This guide applies to Mac computers
About Passport with OneLogin
Passport with OneLogin enables users to log into Mac computers using their OneLogin credentials. This integration provides secure authentication using your organization’s OneLogin identity system with support for both standard and multi-factor authentication.How It Works
Passport integrates with your OneLogin instance using OpenID Connect (OIDC) to authenticate users at the macOS login screen. Whether you need MFA for Passport sign-in determines how many OIDC applications you create in OneLogin and whether you set Authentication mode to Web Login or Mac Login in the Passport Library Item.- OneLogin
- Iru Endpoint
Prerequisites
- To add apps in OneLogin, use an account that is a Super User or Account Owner.
Configure an OIDC App
If you do not need MFA for Passport sign-in, set Authentication mode to Mac Login in the Passport Library Item and follow only the Mac Login section (skip Web Login).If you need MFA at sign-in, set Authentication mode to Web Login. You must create two OIDC apps in OneLogin: Mac Login first (sign-in and password sync to the Mac), then Web Login (MFA in the embedded web view). Follow the Mac Login section, then the Web Login section, in that order.Mac Login
Create the Mac Login OIDC application in OneLogin. This article uses the display name Iru Passport Mac Login.Every deployment uses this app. With Mac Login as the authentication mode, it is the only OneLogin OIDC app you add in this guide. With Web Login (MFA), add this app first, then continue to Web Login.1
Log in to OneLogin
Log in to OneLogin as an Account owner or Super user.
2
Navigate to Applications
In your OneLogin admin console, navigate to the Applications page.
3
Add new app
In the upper-right corner, click Add App.
4
Search for OIDC
In the search field in the upper-left corner, enter OIDC.
5
Select OpenID Connect
Select OpenID Connect (OIDC).
6
Configure app details
In the Display Name field, enter a descriptive name such as Iru Passport Mac Login.
7
Set visibility
Click the Visible in portal switch to the Off position; this app does not need to be visible in order for Passport to work, and it might be confusing for a user to see this app in their OneLogin portal.
8
Save app
Click Save.
9
Access Configuration
In the left sidebar, click Configuration.
10
Enter redirect URI
In the Redirect URIs field, enter the following:
Passport doesn’t require this value, but you cannot save the app configuration without some value in the Redirect URIs field.
11
Access SSO settings
In the left sidebar, click SSO.
12
Set Application Type
Click the Application Type menu and select Native.
13
Set Token Endpoint
Click the Token Endpoint menu and select None (PKCE).
14
Save SSO configuration
Click Save.
Collecting configuration details for Mac Login
1
Prepare secure document
This OIDC app keeps the Mac password in sync with OneLogin. Open a secure text document that you can use to store values for this OIDC app. You will need the Client ID and Issuer URL details when you configure the Passport Library Item (you don’t need the client secret).
2
Copy Client ID
To the right of the Client ID field, click the Copy to Clipboard button (looks like a clipboard).
3
Store Client ID
Paste the Client ID into the secure text document.
4
Copy Issuer URL
Right-click (or Control-click) the Well-known Configuration link and copy its value. The Issuer URL is your OIDC well-known configuration endpoint and follows this pattern:
5
Store Issuer URL
Paste the Issuer URL into the secure text document.
6
Save document
Save the secure text document.
7
Assign app to users
In OneLogin, assign the app to the users or groups who will be using Passport to log in to their Mac computers.
If you are not using Web Login (no MFA), skip the Web Login section below, then continue with Configuring a User Account Type by Identity Provider Group in OneLogin if you need role-based account types, then open the Iru Endpoint tab.
Web Login
Use this section only when Authentication mode is Web Login (MFA). After you finish Mac Login, create the second OIDC app here. This article uses the display name Iru Passport Web Login.1
Navigate to Applications
In your OneLogin admin console, navigate to the Applications page.
2
Add new app
In the upper-right corner, click Add App.
If the Add App button does not appear, it’s possible that you previously clicked See the new apps list. To make OneLogin display the Add App button, remove the string /admin2 from the URL. For example, instead of https://accuhive.onelogin.com/admin2/apps, use https://accuhive.onelogin.com/apps.
3
Search for OIDC
In the search field in the upper-left corner, enter OIDC.
4
Select OpenID Connect
Select OpenID Connect (OIDC).
5
Configure app details
In the Display Name field, enter a descriptive name such as Iru Passport Web Login.
6
Set visibility
Click the Visible in portal switch to the Off position; this app does not need to be visible in order for Passport to work, and it might be confusing for a user to see this app in their OneLogin portal.
7
Save app
Click Save.
8
Access Configuration
In the left sidebar, click Configuration.
9
Enter redirect URI
In the Redirect URIs field, enter the following:
10
Access SSO settings
In the left sidebar, click SSO.
11
Set Application Type
Click the Application Type menu and select Native.
12
Set Authentication Method
In the Token Endpoint section, click the Authentication Method menu and select POST. POST is required so users can complete MFA in the web view at Mac sign-in.
13
Save SSO configuration
Click Save.
Collecting configuration details for Web Login
1
Prepare secure document
This OIDC app supplies the Web Login fields for the Passport Library Item. Open a secure text document that you can use to store values for this OIDC app. You will need the Client ID and Client Secret for this POST app when you configure the Passport Library Item. If you already have a secure document from the Mac Login OIDC app, add a note that the new values are for the Web Login OIDC app.
2
Copy Client ID
Copy the contents of the Client ID field.
3
Store Client ID
Paste the Client ID into the secure text document.
4
Show client secret
Click Show client secret.
5
Copy client secret
Copy the client secret.
6
Store client secret
Paste the client secret into the secure text document.
7
Save document
Save the secure document.
8
Assign app to users
In OneLogin, assign the app to the users or groups who will sign in with Web Login (MFA).
Configuring a User Account Type by Identity Provider Group in OneLogin
Use this section when you map OneLogin roles to standard or administrator Mac accounts in Passport. It applies for both Mac Login (no MFA) and Web Login (MFA).When configuring whether a user will be a standard user or an admin user, follow the steps below.1
Access Roles
Log in to your OneLogin Console. Select Users > Roles.
2
Create new role
Select New Role on the top right of the screen, and name your role. (You will want to make sure your role name matches the IDP group name that you are using in your Iru Passport configuration). In this example, the role is named Passport Admin Users. Finally, select your Iru Passport app that you created in OneLogin and click Save on the top right of the screen.
3
Configure app parameters
Next, navigate to the Iru Passport app that you created in OneLogin. Select the parameters link and click the Groups field.
4
Set default value
In the “Default if no value selected” section, select User Roles from the drop-down list and make sure Semicolon Delimited Input is selected. Click Save.
5
Assign users to role
Finally, make sure your users are part of the role that you are creating, as well as a member of the Iru Passport application in OneLogin. To add a user to a role, select Users > Roles > your role name (for example, Passport Admin Users), select the Users link, search for the user, click the blue check box, click the Add to Role link, and then click Save at the top right of the page.
When OIDC apps and roles in OneLogin match what you need, open the Iru Endpoint tab to enter values in the Passport Library Item. On that tab, User provisioning includes an example when a OneLogin role supplies the administrator group name.
