Follow the Step-by-Step Guide for Confluence Single Sign On (SSO) using Onelogin as IdP

STEP 1: Configuring Onelogin as IdP

• Log into OneLogin as an Administrator and go to Apps >> Company Apps >> Add Apps from the Navbar.



• In the search box, type SAML Test Connector (SP) and click on the App to add it.



• Enter the display name and click Save.
• In General Settings, enter App Name and click on Next.
• After saving, go to Configuration Tab and enter the following:




Audience	Audience URI from Step1 of the plugin under Configure IDP Tab.
Recipient	Recipient URL from Step1 of the plugin under Configure IDP Tab
ACS (Consumer) URL Validator	ACS (Assertion Consumer Service) URL from Step1 of the plugin under Configure IDP Tab.
ACS (Consumer) URL	ACS (Assertion Consumer Service) URL from Step1 of the plugin under Configure IDP Tab.
Single Logout URL	Single Logout URL from Step1 of the plugin under Configure IDP Tab.

• Click on Save.

STEP 2: Assigning Groups/People

• Go to SSO tab. Note down the URL/Endpoints. These will be required while configuring the plugin.




• Click on View Details in X.509 Certificate heading. Copy the X.509 Certificate textarea value and keep it handy.





STEP 3: Configure Confluence as SP

• In miniOrange SAML plugin, go to Configure SP Tab. There are three ways to configure the plugin:
I. By OneLogin Metadata URL(Recommended):

1. Click on the Import from Metadata in Configure SP Tab.
2. Select IdP: Onelogin.
3. Enter IDP Metadata URL: Enter OneLogin Metadata URL.
4. Click on Import.

II. By Uploading IdP Metadata :

1. Click on the Import from Metadata in Configure SP Tab.
2. Select IdP: Import from Metadata File.
3. Upload OneLogin Metadata.xml file and click on Import.

III. Manual Configuration : In miniOrange SAML plugin, go to Configure SP tab. Enter the following values:


IDP Entity ID	Issuer URL for the SSO Tab in OneLogin
Single Sign On URL	SAML 2.0 Endpoint(HTTP) from SSO Tab in OneLogin
Single Logout URL	SLO Endpoint(HTTP) from SSO Tab in OneLogin
X.509 Certificate	Paste the X.509 certificate value.

• In miniOrange SAML plugin, go to User Profile tab. Enter the following values:
  
  

  Username	Name of the username attribute from IDP (Keep Username as NameID by default)
  Email	Name of the email attribute from IDP (Keep Email as NameID by default)
  Full Name Attribute	Name of the firstname attribute from IDP and Name of the lastname attribute from IDP

  OR
  

  Username	Name of the username attribute from IDP (Keep Username as NameID by default)
  Email	Name of the email attribute from IDP (Keep Email as NameID by default)
  FirstName	Name of the firstname attribute from IDP
  LastName	Name of the lastname attribute from IDP




• Go to User Groups tab. Enter the following values:
  
  

  Group Attribute

  Name of the Group attribute from IDP

• You can check the Test Configuration Results to get a better idea of which values to map here.
• Under the Group Attribute Section, configure which GROUP value coming in the SAML response needs to be mapped to which role. The Group value coming in the SAML response will be mapped to the Group assigned here and the user will be assigned that role.




• Go to Sign In Settings tab. Enable Auto-redirect to IDP and Disable Confluence login option. Copy the URLs for backup.