OpenVPN® with SAML Authentication on OneLogin IdP

Overview

This guide provides an example on how to configure Aviatrix to authenticate against a OneLogin IdP. When SAML client is used, your Aviatrix controller acts as the Identity Service Provider (ISP) that redirects browser traffic from client to IdP (e.g., OneLogin) for authentication.

Pre-Deployment Checklist

Before configuring SAML integration between Aviatrix and OneLogin, make sure the following is completed:

  1. Aviatrix Controller is setup and running.
  2. Have a valid OneLogin account with admin access.
  3. Download and install the Aviatrix SAML VPN client.

Aviatrix Controller

If you haven’t already deployed the Aviatrix controller, follow the Controller Startup Guide.

OneLogin Account

A valid OneLogin account with admin access is required to configure the integration.

Aviatrix VPN Client

All users must use the Aviatrix VPN client to connect to the system. Download the client for your OS here.

Configuration Steps

Follow these steps to configure Aviatrix to authenticate against your OneLogin IDP:

  1. Create a OneLogin SAML App for Aviatrix
  2. Create a SAML Endpoint in the Aviatrix Controller

OneLogin SAML App

Before you start, pick a short name to be used for the SAML application name. In the notes below we will refer to this as aviatrix_onelogin. But it can be any string.

We will use the string you select for the SAML application name to generate a URL for OneLogin to connect with Aviatrix. This URL is defined below as SP_ACS_URL. This URL should be constructed as:

https://<your controller ip or host name>/flask/saml/sso/<aviatrix_onelogin>

Tip

Replace <your controller ip or host name> with the actual host name or IP address of your controller and <aviatrix_onelogin> with the string you chose to refer to the SAML application.

  1. Login to OneLogin as an administrator

  2. Add a new App (Apps* > **Add Apps)

    imageOLAddAppsMenu

  3. Search for SAML Test Connector

    imageOLNewAppSearch

  4. Select SAML Test Connector (IdP)

  5. Enter the Configuration values and click Save

    imageOLNewAppStep1

    You can download the rectangular image from here and the square image from here.

  6. Click on Configuration tab

  7. Enter the values

    Field Value
    RelayState Blank
    Audience SP_ACS_URL
    Recipient SP_ACS_URL
    ACS (Consumer) URL Validator SP_ACS_URL
    ACS (Consumer) URL SP_ACS_URL
    Single Logout URL Blank

  8. Click Save

  9. Click on the Parameters tab

  10. Add the following custom parameters (case sensitive)

    Field Value Flags
    Email Email Include in SAML assertion
    FirstName First Name Include in SAML assertion
    LastName Last Name Include in SAML assertion

    imageOLNewAppParams

  11. Optionally, add a field to map to the profile in Aviatrix

    Field Value Flags
    Profile (User Defined) Include in SAML assertion

  12. Click Save

  13. Click on SSO tab

  14. Note the Issuer URL for the next step.

Aviatrix Controller SAML Endpoint

  1. Login to your Aviatrix Controller

  2. Expand OpenVPN, select Advanced in the navigation menu

  3. Go to the SAML tab

  4. Click + Add New button

  5. Follow the table below for details on the fields in the table:

    Field Description
    Endpoint Name Pick
    IPD Metadata Type URL
    IDP Metadata Text/URL Paste in the Issuer URL obtained from the OneLogin app.
    Entity ID Select Hostname
    Custom SAML Request Template Unchecked

    imageAvtxSAMLEndpoint

Test the Integration

You can quickly validate that the configuration is complete by clicking on the Test button next to the SAML endpoint.

imageAvtxTestSAML

Create a VPN User

  1. Log in to the Aviatrix Controller
  2. Click OpenVPN® in the left navigation menu
  3. Select VPN Users
  4. Click + Add New
  5. Select the VPC ID and LB/Gateway Name for your SAML Gateway
  6. Enter a name in the User Name field
  7. Enter any valid email address in the User Email field (this is where the cert file will be sent). Alternatively, you can download the cert if you do not enter an email address.
  8. Select the SAML Endpoint
  9. Click OK

Validate

  1. Log in to the Aviatrix Controller
  2. Click OpenVPN® in the left navigation menu
  3. Select VPN Users
  4. Download the configuration for your test user created in the previous step
  5. Open the Aviatrix VPN Client application
  6. Click Load Conf and select the file downloaded
  7. Click Connect