1. Docs
  2. Administration
  3. Access & Identity
  4. SAML(SSO)
  5. OneLogin

SAML: Configuring OneLogin

    This guide walks you through configuring OneLogin as a SAML SSO identity provider (IdP) for Pulumi Cloud.

    Creating the OneLogin application

    The first step is to create a new OneLogin Application for Pulumi SSO:

    1. From the OneLogin Administration portal, go to the Applications page and select the Add App button.

    2. Search for SAML Custom Connector (Advanced) and select it.

      Finding the SAML Test Connector App

    3. Enter a Display Name and optionally a logo. See Pulumi Logos.

    4. Select Save.

      Creating a OneLogin Application example

    Configuring the OneLogin application

    Now configure the OneLogin Application with the SAML settings for Pulumi SSO.

    Configure SAML URLs

    Select the Configuration view for the application and enter/confirm the values in the following table.

    The values you need to use are dependent upon your Pulumi organization name. Be sure to replace acmecorp with your actual organization name.

    Configuration SettingsValue
    Relay Statehttps://api.pulumi.com/login/acmecorp/sso
    Audience (EntityID)https://api.pulumi.com/login/acmecorp/sso/saml/metadata
    Recipienthttps://api.pulumi.com/login/acmecorp/sso/saml/acs
    ACS Consumer URL Validator.*
    ACS Consumer URLhttps://api.pulumi.com/login/acmecorp/sso/saml/acs
    SAML initiatorOneLogin
    SAML nameID formatEmail
    SAML issuer typeSpecific
    SAML signature elementResponse
    SAML encryption methodTRIPLEDES-CBC
    Do not change the value of SAML nameID format once your users have started using Pulumi—not even switching its value between EmailAddress or Persistent.

    Configuration settings example

    Configure SSO settings

    Select the SSO view for the application and set/confirm the following:

    SSO SettingsValue
    SAML Signature AlgorithmSHA-512

    SSO Settings

    User assignments

    After the Pulumi SAML application has been created in OneLogin, the next step is to assign users to it. This will grant specific users or groups access to sign into Pulumi with their OneLogin-provided credentials.

    To assign users or groups to the application, navigate to the Users tab in the OneLogin portal to add users and then assign them to the Pulumi SSO application.

    User Assignments

    Configuring your Pulumi organization

    To configure Pulumi Cloud with details on your new OneLogin-based SAML application, you need to obtain the IdP metadata document from OneLogin and then provide it to Pulumi.

    Navigate to the OneLogin Application you created above and select the More Actions drop down menu button and select SAML Metadata to download the metadata XML file.

    Get Metadata

    1. Open the file and copy the entire block of XML text to your clipboard.
    2. Sign in to Pulumi Cloud and navigate to your organization.
    3. Select Settings > Access Management.
    4. Select the Other tab.
    5. In the Membership Requirements section, select Change requirements.
    6. Select SAML SSO and then Next.
    7. Paste the IdP metadata XML into the text area.
    8. Select Apply changes.

    Signing in to Pulumi using OneLogin

    Members of your OneLogin application can now sign in to Pulumi. Navigate to https://app.pulumi.com/signin/sso/ and enter the name of your Pulumi organization.

    Troubleshooting

    For help resolving SAML SSO configuration issues, see the SAML SSO troubleshooting guide or contact support.