OneLogin

With the OneLogin integration, you can manage OneLogin access through Opal:

• Create and suspend OneLogin users, and reactivate a user you previously suspended
• Let people request just-in-time access to OneLogin roles from the web and Slack
• Review which apps a role grants, and who can use each app
• Review group membership
• Delegate approvals to the right owners

​

Supported resources

​

Requirements

Before you begin, you must:

• Be an Opal Admin.
• Be an admin of the OneLogin account you want to connect.
• Be able to create API credentials in that account.

If you do not see OneLogin under + App, contact your Opal admin or Opal support.

​

1. Create API credentials

Opal authenticates with a OneLogin client ID and client secret. The credentials belong to the admin who creates them and stop working if that admin is deleted. Create them as a durable integration admin, not as a personal account you might remove later.

1. Sign in to the OneLogin admin portal.
2. Go to Developers > API Credentials.
3. Create a new credential pair.
4. Set the scope to Manage All.

Manage All is required. Opal uses it to read users, roles, groups, apps, and user mappings, and to create users, suspend users, and change role membership.

5. Copy the client ID and client secret.

OneLogin documents this in Working with API credentials.

​

2. Create a OneLogin app in Opal

In Opal, go to Inventory > + App, then select OneLogin. Fill in the following fields and create the app. A token sent to the wrong region is rejected the same way as a wrong secret, so the region has to be the one where the account is hosted. If you set a subdomain, Opal calls https://yourcompany.onelogin.com instead of the regional host.

​

3. Check the app setup

After you create the app, open Setup. Opal exchanges the credentials for an access token, reads users, roles, groups, and apps, and reads enabled user mappings. User mappings matter because Opal refuses to change a role that a mapping assigns. When setup succeeds, Opal saves the OneLogin account id from the token. You do not enter it. If setup fails, use the message to correct the credentials:

​

4. Import OneLogin items

Users who are not suspended and have a valid email address appear on the app’s Accounts tab after sync. Suspended users are not listed. A user with a blank email, or an email that is not a plain address, is not listed. Import roles, groups, and apps from … > Import items. Filter by OneLogin Role, OneLogin Group, or OneLogin App. People can request OneLogin roles through Opal. Groups and apps are visible for review and are not requestable. To give someone an app, grant the role that includes that app.

​

Users

When user provisioning is enabled:

• Not in OneLogin: Opal creates the user with the email as the username and sends an invitation. Opal does not set a password and does not assign a role as part of creating the user. If the invitation email fails, the user still exists. Re-send the invitation from OneLogin.
• Already active: Opal links that user. It does not create a second one and does not change their status.
• Suspended, and not synced from a directory: Opal reactivates that same user.
• Remove from the connection: Opal suspends the user. OneLogin still has the account. The next sync drops them from Opal. Add them again to reactivate them.

Opal matches people by email. If more than one OneLogin user has the same email, Opal stops instead of guessing which one to update. A person needs a valid email address. A person with no email cannot be created or linked.

​

Roles

A role grant adds the person to that OneLogin role. A revoke removes them from that role and leaves their other roles in place. Granting a role to someone who already has it succeeds. Revoking a role they do not have also succeeds. If the role has been deleted in OneLogin, the revoke succeeds. If Opal cannot read which roles a mapping assigns, it blocks every role change until the mapping can be read. That keeps a revoke from being undone the next time the mapping runs. A role administrator is not treated as a member. Being allowed to administer a role does not grant the apps on that role.

​

Groups

Groups sync so you can see each user’s group. A OneLogin user has at most one group, and that group assigns a security policy. Opal does not add or remove people from groups, because a second assignment would replace the first.

​

Apps

Apps sync with the people who can currently use the app and with the roles that grant the app. An app that is hidden from the OneLogin portal is still imported. Hiding an app does not remove access. Opal does not assign a person directly to an app. OneLogin does not offer that write. Grant the role that includes the app. The people listed on an app are everyone OneLogin reports as having it. That can include access granted by a role and access granted in the OneLogin admin portal. Opal does not label which is which.

​

What Opal does not manage

• Deleting a OneLogin user
• Passwords, unlock, and profile fields
• Group membership and security policies
• Assigning a person directly to an app
• Creating, renaming, or deleting roles, groups, and apps
• Roles that an enabled user mapping assigns
• Status changes for users synced from a directory
• Role administrators and delegated admin privileges
• Custom user attributes