where to enter them.
| Detail | Value |
|---|---|
| SC//Nexus™ portal service provider metadata (XML) | https://nexus.scalecomputing.com/api/v1/saml/metadata |
| Assertion Consumer Service (ACS) URL | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| Entity ID / Audience URI | https://saml.stargate.local |
| Signing Certificate | https://nexus.scalecomputing.com/sso/.well-known/saml.cer |
Create the OneLogin SAML Custom Connector
The OneLogin documentation provides the steps for creating a SAML app integration on their platform. For more information, see Advanced SAML Custom Connector in the OneLogin documentation.
- Choose the Applications menu.
- From the Applications page, choose Add App.
-
From the Find Applications page, search for
SAML Custom Connectorand locate the SAML Custom Connector (Advanced) application. -
From the Add SAML Custom Connector (Advanced) page, use the following configuration and then choose Save.
-
For Display Name, enter
SC//Nexus. - For the Rectangular Icon, upload the SC//Nexus logo.
-
For Display Name, enter
- Once the basic application is created, navigate to the Configuration menu and use the following settings.
| Parameter | Value |
|---|---|
| RelayState | leave blank |
| Audience (Entity ID) | https://saml.stargate.local |
| Recipient | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| ACS (Consumer) URL Validator | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| ACS (Consumer) URL | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| Single Logout URL | leave blank |
| SAML not valid before | 3 |
| SAML not valid on or after | 3 |
| SAML initiator | OneLogin |
| SAML nameID format | |
| SAML issuer type | Specific |
| SAML signature element | Assertion |
| SAML encryption method | AES-256-CBC |
SC//Nexus publishes no single logout endpoint, so leave Single Logout URL blank. It also requires only the assertion to be signed, so SAML signature element is set to Assertion rather than Both. Both settings differ from the SC//Reliant™ Platform Manager integration.
Retrieve the identity provider metadata
Once your OneLogin app integration exists, retrieve the OneLogin identity provider metadata and provide it to your Scale Computing account manager or Support to complete the setup.
- In the OneLogin Admin console, access the settings for the SC//Nexus custom connector you created.
- From the More Actions drop-down menu, select SAML Metadata to download the identity provider metadata file.
- Provide that metadata to your Scale Computing account manager or Support, who adds it to your SC//Nexus organization.
IMPORTANT: Ensure that the user's email in OneLogin matches the user's SC//Nexus account email address, in all lowercase.