OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide

Deployment Overview

You can configure Single Sign-On to use SAML authentication and enable your users to log in through one portal and get access to multiple services.

This document describes how to set up SAML authentication through the WatchGuard Access Portal with OneLogin as the Identity Provider.

Test Topology

This integration uses OneLogin Portal to communicate with a WatchGuard Firebox over a public internet connection.

Configure Your Firebox

Because the WatchGuard Access Portal is a subscription service, before you can enable the Access Portal feature and configure it on your Firebox, you must add an Access Portal license to your Firebox feature key.

To configure the Access Portal settings on your Firebox for OneLogin:

1. Log in to Fireware Web UI.
2. Select Subscription Services > Access Portal.
   The Access Portal page appears with the Applications tab selected by default.
3. Select the Enable Access Portal check box.

4. Select the SAML tab.
   The SAML tab appears.
   
5. Select the Enable SAML check box.
6. In the Service Provider (SP) Settings section, type the IdP Name and Host Name.
   You add the IdP settings later in this process.
   • IdP Name — Specify a name for the SAML authentication to appear in other Firebox settings as the server name.
   • Host Name — Specify the fully qualified domain name that resolves to the Firebox external interface.

7. Select Save.
8. Go to https://<host name>/auth/saml.
   
9. Make sure you have this information from the /auth/saml page:
   • SAML Entity ID in this format: https://<host name>/auth/saml.
   • Assertion Consumer Service (ACS) URL in this format: https://<host name>/auth/saml/acs.
   • Single Logout Service (SLS) URL in this format: https://<host name>/auth/saml/sls.
   • Copy the certificate.

Configure OneLogin

To import the information from the WatchGuard Web UI and to get the IdP Metadata URL:

1. Log in to your OneLogin Administration account.
2. Select Applications > Applications > Add App.
3. In the search text box, type SAML Test Connector.
   A list of connector options appears.
4. Select SAML Test Connector (Advanced).

5. On the Portal page, in the Display Name text box, type a descriptive name.
6. To enable your users to see the configuration in the portal, select Visible in portal. Select an icon option and upload the icon:
   • Rectangular Icon
   • Square Icon
     

7. Click Save.
   
8. From the navigation, select the Configuration tab.

9. Specify these settings:
   

RelayState

Leave blank.

Audience

https://<your host name>/auth/saml

The label in the Access Portal pages is SAML Entity ID.

Recipient

https://<your host name>/auth/saml/acs

The label in the Access Portal pages is Assertion Consumer Service (ACS) URL.

ACS (Consumer) URL Validator

https://<your host name>/auth/saml/acs

The label in the Access Portal pages is Assertion Consumer Service (ACS) URL.

ACS (Consumer) URL:

https://<your host name>/auth/saml/acs

The label in the Access Portal pages is Assertion Consumer Service (ACS) URL.

Single Logout URL

https://<your host name>/auth/saml/sls

10. From the SAML signature element drop-down list, select Assertion.
11. Select the Encryption assertion check box.
12. From the SAML encryption method drop-down list, select AES-256-CBC.
13. Keep the default values for all other settings.

14. Click Save.
15. Select the Configuration tab.
16. In the SAML Encryption section, for the Public key, paste the certificate you copied from the WatchGuard SAML 2.0 Configuration for WatchGuard Access Portal.

17. Select the Parameters tab.
18. In the Credentials are section, select Configured by admin.
19. Verify that the NameID value setting is Email.

20. Click +, in the Field name text box, type memberOf. In our example, we use group authentication, if you want to use user authentication, skip steps 20–24.
21. Select the Include in SAML assertion check box.

22. Click Save.
23. From the Value drop-down list, select MemberOf.

24. Click Save.

25. Select the SSO tab.
26. From the SAML Signature Algorithm drop-down list, select SHA-256.
27. Copy the value of Issuer URL.
    You will add this URL in the SAML configuration under the IdP Metadata URL.
    
28. To enable assumed sign-in, select the Allow assumed users to sign into this app check box.
29. Keep the default values for all other settings.

30. Click Save.
31. To create a group for users, select Users > Groups > New Group.
32. In the Untitled Group text box, type a descriptive name for the group.
33. From the Security policy drop-down list, select Default policy.
    

34. Click Save.
35. To add a user in OneLogin, select Users > Users > New User.
    You can add your own user information.
    

36. Click Save User.
37. Select Users > Users and select the user you created.
38. Select the Authentication tab, from the User security policy drop-down list, select Default policy.
39. Select the Applications tab, in the Applications section, click +.
40. From the Select application drop-down list, select SAML Test Connector (Advanced) you created.

41. Click Continue.
42. Select the Allow the user to sign in check box.
43. Verify the value of NameID value is the email address of the user you created.
44. In the memberOf text box, type the group name you created.

45. Click Save.
46. Click Save User.

Complete the WatchGuard SAML Setup

From Fireware Web UI:

1. Select Subscription Services > Access Portal.
2. Select the SAML tab.
3. In the IdP Metadata URL text box, paste the value of Issuer URL you copied from the OneLogin setup.

4. Click Save.
5. Select Authentication > Users and Groups.
6. Click Add.
   The Add User or Group page appears. You can add a user or a group. In our example, we add a group. If you want to add a user, the user name must type the user's email address.
7. For Type, select Group.
8. In the Name text box, type a name for the group. The group name must be the same as the group name of memberOf on OneLogin.
9. From the Authentication Server drop-down list, select the authentication server where the user or group exists.
   

10. Click OK.
11. Click Save.
12. To add an application to the access Portal, select Subscription Services > Access Portal.
13. In the Applications section, click Add. In our example, select the Web Application.
14. In the Name text box, type a description name.
15. In the URL text box, type the url address.
16. Click OK.
17. Click Save.
18. Select the User Connection Settins tab.
19. In the User Access section, select Specify the applications available to each user and group.
20. Click Add.
21. From the Authentication Server drop-down list, select the authentication server.
22. From the Type drop-down list, select Group.
23. In the Name text box, type the group name. The group name must be the same as the group name of memberOf on OneLogin.
24. Select the applications that are available to this group.

25. Click OK.
26. Click Save.

Test the Integration

After you have completed these configuration steps, users in the group you added can sign in to either the OneLogin account or to a resource configured with OneLogin Single Sign-On.

1. Type the URL for the portal in this format: https://<host name>.
   The Log In page appears with the name of the SAML portal you configured at the top of the page.
   

2. To log in, click the name of the SAML portal. In this example, we click My_OneLogin.
   
3. Complete the authentication process in OneLogin.
   After successful authentication, the user can get access to the resource.