OneLogin SSO (Manual)
Setting up DevArmor SSO with your OneLogin
DevArmor supports signing in with your organization's OneLogin via OpenID Connect. Your OneLogin administrator needs to register an app and share four values with us. Time required: ~10 minutes.
Supported features
SP-initiated SSO: users start sign-in from the DevArmor application.
Not supported:
IdP-initiated SSO (launching DevArmor from the OneLogin portal). Sign-in always starts at
app.devarmor.comJust-in-Time (JIT) provisioning. DevArmor provisions users on its side; authenticating via OneLogin doesn't create a DevArmor account by itself. See Adding new users after setup below.
SCIM provisioning
Single Logout (SLO)
There's currently no public API for account management. New users are added within the DevArmor application by your organization's DevArmor admin, or by contacting support@devarmor.com.
Step 1 — Create an OIDC app in your OneLogin org
OneLogin Admin Console → Applications → Add App
Search for "OpenId Connect (OIDC)" and select it (the generic connector — DevArmor isn't in the OneLogin app catalog yet, so there's no dedicated "DevArmor" listing to search for)
Display name:
DevArmorConfiguration tab → Redirect URI:
https://auth.devarmor.com/oauth2/idpresponseLeave Login URL blank — sign-in always starts from DevArmor, not from your OneLogin portal
Users tab: assign the users who should have DevArmor access (not the Access tab — that's for role/policy-based rules; individual and ongoing user assignment happens under Users)
Step 2 — Set the Token Endpoint Authentication Method to POST
On the app's SSO tab:
Application Type:
WebToken Endpoint Authentication Method:
POST
Step 3 — Send DevArmor these four values
(please send the client secret over a secure channel — a password manager, encrypted message, or our PGP key — not plain email):
OneLogin domain — e.g.
your_domain.onelogin.com, or your custom domain if you use oneClient ID (from the app's SSO tab)
Client Secret (from the app's SSO tab)
Email domain(s) your team uses — e.g.
your_domain.com
We'll enable routing for your domain. Your team then signs in at app.devarmor.com → "Sign in with OneLogin" → enter their @your_domain.com email → they're redirected to your OneLogin to authenticate.
Adding new users after setup
DevArmor doesn't support Just-in-Time provisioning, so there are two separate steps for every new user.
In DevArmor: an account must exist for the user (matching email address). Your organization's DevArmor admins can add this from within the app from Members tab, or contact
support@devarmor.com.In OneLogin: your OneLogin admin must assign the user to the DevArmor app on its Users tab (Applications → DevArmor → Users → add the user).
Troubleshooting adding new users
Missing either step causes sign-in to fail.
If step 2 is missing, the user is bounced back before ever reaching a DevArmor screen, usually with
error=access_deniedanderror_description=End-user does not have access to this applicationvisible in the URL.If step 1 is missing, the user successfully authenticates via OneLogin but is rejected by DevArmor as unrecognized. This is indicated by a red toast message
User not authorized.
Notes
You keep full control of your own MFA and sign-on policies. DevArmor never changes them.
Organizational (work) OneLogin accounts only; personal accounts aren't supported.
Last updated
Was this helpful?