SSO with OneLogin

Prerequisites

Before you start, do the following:

• Submit a ticket to SAP LeanIX Support to request setting up SSO for your organization. If you're an SAP customer, submit a request from the SAP for Me portal.
• Learn about the SSO configuration process in SSO Configuration Process.

For more information about configuring SSO with OneLogin, visit the OneLogin website.

Step 1: Create a SAML Application

Follow these steps:

1. In the OneLogin admin dashboard, in the Applications section, click Add App.

   

2. On the page that appears, search for and select SAML Custom Connector (Advanced).

   

3. Enter a name for your application and adjust other settings as needed.

   

Step 2: Configure SAML Settings

In the Configuration section of the application settings, enter the following:

• Audience (EntityID): https://{SUBDOMAIN}.leanix.net/Shibboleth.sso
• Recipient: https://{SUBDOMAIN}.leanix.net/Shibboleth.sso/SAML2/POST
• ACS (Consumer) URL Validator: ^https:\/\/{SUBDOMAIN}\.leanix\.net\/Shibboleth\.sso\/SAML2\/POST$
• ACS (Consumer) URL: https://{SUBDOMAIN}.leanix.net/Shibboleth.sso/SAML2/POST
• Login URL: https://{SUBDOMAIN}.leanix.net/customdomain

📘

Note

Replace {SUBDOMAIN} in the URLs with your custom subdomain that you specified in the SSO request form (for example, https://your-company.leanix.net).

Step 3: Configure Attribute Mapping

In the Parameters section of the application settings, specify attributes to be added to the SAML assertion as shown in the following table. Set all attributes as required. All fields are case-sensitive.

If you want to manage user roles within OneLogin and not within SAP LeanIX, configure additional role attributes specified in the following table. To learn more about managing user roles, see Managing User Roles with SSO.

To configure role attributes, follow these steps:

1. In the OneLogin admin dashboard, navigate to the Users section.

2. In the Roles section, create application roles.

   

3. In the Mappings section, map the application roles that you created to user groups.

   

To verify your SSO configuration, first, access your workspace at https://{SUBDOMAIN}.leanix.net, then navigate to the SAML session page at https://{SUBDOMAIN}.leanix.net/Shibboleth.sso/Session.

The following screenshot shows a SAML session page with a list of required user attributes that appear under Attributes. The role attribute is optional and may not apply to your setup.