# OneLogin SSO

## Overview

Panther supports integrating with OneLogin as a SAML provider to enable logging in to the Panther Console via SSO.

For more information on features, terminology, and limitations of SSO integrations with the Panther Console, see [Identity & Access Integrations](https://docs.panther.com/system-configuration/saml).

## How to configure SAML SSO to the Panther Console with OneLogin

### Step 1: Obtain the OneLogin SSO parameters from Panther

1. Log in to the Panther Console.
2. In the upper-right corner, click the gear icon, and then click **General**.
3. Navigate to the **Identity & Access** tab.
4. Next to **Enable SAML (Security Assertion Markup Language)**, set the toggle to `ON`.
5. If using [IdP-initiated login](https://docs.panther.com/system-configuration/saml/..#idp-initiated-vs.-sp-initiated-login), set the **Use IdP-Initiated Single Sign On (SSO)** toggle to `ON`.
6. Copy the the **Audience** and **ACS Consumer URL** values and store them in a secure location. You will need them in the following steps.
   * If using IdP-initiated login, also copy the **Relay State** value.

{% hint style="info" %}
It's recommended to use [SP-initiated login](https://docs.panther.com/system-configuration/saml/..#sp-initiated-login-recommended), as it is generally considered more secure than IdP-initiated login.
{% endhint %}

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-800628a71753e4ef33d50d9bbf9231f05441120b%2FScreenshot%202025-10-10%20at%203.03.25%E2%80%AFPM.png?alt=media" alt="In the Settings section of the Panther Console, within the Identity &#x26; Access tab, various fields like &#x22;Enable SAML&#x22;, &#x22;Audience&#x22; and &#x22;ACS Consumer URL&#x22; are shown"><figcaption></figcaption></figure>

### Step 2: Create the OneLogin App

1. Log in to the OneLogin administrative console.
2. Click the **Applications** tab. In the drop-down menu, click **Applications**.
3. In the upper-right side of the page, click **Add App**. Search for and select **SAML Custom Connector (Advanced)**.

   <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-4d625c3853acdce44a6257d032d9891ca55547f9%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>
4. Fill in the form:
   * **Display Name**: Add a descriptive name, such as "Panther Console."
   * **Logo Icon**: Upload a Panther logo to help users quickly identify this app.
   * **Description**: Add a description of the app.
5. Click **Save**.
6. Open your new app's **Configuration** page. Under **Application Details**, enter the following:
   * **Audience**: Enter the **Audience** value you copied from the Panther Console in Step 1.
   * **Recipient**: Enter the **ACS URL** value you copied from the Panther Console in Step 1.
   * **ACS (Consumer) URL Validator**: Enter the **ACS URL** value you copied from the Panther Console in Step 1.
   * **ACS (Consumer) URL**: Enter the **ACS URL** value you copied from the Panther Console in Step 1.
   * **Relay State:** If using IdP-initiated login, paste the **Relay State** value you copied from the Panther Console in Step 1. If using SP-initiated login, leave this value blank.
7. In the Parameters tab, add the attribute mappings for Panther. Check the box next to "Include in SAML assertion" for each attribute.

   * `PantherFirstName`: `First Name`
   * `PantherLastName`: `Last Name`
   * `PantherEmail`: `Email`

   When you are done, they will appear in the attributes list:

   <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-40223e1e4d977ab5480c4c8b2df32aa264807e9c%2Fonelogin4%20(8)%20(8)%20(9)%20(5).png?alt=media" alt=""><figcaption></figcaption></figure>
8. Click **Save**.
9. In the SSO tab, set the algorithm to **SHA-512**.
10. Copy the **Issuer URL** and store it in a secure location. You will need this in the next steps.

    <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-705cd784123629b9a3d48c4509ca1a455fffcff3%2Fonelogin5%20(8)%20(8)%20(9)%20(6).png?alt=media" alt=""><figcaption></figcaption></figure>
11. Save your settings.

After you're done, make sure to grant access to the appropriate users and groups.

### Step 3: Configure OneLogin SAML in Panther

1. Navigate back to the **Identity & Access** section in the Panther Console from Step 1. In the **Default Role** field, choose the Panther role that your new users will be assigned by default when they first log in via SSO.

{% hint style="warning" %}
Panther highly recommends not setting this value to `Admin`.
{% endhint %}

2. In the **Identity Provider URL** field, paste the **Issuer URL** from OneLogin that you obtained in the previous steps of this documentation.
3. Click **Save Changes**.

To test your setup, go to your Panther sign-in page and click **Login with SSO**.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-5e5aa7beb6e3547f6c0d323432359430390a0067%2Fpanther-login-sso%20(6)%20(1).png?alt=media" alt="The Panther login page displays a &#x22;Login with SSO&#x22; button at the bottom."><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.panther.com/system-configuration/saml/onelogin.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.