OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide
i WatchGuard Technologies, Inc.
One Login SAML Authentication with WatchGuard Access Portal Deployment Overview You can configure Single Sign-On to use SAML authentication and enable your users to log in through one portal and get access to multiple services. This document describes how to set up SAML authentication through the WatchGuard Access Portal with OneLogin as the Identity Provider. Integration Summary Hardware and Service Versions: OneLogin Portal: o November 2017 WatchGuard FireboxV : o Fireware OS v12.1 o Feature key with an Access Portal license Test Topology This integration uses OneLogin Portal to communicate with a WatchGuard Firebox over a public internet connection. OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide 1
Configure Your Firebox for OneLogin Because the WatchGuard Access Portal is a subscription service, before you can enable the Access Portal feature and configure it on your Firebox, you must add an Access Portal license to your Firebox feature key. To configure the Access Portal settings on your Firebox for OneLogin, from Fireware Web UI: 1. Select Subscription Services > Access Portal. The Access Portal page appears with the Applications tab selected by default. 2. Select the Enable Access Portal check box. 3. Click Save 4. Select the User Connection Settings tab. Click Configure. The SAML tab appears. 5. Select the Enable SAML check box. 6. In the Service Provider (SP) Settings section, type the IdP Name and Host Name. You add the IdP settings later in this process. IdP Name Specify a name for the SAML authentication to appear in other Firebox settings as the server name. Host Name Specify the fully qualified domain name that resolves to the Firebox external interface. 2 WatchGuard Technologies, Inc.
4. Select Save. 5. Go to https://<host name>/auth/saml. 6. Make sure you have this information from the /auth/saml page: SAML Entity ID in this format: https://<host name>/auth/saml. Assertion Consumer Service (ACS) URL in this format: https://<host name>/auth/saml/acs. Single Logout Service (SLS) URL in this format: https://<host name>/auth/saml/sls. Copy the certificate. OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide 3
4 WatchGuard Technologies, Inc.
Configure Your OneLogin Portal To import the information from the WatchGuard Web UI and to get the IdP Metadata URL: 1. Log in to your OneLogin account. 2. Select Apps > Add Apps. 3. In the search text box, type SAML Test Connector. A list of connector options appears. 4. Select SAML Test Connector (IDP) w/encrypt signed assertions. 5. On the Configuration page, in the Display Name text box, type a descriptive name for this configuration. 6. To enable your users to see the configuration in the portal, select Visible in portal. Select an icon option: Rectangular Icon Square Icon OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide 5
7. Click Save. 8. To create a group for users, select Users > Groups > New Group. 9. In the Group Security Policy text box, type a descriptive name for the group. 10. From the Security Policy drop-down list, select Default policy. 11. Click Save. 12. To add a user in OneLogin, select Users > All Users > New User. 6 WatchGuard Technologies, Inc.
13. In the Groups section, from Group drop-down list, select the group you created. 14. Click Save User. 15. Select Users > All Usersand select the user you created. 16. Select the Authentication tab. 17. From the User Security Policy drop-down list, select Default policy. OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide 7
18. Select the Applications tab. 19. Verify the SAMLTest Connector appears in the Applications list. 20. Select the SAML Test Connector application. The Edit SAML Test Connector appears. 21. To enable users to sign in, select the Allow user to sign in check box. 22. Verify that the NameID is the email address of the user you created. 8 WatchGuard Technologies, Inc.
