OneLogin Users and Groups Synchronization in WebADM

Overview & Concepts

Overview and Concepts

Building a Unified IAM Infrastructure
In large organizations, consolidating Identity and Access Management (IAM) systems from different vendors across various locations is a daunting and often impractical task. This is especially challenging for corporate groups and companies that frequently acquire new subsidiaries, resulting in fragmented information systems. Consolidation projects are typically long, costly, and rarely yield the expected results, leaving behind a mix of well-integrated systems and legacy systems that still need to function.

RCDevs addresses these challenges by offering a federated approach to IAM and Identity Provider (IdP) management. The RCDevs solution federates multiple IAM systems, integrating them into a cohesive meta-IAM platform. This top-level meta-IAM provides a unified view of all the underlying IAM systems, allowing seamless integration with cloud or on-premises services like email, VPNs, and OpenID Connect (OIDC). With this approach, there's no need for complex IdP cascading or password management, simplifying the IAM consolidation process.

For example, consider a corporate group, MyCorp, which has acquired two companies—one using Okta and the other using local Active Directory (AD) systems—while MyCorp itself uses OneLogin. RCDevs creates a meta-IAM that aggregates these disparate systems into a unified platform. This enables cross-IAM application access policies, unified UPN naming conventions, and centralized IdP services across the entire organization.

WebADM and External IAM Integration
With the introduction of WebADM version 2.3.20, RCDevs enhanced its platform with native integration capabilities for external IAM providers. This feature allows organizations to synchronize accounts and groups from their cloud IAM providers into WebADM’s LDAP tree. The synchronization is one-way—from the external IAM provider to WebADM—preserving group memberships and allowing external identities to be added to locally defined groups within WebADM.

This functionality is especially beneficial in scenarios like mergers and acquisitions, where multiple IAM systems need to be unified. By synchronizing identities from various sources, WebADM creates a centralized user directory, enabling consistent security policies, seamless IT management, and group-based access control across the entire organization.

The benefits of this approach include simplified identity management, enhanced security and compliance, flexible group management, cost efficiency, scalability, and an improved user experience through a unified access platform.

In summary, RCDevs and WebADM provide powerful tools for overcoming the complexities of managing multiple IAM systems, enabling a cohesive, secure, and scalable identity management infrastructure.

Actions/permissions required on OneLogin

To perform operations such as locking a user account, checking or changing a OneLogin user's password, and retrieving user and group information using OneLogin APIs from WebADM, you will need specific API permissions. These permissions must be granted via API credentials in the OneLogin Administration Console.

API Credentials

From the OneLogin admin console, go to Developers-->API Credentials.
Click on the New Credential button which is located at the top right of the page.

Provide a name, and select Manage users. Then, click on Savebutton.

Take note of the Client ID and the Client Secret, these will be used in the WebADM configuration.

Permissions & Roles

Creating an API Credential is sufficient to obtain all the permissions required to enable full WebADM synchronization. Related permissions are:

• Synchronize Users and Groups Information: synchronize users and groups from OneLogin within the WebADM Framework
• Password verification with Salesforce: validate a user's password using OneLogin for authentication that started with OpenOTP and a synced OneLogin account.
• User Account Lockout: this permission is essential when using the Account Lockout feature in OpenOTP Badging. It is required if you've implemented an account lockout policy that prevents access when the user is not badged-in. The account will remain locked at the OneLogin level, until the user badges-in with the OpenOTP Token application or from the User Self-Service Desk web application.
• Password Reset/Update: passwords for OneLogin accounts synced in WebADM can be changed through the WebADM Framework. The system supports applying password policies, leak protections, and weak password detection to OneLogin accounts. Resetting a user's password from a third-party application requires admin rights due to the sensitivity and potential impact of this operation. In OneLogin, the permissions required to perform these actions generally involve administrative privileges.

OneLogin configuration on WebADM

The OneLogin configuration on WebADM consists of:

• Creating a Container, Organizational Unit, or Organization object in your LDAP tree where the OneLogin tenant will be synced.
• Creating a WebADM User Domains and configuring the tenant information of your OneLogin tenant.

