OneLogin

Last Updated: April 07, 2026

An identity provider (IdP) uses an authentication token to vouch for a person's identity. Vasion Automate uses IdPs for several tasks, including logging in to the Admin Console and portals, deploying printers, releasing print jobs, and more.

If you use an IdP, the Control Panel Application (CPA) supports only badge and PIN authentication.

Just-in-Time (JIT) provisioning is the only option available when using OneLogin with Virtual Appliance.

Configure Connection

To add and configure app properties for the Virtual Appliance connection, do the following:

Create the OneLogin App.
Add the IdP Settings Template.
Configure Single Sign-On (SSO).
1. Configure Parameters.
Add the X-509 Certificate.
Complete IdP Settings.
Assign Access.
Just-in-Time (JIT) Provisioning.
Add Virtual Appliance Admins.

1. Create the OneLogin App

In your preferred browser, log in to your OneLogin portal. You can add your domain name to the following URL to access your portal.
https://<your domain>.onelogin.com/login
Hold the pointer over Applications in the top menu, and then select Applications.
Select Add App in the upper-right corner of the Applications screen.
Search for and select the SAML Custom Connector (Advanced) app.
Give your app a unique name and description.
Select Save.

Leave the current browser open on the new app screen for the following steps.

2. Add the IdP Settings Template

If the IdP Settings modal does not look like the image below, you may not be using the latest version and should contact Product Support to upgrade your IdP settings.

When configuring this IdP through Virtual Appliance, select the Custom option from the IdP Template dropdown menu.

Open your Virtual Appliance Admin Console in a new browser tab, and log in.
Select Tools Settings General, and scroll down to the Identity Provider Settings section.
Select IdP, and then select Add.
Select the IdP that you want to configure from the IdP Template dropdown menu.
Select SAML2 in the Authentication Protocol section.
In the Provisioning section, the Admin Console assumes that you are using Just-in-Time (JIT) for Virtual Appliance apps. Select the JIT checkbox.

When you consider how to set up your IdP configuration, be aware that Systems for Cross-domain Identity Management (SCIM) provisioning requires an open connection from the IdP to the Virtual Appliance instance gateway container. We recommend JIT provisioning when setting up your IdP connection.
In the Name field, enter the name that you want to appear on the login button for users. For example, My Company, Login, or Acme Corp.
Scroll down, and select the desired settings:
- Enable for End User Login: Allows end users to log in using this IdP. (Self-service Portal)
- Enable for Admin Login: Allows admins to log in using this IdP. (Admin Console)
- You can select both checkboxes when you are using a single IdP or the admin and end users use the same IdP to log in.

Keep the IdP Settings modal open so that the Service Provider Information section at the bottom is available for the following steps.

3. Configure Single Sign-On (SSO)

In the Virtual Appliance Admin Console, copy the Relay State in the Service Provider Information section of the IdP Settings modal.
In the OneLogin app, select Configuration from the left-side menu.
Paste the Relay State in the OneLogin RelayState field.
Copy the Admin Console Identifier (Entity ID), and paste it in the OneLogin Audience (Entity ID) field.
Copy the Admin Console Reply Url (ACS), and paste it in both the OneLogin ACS (Consumer) URL Validator and ACS (Consumer) URL fields.
Configure any other fields as desired, but you can leave them with the default values.
Select Save.
In the OneLogin app, select SSO from the left-side menu.
Copy the OneLogin Issuer URL, and paste it in the Admin Console Issuer URL field.

Leave the Admin Console Issuer ID field blank.
Copy the OneLogin SAML 2.0 Endpoint (HTTP), and paste it in the Admin Console SSO URL field.
Select Save.

Configure Parameters

In the OneLogin app, select Parameters from the left-side menu.
Select the + (plus) button.
In the Field name, enter FirstName.
Select the Include in SAML assertion checkbox, and then select Save.
In the Edit Field modal, enter the following:
1. Field Name: Email, Value: Email.
2. Field Name: FirstName, Value: First Name.
3. Field Name: LastName, Value: Last Name.
4. Field Name: Username, Value: Username.
Select Save.

4. Add the X-509 Certificate

In the OneLogin app, select SSO from the left-side menu.
In the SSO tab, go to the X.509 Certificate section, right-click View Details, and select Open in new tab.

You do not need to open the link in a new tab. After completing this section, navigate back to the app, hold the pointer over Applications in the top menu, select Applications, and then select your app from the Applications screen.
Scroll down to the X.509 Certificate section, and copy the certificate body, including the Begin / End Certificate headers.
Paste the certificate in the Admin Console X-509 Certificate field.
Select Apply in the Admin Console.
Select Save in the upper-right corner of the General settings.

5. Complete IdP Settings

In the General settings of the Virtual Appliance Admin Console, navigate to the Identity Provider Settings section.
To have Virtual Appliance prompt users to authenticate through the IdP when performing any function that requires authorization, such as installing a printer, select the Automatically Open Browser to Login on Desktop Client option.

If you do not select this option, users must manually navigate to the IdP login screen to log in.
We recommend enabling the Use Loopback with Saml 2.0 (recommended) option. The IdP needs to provide an authentication token to the desktop Client whenever authentication happens. This option allows the Client to handle the token and automatically log in without interaction from end users.
The option Use Domain User (Windows only) automatically authorizes domain-joined Windows users and does not require log in via the configured IdPs.
Select Save in the upper-right corner of the General settings.

6. Assign Access

In the OneLogin app, select Access from the left-side menu.
Select the groups of users that should have access to the Virtual Appliance app, and select Save.
Select Users from the left-side menu, and verify that the appropriate users are assigned to the app.

7. Just-in-Time (JIT) Provisioning

JIT does not support the provisioning of group membership associations, so you cannot apply Role-Based Access Control (RBAC) roles, printer deployments, or portal security roles to groups. You must create assignments individually for each user.

When using JIT provisioning, the app creates users during the first login attempt:

Access your Vasion instance, and select Sign In With <IdP Name>.
Attempt to log in with your IdP credentials.
This login attempt fails and returns you to the login screen.

This behavior is expected. With JIT, this action triggers user creation in the Vasion instance.
The second login attempt with valid credentials initiates a typical login sequence.

For admins who need access to the Admin Console, you still need to add them to the Users page located in Tools Users.

8. Add Virtual Appliance Admins

For steps on assigning users and roles to the Virtual Appliance and Vasion Automate Admin Console, refer to Admin Console Users.