Single sign-on (SSO) via OneLogin

Nolt supports SAML 2.0 and OpenID Connect standard for Single-sign-on (SSO) and allows users to seamlessly log in to Nolt eliminating the need for them to create a separate account in Nolt. If you are using OneLogin as your Identity Provider then you can connect your Nolt board to OneLogin to setup single-sign-on. You can configure either OpenID Connect or SAML 2.0 in OneLogin to enable SSO. This guide will walk you through the steps to setup SSO via OneLogin.

This feature is only available for Enterprise customers.

OpenID Connect (OIDC)
SAML 2.0

OpenID Connect (OIDC) Integration

If you want to use OpenID Connect based authentication for your users then you can follow along the steps to integrate OneLogin with Nolt.

1. Setting up Application in OneLogin

Sign in to your OneLogin account as an administrator. Navigate to Applications → Add App.
Search for OpenID Connect and select OpenId Connect (OIDC). Name the app Nolt, upload your logo and save the App.
Once the app is created, navigate to Configuration. Set Redirect URI's as
```
https://YOUR_BOARD.nolt.io/sso/openIdConnect
```
Navigate to SSO → Token Endpoint. Set Authentication Method as POST
Save the configuration

2. Integrating in Nolt

Navigate to your board → Integrations → OpenID Connect. Set up all the required fields to activate the integration.

Client ID:
Copy the Client ID from the OneLogin OIDC application.
Client Secret:
Copy the Client Secret from the OneLogin OIDC application.
Issuer URL:
Copy the Issuer URL from the OneLogin OIDC application.

Note: To get Client ID and Client Secret, navigate to Applications → Nolt → SSO in OneLogin.

Token URL:

https://ONELOGIN_SUBDOMAIN.onelogin.com/oidc/2/token

Remote Login URL:

https://ONELOGIN_SUBDOMAIN.onelogin.com/oidc/2/auth?client_id=CLIENT_ID&redirect_uri=https://YOUR_BOARD.nolt.io/sso/openIdConnect&response_type=code&scope=openid%20profile%20email

Note: ONELOGIN_SUBDOMAIN is available in the issuer url. Make sure to replace ONELOGIN_SUBDOMAIN, CLIENT_ID and YOUR_BOARD before using the remote login URL.

Remote logout URL (optional)
Add a Remote logout URL if you want to redirect users to a specific URL after they log out from their Nolt account.
User role structure (optional)
If you are passing the user role for nolt other than noltUserRole in the OIDC token, you need to set this field. If you have the attribute as follows:
```
userRole: 'ADMIN'
```
Then the user role structure should be set as follows:
```
userRole
```
Custom Attributes (optional)
If you are passing any custom attributes in OIDC token, you need to set this field. If you have custom attribute as follows:
```
department
empId
```
Then the user custom attribute structure should be set as follows:
```
{"Department":"department","EmployeeID":"empId"}
```
Click Test and activate:
This should activate the SSO. To test the SSO try logging in as a new user.

SAML 2.0 Integration

If you want to use SAML 2.0 based authentication for your users then you can follow along the steps to integrate OneLogin with Nolt.

1. Setting up Application in OneLogin

Sign in to your OneLogin account as an administrator. Navigate to Applications → Add App. Search for SAML and select SAML Custom Connector (Advanced) from the list. Name the app Nolt and upload your logo and save the App.

2. SAML Configuration

The following settings should be configured in OneLogin to setup SAML 2.0:

Audience:
```
https://YOUR_BOARD.nolt.io
```
This URL should match the Audience URI in Nolt SAML configuration.
Recipient:
```
https://YOUR_BOARD.nolt.io/sso/saml
```

ACS (Consumer) URL Validator:

^https:\/\/YOUR_BOARD\.nolt\.io\/sso\/saml$

ACS (Consumer) URL:
```
https://YOUR_BOARD.nolt.io/sso/saml
```
Other fields are optional. The configuration should look similar to the screenshot below:
SAML signature element:
Select Assertion as the SAML signature element
Parameters
Navigate to parameters tab (available at the left panel). To add parameters click on the + (Add) symbol.

It is mandatory to set the below parameters with the same field-name mentioned (case sensitive).
- id
  Check the Include in SAML assertion flag and click save. The value should be a unique descriptor for the user (Can be UUID/email or any other field).
- name
  Check the Include in SAML assertion flag and click save. Set the value to Name.
- email
  Check the Include in SAML assertion flag and click save. Set the value to Email.
- noltUserRole (Optional)
  If you wish to pass the role for the user, you can set this field. The value field can be set to the field that describes the role for the user. Note: Role can be one of ADMIN/MODERATOR (case-sensitive).
- Custom Attributes (Optional)
  You can set the custom attributes that will be shown in user profile. You can use any field-name and field value for custom attributes.
SAML Signature Algorithm
Navigate to SSO tab (available at the left panel) and set the SAML Signature Algorithm as SHA-256

3. Integrating in Nolt

Navigate to your board → Integrations → SAML 2.0. Set up all the required fields to activate the integration.

Note: The configuration data is available in SSO tab of OneLogin (OneLogin administrator → Applications → Nolt → SSO).

IDP entity ID (Issuer URL):
Copy the Issuer URL.
SP Entity ID (Audience URI):
```
https://YOUR_BOARD.nolt.io
```
X509 Certificate:
To get the certificate, click on view details and copy it.
Remote Login URL:
Copy the SAML 2.0 Endpoint (HTTP).
Remote logout URL (optional)
Add a Remote logout URL if you want to redirect users to a specific URL after they log out from their Nolt account.
User role structure (optional)
If you are passing the user role for nolt other than noltUserRole from the parameter, you need to set this field. If you have setup the parameter statement as follows in OneLogin,Then the structure should be,
```
userRole
```
Custom Attributes (optional)
If you have set any custom attributes in the parameter, you need to set this field. If you have setup the parameter as follows:Then the structure should be,
```
{"Department":"userDepartment","Title":"title"}
```
Click Test and activate:
This should activate the SSO. To test the SSO try logging in as a new user.