Container Creation

Let's first create the container where objects will be synced in.

Login on the WebADM Administrator Portal with a super_admin account, and click on the Create tab.
In this example, we create an OrganizationalUnit named OneLogin inside an existing Organization object named External Providers.

Click Proceed and select the location of the OU. I created it within an organization object named External Providers, but you can place it wherever you prefer. Name your object, optionally provide a description, and click Proceed, followed by Create Object.
Your Organizational Unit should then be created and visible at the location you specified.

Domain Creation and Configurations

Username/UPN Concepts

The WebADM User Domain creation involves configuring the following key settings:

• The User Search Base
• The UPN Mode and optionally the UPN Suffix when the UPN Mode is set to Explicit.
• The Directory Synchronization settings

When configuring the UPN Mode, you are determining how the login name value will be synced in the login attribute.

Example for Clarification

Consider the UPN (User Principal Name) of a OneLogin account: testaccount@xxxxx.onmicrosoft.com.

• testaccount is the UPN prefix.
• xxxxx.onmicrosoft.com is the UPN suffix.

UPN Mode: Implicit vs Explicit

The UPN Mode can be set to either Implicit or Explicit. Here's how each mode works:

1. Implicit Mode:
   In this mode, the testaccount value (the UPN prefix) will be stored in the login attribute. With this mode, users can authenticate using two different methods:

   • By providing username=testaccount and domain=WebADM_Domain_Name to the OpenOTP APIs.
   • By constructing a UPN with the WebADM Domain Name they belong to and logging in as username@WebADM_Domain_Name.

This mode is the most flexible.
The UPN suffix can also be configured to work with the full UPN, even if it's not synced into the uid attribute.
With Active Directory backend configured with WebADM, you must set UPN Mode to Implicit. Explicit mode can not work, as the UPN prefix is synced into the sAMAccountName and the full OneLogin UPN is synced into the UserPrincipalName.

2. Explicit Mode:
   In this mode, the full UPN (testaccount@xxxxx.onmicrosoft.com) will be stored as the login attribute. In this case, users must use the full UPN as their username to log in. The testaccount value (UPN prefix) alone cannot be used for authentication.

If the directory backend configured with WebADM is Active Directory, and you attempt to sync OneLogin accounts into Active Directory, the prefix of the UPN will be synced into the sAMAccountName attribute, while the entire OneLogin UPN will be synced into the UserPrincipalName attribute.

Now that you fully have the concepts, we can continue by creating the WebADM User Domain object and configuring the information for OneLogin.

Go to the Admin tab, select User Domains, and click Add Domain. Provide a common name to identify the cloud provider, such as OneLogin, and optionally add a description. Then, click Proceed followed by Create Object.

The domain object will be created, and you will enter the User Domain configurator. In the first section, configure the User and Group Search Bases to point to the Organizational Unit (OU) you previously created. In the UPN Suffix field, enter your OneLogin UPN ending with onmicrosoft.com. This information can be retrieved from your tenant.

Scroll down to the Directory Synchronization section.

• In the Provider setting, select OneLogin.
• In the Tenant ID setting, enter your tenant identifier, which can be retrieved from your OneLogin directory.
• In the Client ID setting, enter the unique identifier assigned to your registered application within the directory.
• In the Secret Key setting, enter the private key associated with the application. This key, used together with the client ID, verifies the application's identity.
• Choose the Sync Options that best suit your preferences for password synchronization, ensuring they align with the permissions granted to the application.
• Finish by setting the Sync Period. By default, synchronization occurs every hour.

When the configuration is complete, click Apply to save your settings. You will be redirected to the Registered LDAP Domains menu, where your OneLogin domain should appear with a Sync Now button.
Click this button to start the synchronization process.

If any objects cannot be synced for any reason, an error message will appear in the synchronization output. For more details, consult the WebADM Server logs.

Objects that have been successfully synced will appear in the left LDAP tree, as shown in the screenshot below:

That's it. The synced identities and groups can now be used with WebADM, along with its dependencies and integrations.