Skip to main content

SSO/SAML Setup: OneLogin

Note: DataGrail only supports connections with SAML v2.0.

DataGrail OneLogin Application​

  1. Create a DataGrail App in your OneLogin instance
  2. Integrate OneLogin with a read-only user. This will alert Legal when new applications are added/removed that may contain personal data so they can take appropriate action to comply with Privacy Regulations

Step 1: Build a SAML Test Connector (Advanced) App:​

  1. Click the Administration Tab in the top right corner

Screen_Shot_2021-06-07_at_1.42.01_AM.png

  1. Select Users and then Custom User Fields.

Screenshot

  1. Add a new field called DataGrail Admin with is_dg_admin for the Shortname.

  2. Go to Applicationsthen >> Add App

Screenshot

  1. Under Find Applications select SAML Custom Connector (Advanced)

Screenshot

  1. Edit the Display Name to DataGrail and clickSave. Once complete, navigate to the Configuration tab on the left-hand menu.

Screenshot

  1. Please edit the following fields in bold:

    1. Audience (EntityID): https://[yourname].datagrail.io/saml/metadata

    2. Recipient: https://[yourname].datagrail.io/saml/auth

    3. ACS Consumer URL: https://[yourname].datagrail.io/saml/auth

    4. ACS Consumer URL Validator

      1. Input the regex expression that matches the value of the Consumer URL from step 3.
      2. Ex: https://testcustomer.datagrail.io/saml/auth is validated as:
      ^https:\/\/testcustomer\.datagrail\.io\/saml\/auth$

      Note: ‘/’ and ‘.’ are escaped characters so you need to put a ‘\’ in front of each one. The '^' and '$' characters indicate the beginning and end of the regular expression.

    5. SAML not valid before / not valid on or after: 3 (should be the default)

    6. SAML Initiator: Default: OneLogin

    7. SAML NamedID Format: email

    8. SAML Issuer Type: Specific

    9. SAML Signature Element: Response

    10. SAML Encryption Method: Default to TRIPLESDES-CBC

    11. SAML sessionNotOnOrAfter: Set to 1440 (should be the default)

  3. Select the Parameters section in the left-hand menu.

  4. Add a field named email, select Include in SAML assertion, and click save. Once complete, selectEmail from the value dropdown. Click save.

Screenshot

  1. Add a field named first_name, select Include in SAML assertion, and click save. Once complete, select First Name from the value dropdown. Click save.

  2. Add a field named last_name, select Include in SAML assertion, and click save. Once complete, select Last Name from the value dropdown. Click save.

  3. Add a field named is_dg_admin, select Include in SAML assertion, and click save. Once complete, select DataGrail Adminfrom the value dropdown. Click save.

  4. Open the SSO section of the left-hand menu. Set SAML Signature Algorithm to SHA-256.

  5. Copy the Issuer URL (metadata URL) and send it to: support@datagrail.io

Step 2: Invite Users:​

Learn about inviting new users with OneLogin here.

Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.