Docs

Appearance

OneLogin Operations Guide ​

Overview ​

OneLogin is the Identity Provider (IdP) for Cirius Group's SSO chain. It is the bridge between Entra ID (source of truth for user identity) and third-party apps that don't support native Entra SSO.

Apps federated through OneLogin:

AppProtocolNotes
Cloudflare AccessSAML 2.0Protects secops.bedrockcybersecurity.org and dashboard.ciriusgroup.com
KeeperSAML 2.0Keeper Business SSO — users log in with Entra credentials via OneLogin
ZendeskSAML 2.0Customer support portal
Zendesk (secondary)SAML 2.0Secondary Zendesk instance
KnowBe4SAML 2.0Security awareness training

The Arctic Wolf OneLogin connector is a separate integration — see Arctic Wolf OneLogin Connector.

Admin Access ​

URL: https://ciriusgroup.onelogin.com/admin
Credentials: Keeper → IT Operations → OneLogin Admin
Owner: Rory

OneLogin admin access is separate from regular SSO login. The admin account authenticates directly (not via Entra SSO) so you can still reach OneLogin if Entra has a problem.

User Management ​

OneLogin User Model ​

OneLogin users are provisioned automatically via the Entra ID connector — do not create users manually in OneLogin. The workflow:

  1. User is created in Entra ID (PROD tenant)
  2. Entra ID SCIM connector pushes the user to OneLogin automatically
  3. User appears in OneLogin with their Entra email as the login

If a user exists in Entra but not in OneLogin, the SCIM sync may have failed — check the SCIM connector status (see below).

Viewing Users ​

OneLogin Admin → Users → All Users

Search by email or name. The user record shows:

  • Status (Active / Suspended)
  • Apps assigned
  • Last login time
  • MFA method enrolled

Suspending a User ​

Offboarding disables the Entra account first — once disabled in Entra, the SCIM sync updates OneLogin automatically within minutes. If the OneLogin account needs immediate suspension (e.g., during an active incident):

  1. OneLogin Admin → Users → find the user
  2. More Actions → Suspend User or click the user → Suspend

Suspended users cannot authenticate via SSO. The Entra account disable is still required as the primary offboarding step — OneLogin suspension alone does not revoke Azure access.

SCIM Sync Status ​

If users aren't syncing from Entra to OneLogin:

  1. Entra ID Portal → Enterprise Applications → OneLogin Provisioning
  2. Check the provisioning status — should be Running
  3. View provisioning logs for sync errors
  4. If the connector is stopped, click Start provisioning

Application Management ​

Viewing Configured Apps ​

OneLogin Admin → Applications → Applications

Shows all SAML/OIDC apps. Click any app to see its configuration including:

  • SSO settings (ACS URL, Entity ID, SAML cert in use)
  • Parameters being passed in the SAML assertion
  • Access policy (which users/groups have access)
  • Event log

Adding a User to an App ​

Apps are assigned by Entra group, not per-user. The mapping:

OneLogin AppEntra Group
Cloudflare AccessSynced via Cloudflare Access policy (all ciriusgroup.com email)
KeeperAll licensed users (SCIM pushes license assignment)
ZendeskAgent users group
KnowBe4All staff

If a user can't access an app via SSO:

  1. Check they have an active OneLogin account (SCIM synced)
  2. Check the app's access policy in OneLogin
  3. Check their Entra group memberships match the app's requirements

Cloudflare Access SAML Integration ​

Cloudflare Access uses OneLogin as its SAML IdP to authenticate users before they reach the protected apps (secops.bedrockcybersecurity.org, dashboard.ciriusgroup.com).

Integration Details ​

PropertyValue
Client ID / App IDe906536f-79ea-4d3a-a48c-2bc73494992c
TypeSAML 2.0
ACS URLConfigured in the OneLogin app → matches Cloudflare's SAML callback URL
Entity IDCloudflare Zero Trust team domain

Viewing the Cloudflare App Config ​

OneLogin Admin → Applications → Applications → Cloudflare Access

Key settings:

  • SSO → SAML Signature Algorithm: SHA-256
  • SSO → X.509 Certificate: the active SAML signing cert
  • Parameters → NameID: user email (primary identifier Cloudflare uses)

SAML Certificate Rotation ​

When the SAML cert expires, Cloudflare Access returns SAML assertion errors and users cannot authenticate. Rotate before the cert expires — monitored by cert_expiry_agent at 90 days.

