OneLogin SSO (Manual)

Setting up DevArmor SSO with your OneLogin

DevArmor supports signing in with your organization's OneLogin via OpenID Connect. Your OneLogin administrator needs to register an app and share four values with us. Time required: ~10 minutes.

Supported features

• SP-initiated SSO: users start sign-in from the DevArmor application.

Not supported:

• IdP-initiated SSO (launching DevArmor from the OneLogin portal). Sign-in always starts at app.devarmor.com

• Just-in-Time (JIT) provisioning. DevArmor provisions users on its side; authenticating via OneLogin doesn't create a DevArmor account by itself. See Adding new users after setup below.

• SCIM provisioning

• Single Logout (SLO)

There's currently no public API for account management. New users are added within the DevArmor application by your organization's DevArmor admin, or by contacting [e-mail].

Step 1 — Create an OIDC app in your OneLogin org

• OneLogin Admin Console → Applications → Add App

• Search for "OpenId Connect (OIDC)" and select it (the generic connector — DevArmor isn't in the OneLogin app catalog yet, so there's no dedicated "DevArmor" listing to search for)

• Display name: DevArmor

• Configuration tab → Redirect URI: https://auth.devarmor.com/oauth2/idpresponse

• Leave Login URL blank — sign-in always starts from DevArmor, not from your OneLogin portal

• Users tab: assign the users who should have DevArmor access (not the Access tab — that's for role/policy-based rules; individual and ongoing user assignment happens under Users)

Step 2 — Set the Token Endpoint Authentication Method to POST

On the app's SSO tab:

• Application Type: Web

• Token Endpoint Authentication Method: POST

Step 3 — Send DevArmor these four values

(please send the client secret over a secure channel — a password manager, encrypted message, or our PGP key — not plain email):

1. OneLogin domain — e.g. your_domain.onelogin.com, or your custom domain if you use one

2. Client ID (from the app's SSO tab)

3. Client Secret (from the app's SSO tab)

4. Email domain(s) your team uses — e.g. your_domain.com

We'll enable routing for your domain. Your team then signs in at app.devarmor.com → "Sign in with OneLogin" → enter their @your_domain.com email → they're redirected to your OneLogin to authenticate.

Adding new users after setup

DevArmor doesn't support Just-in-Time provisioning, so there are two separate steps for every new user.

1. In DevArmor: an account must exist for the user (matching email address). Your organization's DevArmor admins can add this from within the app from Members tab, or contact [e-mail].

2. In OneLogin: your OneLogin admin must assign the user to the DevArmor app on its Users tab (Applications → DevArmor → Users → add the user).

Troubleshooting adding new users

• Missing either step causes sign-in to fail.

  • If step 2 is missing, the user is bounced back before ever reaching a DevArmor screen, usually with error=access_denied and error_description=End-user does not have access to this application visible in the URL.

  • If step 1 is missing, the user successfully authenticates via OneLogin but is rejected by DevArmor as unrecognized. This is indicated by a red toast message User not authorized.

Notes

• You keep full control of your own MFA and sign-on policies. DevArmor never changes them.

• Organizational (work) OneLogin accounts only; personal accounts aren't supported.