Skip to main content

Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

OneLogin Cloud Connector

OneLogin is a cloud-based identity and access management solution that provides single sign on (SSO) identity platform to enable enterprises to secure applications for their users on all devices. For more information see the OneLogin documentation.

Prerequisites to Configure the OneLogin Connector

Before you configure the OneLogin connector you must complete the following prerequisites:

  • Ensure the https://*.onelogin.com service is open for communication with the Exabeam Cloud Connector platform.

  • Note the region to which the OneLogin account belongs. For example, EU or US.

  • Create an API credential specifically for Exabeam cloud connector configuration.

  • Obtain the values for client ID and client secret.

Create an API Credential

OneLogin APIs are authenticated via client ID and client secret. You must create an API credential and obtain the values for client ID and client secret to use while configuring the OneLogin connector.

To create an application credential:

  1. Log in to the OneLogin developer console as an administrator.

  2. Navigate to Developers > API Credentials.

  3. On the API Access page, click New Credential.

  4. In the Create New API Credential area, in the Name box, specify a name for the API credential, then select the credential scope Read All.

  5. Click Save.

  6. Copy the values for Client ID and Client Secret to use for authorizing the API calls. Use these values, represented by a string of letters and numbers, to configure the OneLogin cloud connector. For more information, see the OneLogin Documentation.

Configure the OneLogin Cloud Connector

OneLogin is a cloud-based identity and access management solution that provides single sign on (SSO) identity platform to enable enterprises to secure applications for their users on all devices. For more information see the OneLogin documentation.

The following table displays audit source API and security events supported by the connector.

Audit Source: API

Service or Module Covered

Event Types

Event Included

Events

Authentication

Login to OneLogin failed or succeeded, user authentication via API failed or succeeded, user failed remote authentication, Mac login success or failed, user logged-out from OneLogin, user logged-out from app, user authenticated by RADIUS, social sign-in, user login failed via assertion proxy

Represents authentication related events to OneLogin app or its protected apps

Active Directory

Ad connector started, stopped, configuration reloaded

Represents events related to the Active Directory connector

Directory Connector and VLDAP

Directory connector enabled or disabled, directory export started or finished, VLDAP bind failed, VLDAP enabled or disabled or updated

Represents events related to the directory connector

Directory Management

Directory added or deleted or modified, directory group updated

Represents events related to directory management

Integrated Application

Integrated app added or removed or updated

Represents events related to integrated applications

Directory Users Management

User deleted or created in directory, user invited, user locked, user suspended or reactivated in directory, user field added or removed, self-registration requested for user, user unlocked in the directory

Represents events related to user management in OneLogin directories

App Users Management

User deleted or created in app, user suspended or reactivated in app, user linked in app, user updated in app

Represents events related to user management in OneLogin apps

Roles Management

Added role to a user, role management granted or revoked, role removed from a user

Represents events related to security setting updates

Security Settings

Trusted idp removed, certification expiration notice, certification created, RADIUS configuration updated, desktop SSO enabled or disabled, VPN enabled or disabled

SAML

SAML assertion consumer service failed

Passwords

Set password with salt, set password with clear text, failed to set password with salt

Represents event related to password changes and management

Table 21. Audit source API and security events supported by the connector


To configure the OneLogin connector to import data into the Exabeam Cloud Connector platform:

  1. Complete the Prerequisites to Configure the OneLogin Connector.

  2. Log in to the Exabeam Cloud Connectors platform with your registered credentials.

  3. Navigate to Settings > Accounts > Add Account.

  4. Click Select Service to Add, then select OneLogin from the list.

  5. In the Accounts section, enter the required information. Required fields are indicated with a red bar.

    1. Tenant – Select a tenant to attach to the connector if you are using a multi-tenant edition of Exabeam. Otherwise, select default.

    2. Account Name – Specify a name for the OneLogin connector. For example, OneLogin SSO.

    3. Description – Describe the OneLogin connector (optional). For example, OneLogin identity and access management service.

    4. Region – Select the region for the connector. Make sure that the region for the OneLogin account and the region you select for the connector is the same.

    5. Client-ID – Enter the value for client ID that you obtained while completing prerequisites.

    6. Client-Secret – Enter the value for client secret that you obtained while completing prerequisites.

  6. To confirm that the Exabeam Cloud Connector platform communicates with the service, click Test Connection.

  7. Click Done to save your changes. The cloud connector is now set up on the Exabeam Cloud Connector platform.

  8. To ensure that the connector is ready to send and collect data, Start the connector and check that the status shows OK.