Setting up OneLogin authentication - User Guide - BlueCat Horizon

1. Configure the OneLogin SAML application

1. In the OneLogin Admin Portal, navigate to Applications > Applications > Add App.
2. Search for SAML Custom Connector (Advanced).
3. Select the connector.
4. Select Save.

2. Assign users

1. Navigate to Users > User > Applications.
2. Assign users to the application. If needed, create groups and assign them to the user(s). Make sure the groups match the ones you created in BlueCat Horizon for your external users.
   Note: Only assigned users will be allowed to authenticate using SSO.

3. Configure SAML settings

1. Navigate to Configuration and enter the following values from the metadata file you downloaded previously:

   Field	Value
   Audience (EntityID)	entityID
   Recipient	AssertionConsumerService URL without query parameters, for example, https://example.com/login/callback
   ACS (Consumer) URL Validator	Exact regex of ACS (Consumer) URL, for example, ^https:\/\/example\.com\/login\/callback\?connection=00000000-0000-0000-0000-000000000000-samlp-custom$
   ACS (Consumer) URL	AssertionConsumerService URL

2. Save the configuration.

4. Configure attribute mapping

In OneLogin, SAML attributes are configured using Parameters and optionally refined with Rules. Each parameter represents a SAML claim that will be included in the SAML assertion sent to BlueCat Horizon, while rules control how values are populated.

Each claim consists of:

• Name: The claim identifier expected by BlueCat Horizon
• Value: The OneLogin field or mapping used to populate the claim

1. Navigate to Parameters and add the following parameters. Include the flag Include in SAML assertion:

   Name	Value	Type	Expected format
   https://bluecatnetworks.com/saml/claims/emailaddress	Email	String	User email address, for example user@example.com
   https://bluecatnetworks.com/saml/claims/groups	Enable the Multi-value parameter flag	Multi-valued (string array)	List of group names
   https://bluecatnetworks.com/saml/claims/name	Name	String	User's full name

   Note:

   • The Groups claim must return a multi-value list of strings.
   • Each group name must exactly match a group configured in BlueCat Horizon.
   • If the Multi-value parameter is not enabled, only a single group may be sent,resulting in missing permissions.
   • If no matching groups are found, the user will be authenticated but no roles or permissions will be assigned.
2. Navigate to Rules and add the following rule if, for example, you want to map the user's group to the group parameter:
   • Action: Set https://bluecatnetworks.com/saml/claims/groups for each member_of with a value that matches Horizon-[\w*]* or your group filter

   You can customize rules to filter or transform group names depending on your directory structure.

5. Retrieve OneLogin identity provider information

1. Navigate to SSO and copy the following values:
   • SAML 2.0 Endpoint (HTTP)
   • X.509 Certificate → View Details → Download

6. Update the SSO connection

1. In BlueCat Horizon, navigate to Administration > Single sign-on.
2. Your SSO connection and its details should be displayed, including the placeholder values. Select Edit.
3. In the dialog, replace the placeholder values with the real ones from your SSO configuration:
   1. Enter the SAML 2.0 Endpoint (HTTP) value from your OneLogin configuration into the Sign in URL field.
   2. Drag and drop or upload the X.509 Certificate file from OneLogin into the Signing certificate field.
4. Select Update.