# OneLogin

By integrating OneLogin with HPE Morpheus Enterprise, users can access HPE Morpheus Enterprise with their existing credentials set up within the OneLogin platform. Additionally, administrators can manage user access including Role assignment and enabling or disabling users from within the OneLogin platform. As employees are onboarded, change positions, or leave the company, additional user management within the HPE Morpheus Enterprise platform is not necessary.

## Adding OneLogin Identity Source Integration

To begin, log into OneLogin with an administrator account to gather some needed pieces of information. From the top menu bar, select Administration. From the admin panel, click Developers > APICredentials. Click the button labeled “New Credential”. Provide a name for the new API credentials and select “Manage Users” as the permissions type. Store the credentials somewhere they can be retrieved in the next step.

![../../_images/oneLoginKey.png](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-3244CCDD-7F2B-4DF3-B4E6-4BA4B0686C60-high.png)

Back in HPE Morpheus Enterprise, navigate to the Tenant which will integrate with OneLogin. Identity providers are integrated on a per-Tenant basis in HPE Morpheus Enterprise. From the selected Tenant, click IDENTITY SOURCES. The list of currently-integrated identity providers is here. Click + ADD IDENTITY SOURCE to start a new integration for OneLogin. Fill in the fields below:

- **TYPE:** OneLogin
- **NAME:** A name for the identity source integration in HPE Morpheus Enterprise
- **DESCRIPTION:** An optional description for the identity source
- **ONELOGIN SUBDOMAIN:** The subdomain from your OneLogin portal URL. For example, “morpheus-dev” if your portal is accessed at morpheus-dev.onelogin.com. Incorrect subdomains will cause login attempts to HPE Morpheus Enterprise to fail
- **ONELOGIN REGION:** Specify US or EU region
- **API CLIENT SECRET:** OneLogin API client secret which was gathered earlier in this walkthrough
- **API CLIENT ID:** OneLogin API client ID which was gathered earlier in this walkthrough
- **REQUIRED ROLE:** Enter a role which OneLogin users logging into HPE Morpheus Enterprise must have to gain access to HPE Morpheus Enterprise
- **DEFAULT ROLE:** The default HPE Morpheus Enterprise Role applied to users created from the OneLogin integration if no other role mapping is specified in other Role Mappings fields
- **ROLE MAPPINGS:** All existing HPE Morpheus Enterprise Roles will be listed with fields to enter OneLogin Roles to create a mapping. Users with OneLogin roles matching the role mappings will be assigned the appropriate Role(s) in HPE Morpheus Enterprise when signing in
- **ENABLE ROLE MAPPING PERMISSION:** When selected, Tenant users with appropriate rights to view and edit Roles will have the ability to set role mapping for the Identity Source integration. This allows the Tenant user to edit only the role mappings without viewing or potentially editing the core integration fields (such as the API keys)
- **MANUAL ROLE ASSIGNMENT:** When selected, administrators can manually edit Roles for users created through this identity source integration from the user detail page (Administration > Users > Selected user).

Select SAVE CHANGES and the OneLogin Integration will be added.

Users can now login to HPE Morpheus Enterprise with OneLogin credentials. The first login will create a user in HPE Morpheus Enterprise matching the username, email and password from OneLogin. If a REQUIRED ROLE is specified in the Identity Source settings, only users with that Role in OneLogin will be able to login to HPE Morpheus Enterprise.

IMPORTANT

OneLogin users will not authenticate in HPE Morpheus Enterprise if there is an existing HPE Morpheus Enterprise User with matching username or email address.

You can now test the integration by logging in with user credentials which have been configured in OneLogin. On the first login, a new user will be created with the same username, email address, and password as contained in OneLogin. On subsequent logins, HPE Morpheus Enterprise will sync with OneLogin to make sure the user hasn’t been disabled or if its Role(s) have changed in OneLogin which would affect its corresponding Roles in HPE Morpheus Enterprise.

The HPE Morpheus Enterprise identity source integration is interacting with the OneLogin APIs in the list below. This reference may be needed to ensure HPE Morpheus Enterprise is integrating using an API key with sufficient privileges. In a situation where troubleshooting is needed, first confirm these APIs can be accessed using the provided key.

- `/auth/oauth2/token` - Generate Token
- `/api/1/users/$user_id/roles` - Get Roles
- `/api/1/login/auth` - Create Session
- `/api/1/users/$user_id` - Get User
- `/api/1/roles/$role_id` - Get Role
- `/api/1/roles?name=$role_name` - Find Role
