> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/onelogin.md).

# OneLogin

### Overview

The OneLogin integration connects to your OneLogin environment to discover users, group memberships, applications, and role assignments managed by the identity provider.

The integration enables:

* Discovery of OneLogin users, groups, roles, and applications
* Visibility into OneLogin administrative roles
* Review of SAML applications assigned to OneLogin users and groups
* Mapping access between OneLogin users and AWS IAM roles they can assume

### Configuring OneLogin

Veza connects to your OneLogin environment using read-only API credentials. To configure the integration, you will need to create a new credential and save the client ID and secret.

#### Prerequisites

* OneLogin administrator account
* API credentials with Read All scope

#### Creating OneLogin API Credentials

1. Log in to OneLogin as an account owner or administrator.
2. Navigate to **Developers** > **API Credentials**.
3. Click **New Credential**.
4. Select "Read All" scope.
5. Click **Save** and securely store the client ID and secret.

See the [Working with API Credentials](https://developers.onelogin.com/api-docs/1/getting-started/working-with-api-credentials) documentation for more details.

### Configuring OneLogin on the Veza Platform

1. In Veza, go to the **Integrations** page.
2. Click **Add Integration** and search for OneLogin.
3. Click on the **OneLogin** tile to open the configuration form.
4. Enter the required information.
5. Click **Create Integration** to save the configuration.

| Field                 | Description                                                                                                                                                         |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Insight Point         | Choose whether to use the default data plane or a deployed Insight Point                                                                                            |
| Name                  | A friendly name to identify the unique integration                                                                                                                  |
| Domain                | OneLogin domain, e.g., `your-domain.onelogin.com`                                                                                                                   |
| Region                | OneLogin region, e.g., `us`                                                                                                                                         |
| Client ID             | API client ID from OneLogin                                                                                                                                         |
| Client Secret         | API secret from OneLogin                                                                                                                                            |
| Mapping Configuration | Define rules for linking OneLogin users to other IdP identities or local users.                                                                                     |
| Custom Properties     | Specify any [Custom Fields](https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010629) to extract by entering the API shortname and data type. |

### Notes and Supported Entities

The OneLogin integration discovers the following entities and relationships:

* Domain → Users
* Domain → Applications
* Domain → Groups (one-to-many)
* Domain → Roles (one-to-many)
* Users → Groups (many-to-one)
* Users → Roles (many-to-many)
* Applications → Users (many-to-many)

#### OneLogin Domain

A OneLogin tenant containing and managing users, applications, groups, and roles. The domain serves as the root node for discovering identity and access relationships.

#### OneLogin User

Identities in OneLogin, including core attributes and authentication status. Users can belong to groups and be assigned roles.

| Attribute         | Description                               |
| ----------------- | ----------------------------------------- |
| `username`        | OneLogin username (required)              |
| `email`           | User's email address (required)           |
| `firstName`       | User's first name                         |
| `lastName`        | User's last name                          |
| `title`           | Job title (optional)                      |
| `department`      | Department name (optional)                |
| `isLocked`        | Account lock status                       |
| `lastLoginAt`     | Timestamp of last login                   |
| `mfaActive`       | Multi-factor authentication status        |
| `createdAt`       | Account creation timestamp                |
| `updatedAt`       | Last modification timestamp               |
| `awsIamRoleArns`  | List of AWS IAM roles the user can assume |
| `samlProviderArn` | SAML provider ARN for AWS role assumption |

#### OneLogin App

SAML Applications integrated with OneLogin define what users can access through OneLogin SSO.

| Attribute             | Description                              |
| --------------------- | ---------------------------------------- |
| `oneLoginConnectorId` | OneLogin connector identifier (required) |
| `samlProviderIds`     | Associated SAML provider IDs (optional)  |
| `createdAt`           | Application creation timestamp           |
| `updatedAt`           | Last modification timestamp              |

`OneLoginApp` entities support [entity owner assignment](/4yItIzMvkpAvMVFAamTf/features/access-reviews/configuration/managers-and-resource-owners.md#supported-entity-types).

#### OneLogin Group

Groups represent collections of users, used for role-based access control at scale.

#### OneLogin Role

Admin role assignments in OneLogin grant access to platform management capabilities. Roles track administrative access with admin ID mappings.

| Attribute  | Description                                |
| ---------- | ------------------------------------------ |
| `adminIds` | List of administrative user IDs (optional) |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/onelogin.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.