Answer
OneLogin SSO/SAML and Automatic License Provisioning
Prerequisite: Verify Domain in the Foxit Admin Console
- Open Foxit Admin Console
- Navigate to Settings > Directory Setting > Verify Domain / Domain Settings
- You can verify domains in the following two methods:
- DNS Method – Copy a TXT record to your domain name system. (Recommended)
- Type -> TXT
- Host/Name -> @ or leave blank
- TXT Value -> (Copy>Paste from Foxit Admin Console under
- TTL -> 1 Hour
- HTTPS Method – Upload an HTML file to the root folder of your domain’s website.
- After uploading the HTML file or adding the TXT record, click Verify Domain.
- In the pop-up dialog box, select TXT Record or HTTPS correspondingly, enter the domain you want to verify in the Domain field, and click Verify domain.
- Then the domain will be added to the Verified Domains List, and you can view the verification status. The status of a domain may show Unverified. Verifying domains using DNS may take up to 72 hours for your domain to verify and DNS changes to take effect. Then you can click Verify in the Actions column to verify again.
To remove a domain from the list, click Remove in the Actions column. When a verified domain is removed, the users with that domain are no longer managed and won't appear on your managed account page
1.1 Signup and login
Log in after registering on the website: https://www.onelogin.com/
The login address is the domain name entered during registration and can also be seen in the registration verification email sent by OneLogin
1.2 Add ApplicationClick Applications → Applications
Click Add App
Enter SCIM v2 Enterprise, full SAML in the search box and select SCIM Provisioner with SAML (SCIM v2 Enterprise, full SAML) in the result list
Improve App configuration, such as Display Name → click Save
Click Configuration → Get SP Entity ID and SP Assertion Consumer Service URL from the Foxit Admin Console, put SP Entity ID in ACS (Consumer) URL Validator of OneLogin, and SP Assertion Consumer Service URL in ACS (Consumer) URL of OneLogin.
Click SSO → Collect x.509 Certificate, Issuer URL and SAML 2.0 Endpoint(HTTP)
Put Issuer URL in Identity provider Entity ID of Foxit Admin Console, SAML 2.0 Endpoint (HTTP) in Identity provider SSO URL and x.509 Certificate in Public x509 certificate of Foxit Admin Console → Click Save configuration
Click Parameters → Click +
Enter email at Field name → Choose Include in SAML assertion → Click Save
Select Email at Value → Click Save
Click + → Enter firstname at Field name → Choose Include in SAML assertion → Click Save
Select First Name at Value → Click Save
Click + → Enter lastname at Field name → Choose Include in SAML assertion → Click Save
select Last Name at Value → Click Save
Click Developers → API Credentials
Click New Credential
Enter Name of new API credential, choose Reader users → Click Save
You can get Client ID and Client Secret → Click Done
Put Client ID of OneLogin in Client ID of Admin Console, and put Client Secret of OneLogin in Client Secret of Admin Console → Client Authorize
Click Synchronize
Click Provision
Copy the Tenant URL and Secret Token
Click Applications → Applications → Configuration, put Tenant URL in SCIM Base URL of OneLogin, and Secret Token in SCIM Bearer Token of OneLogin.
Click Enable
Click Enable provisioning. When users are deleted in OneLogin, or the user's app access is removed, perform the below action, select Suspend.
Click Save
Click New Role
Input your role name, such as "Group for Foxit PDF Editor for Mobile". Click ✔.
Select your SCIM app, then click Save.
Click Group for Foxit PDF Editor for Mobile
Click Users
Search user name, then Check
Click Add to Role
Click Save
Click Save
Click Add Rule
Put in Name, such as "Role Rules".
Select Set Groups in "app name"
For each role with value that matches.*
Click Save
2.6 ParametersClick scimusername
Edit Field scimusername, select value Email, click Save
Click Groups
Select Include in User Provisioning, click Save
Provisioning, click Refresh, click Save
Click "Create group connections" to enter the page that defines the relationship between OneLogin Roles and Foxit products.
Manually enter OneLogin custom role name.
Select the products you want to automatically assign licenses to the role In "Auto-licensing products".
Click "Save", and then you can see the role product relationship in the list.
User Provisioning State, click Pending
Click Approve
Provisioning
Provisioning successed
Users → Users → Applications, click on the selected roles to remove the user from the roles
Click Remove
Click Save User
Users → Users → Applications, Click Pending
Click Approve
Users → Users → Applications, click on the unchecked roles to add the user to the roles
Click Save User
Users → Users → Applications, Click Pending
Click Approve
It is best for users to synchronize from provisioning to perform all operations on OneLogin, and not on AC users.
- Do not delete users in AC as it may cause provisioning failure. Users should be deleted in OneLogin.