For the rotation procedure see Certificate Renewal Procedure.

Cloudflare Access Policy ​

The Cloudflare side of the integration is configured at:
Cloudflare Dashboard → Zero Trust → Access → Applications

The OneLogin SAML Identity Provider entry is under:
Cloudflare Dashboard → Zero Trust → Settings → Authentication → OneLogin

If OneLogin is configured correctly but Cloudflare rejects the assertion:

  1. Check the Cloudflare IdP configuration — is the Entity ID correct?
  2. Check the SAML cert in Cloudflare matches what OneLogin is signing with
  3. Check the Access policy — is the user's email domain allowed?

MFA Configuration ​

MFA Policy ​

All OneLogin users are required to enroll MFA. The policy is set at:
OneLogin Admin → Security → Authentication Factors — shows enrolled factor types
OneLogin Admin → Users → Security Policies — shows which policy applies

Supported factors (in order of preference):

  • OneLogin Protect (mobile app — TOTP push)
  • TOTP authenticator (Google Authenticator, Authy, etc.)

Resetting MFA for a User ​

If a user loses their MFA device:

  1. OneLogin Admin → Users → find the user
  2. Click the user → Security → Reset Authentication
  3. The user will be required to enroll a new MFA factor at next login
  4. Verify their identity through an out-of-band channel (video call, manager confirmation) before resetting

SSO Troubleshooting ​

User Gets an Error Logging in to a SAML App ​

Step 1 — Check OneLogin event log:

OneLogin Admin → Events → filter by user email and date. Look for:

  • SAML assertion failed — assertion validation error
  • User not found — SCIM sync hasn't run yet or user email mismatch
  • App not found — app deactivated or misconfigured

Step 2 — Check the app configuration:

OneLogin Admin → Applications → the failing app → SSO tab. Verify:

  • ACS URL matches what the service provider expects
  • Entity ID is correct
  • The active X.509 certificate is not expired

Step 3 — Test the SAML flow:

OneLogin Admin → Applications → the failing app → More Actions → Test Connector

This walks through the SAML handshake and shows exactly where it fails.

Users Can't Reach secops.bedrockcybersecurity.org (Cloudflare Access Blocking) ​

  1. Verify the user's OneLogin account is active (not suspended, not locked)
  2. OneLogin Admin → Events → check for SSO events for that user
  3. Cloudflare Dashboard → Zero Trust → Access → Applications → secops → Activity — what did Cloudflare see?
  4. If Cloudflare says "Identity provider returned an error" — the issue is in OneLogin
  5. If Cloudflare says "User is not authorized by policy" — the user's email isn't matching the access policy (check email in Entra vs OneLogin)

Entra Users Not Appearing in OneLogin ​

SCIM sync isn't running or errored:

  1. Entra ID → Enterprise Applications → OneLogin → Provisioning
  2. Check "Current cycle status" and provisioning logs
  3. Errors usually show the specific user and the reason (e.g., duplicate email, attribute mapping failure)
  4. Fix the attribute causing the error, then manually trigger sync: Provisioning → Restart provisioning cycle

OneLogin Admin Console Unreachable ​

If ciriusgroup.onelogin.com/admin is unreachable:

  • Check status.onelogin.com for an active incident
  • This is not something you can fix — contact OneLogin support if it's a OneLogin outage
  • Existing browser sessions for SAML apps typically remain active even if OneLogin is temporarily down (sessions are issued at the SP, not by OneLogin)

Audit Log Access ​

OneLogin captures all authentication events, admin actions, and SAML assertions.

OneLogin Admin → Events

Filter options: user, app, event type, date range.

Useful event types to search:

  • user_logged_in — successful SSO
  • user_login_failed — failed authentication
  • saml_response_generated — SAML assertion sent to SP
  • password_changed — password updates
  • admin_updated_user — admin account changes (audit trail for compliance)

Events are available for 90 days in the OneLogin console. For long-term retention, enable event streaming to the SIEM (not currently configured — see future roadmap).

Document History ​

DateChangeAuthor
May 2026Initial draft — admin access, user management, app configuration, Cloudflare Access SAML integration, MFA, SSO troubleshooting, audit log.Rory

Internal use only — Cirius Group