23. Click Save 24. Click Save User. SAML Configuration in OneLogin App 1. Select Apps > Company Apps. 2. Select the Configuration tab. 3. Specify these settings: RelayState Leave blank. Audience https://<your host name>/auth/saml The label in the Access Portal pages is SAML Entity ID. Recipient https://<your host name>/auth/saml/acs The label in the Access Portal pages is Assertion Consumer Service (ACS) URL. ACS (Consumer) URL Validator https://<your host name>/auth/saml/acs The label in the Access Portal pages is Assertion Consumer Service (ACS) URL. ACS (Consumer) URL: https://<your host name>/auth/saml/acs The label in the Access Portal pages is Assertion Consumer Service (ACS) URL. OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide 9
Single Logout URL https://<your host name>/saml/sls 4. In the Public Key text box, paste the certificate you copied from the WatchGuard SAML 2.0 Configuration for WatchGuard Access Portal. 5. Select the Parameters tab. 6. In the Credentials are section, select Configured by admin or Configured by admins and shared by all users based on your company's credential policy. 7. Vericy that the NameID setting is Email. 10 WatchGuard Technologies, Inc.
8. Select the SSO tab. 9. Save a copy of the Issuer URL. You will add this URL in the SAML configuration under the IdP Metadata URL. 10. From the SAML Signature Algorithm drop-down list, select SHA-256. 11. To enable assumed sign-in, select the Allow assumed users to sign into this app check box. 12. Click Save. OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide 11
Complete the WatchGuard SAML Setup From Fireware Web UI: 1. Select Subscription Services > Access Portal. 2. Select the User Connection Settings tab. 3. Select Configure > SAML. 4. In the IdP Metadata URL text box, paste the Issuer URL you copied from the OneLogin setup. 5. Click Save. Test the Integration Now you can test the integration with the group name you created. From Fireware Web UI: 1. Select Authentication > Users and Groups. 2. Click Add. The Add User or Group page appears. 3. Type the the Name and Description of the group. 4. From the Authentication Server drop-down list, select the authentication server where the user or group exists. 12 WatchGuard Technologies, Inc.
5. Click OK. The Users and Groups page appears. 6. Click Save. 7. To add an RDP Host to the Access Portal, select Subscription Services > Access Portal. 8. Click Add. Select the Host Desktop Access (RDP). The RDP Host page appears. 9. From the Authentication Server drop-down list, select the name of the SAML configuration. 10. From the Type drop-down list, select Group. 11. In the Name text box, type the name of the group you created. OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide 13
After you have completed these configuration steps, users in the group you added can sign in to either the OneLogin account or to a resource configured with OneLogin Single Sign-On. 1. Type the URL for the portal in this format: https://<host name>. The Log In page appears with the name of the SAML portal you configured at the top of the page. 2. To log in, click the name of the SAML portal. In this example, click MY_ONELOGIN. The user can now get access to the resource. 14 WatchGuard Technologies, Inc.
About This Guide Guide Type Documented Integration WatchGuard or a Technology Partner has provided documentation demonstrating integration. Guide Details WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product. Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc. Guide revised: 1/16/2018 Copyright, Trademark, and Patent Information Copyright 1998 2018 WatchGuard Technologies, Inc. All rights reserved. All trademarks or trade names mentioned herein, if any, are the property of their respective owners. Complete copyright, trademark, patent, and licensing information can be found in the Copyright and Licensing Guide, available online at http://www.watchguard.com/wgrd-help/documentation/overview. About WatchGuard WatchGuard Technologies, Inc. is a global leader in network security, providing best-in-class Unified Threat Management, Next Generation Firewall, secure Wi-Fi, and network intelligence products and services to more than 75,000 customers worldwide. The company s mission is to make enterprisegrade security accessible to companies of all types and sizes through simplicity, making WatchGuard an ideal solution for Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visit WatchGuard.com. For additional information, promotions and updates, follow WatchGuard on Twitter, @WatchGuard on Facebook, or on the LinkedIn Company page. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them at www.secplicity.org. Address 505 Fifth Avenue South Suite 500 Seattle, WA 98104 Support www.watchguard.com/support U.S. and Canada +877.232.3531 All Other Countries +1.206.521.3575 Sales U.S. and Canada +1.800.734.9905 All Other Countries +1.206.613.0895 OneLogin SAML Authentication with WatchGuard Access Portal Integration Guide 15