--- title: OneLogin Configuration slug: kronpam-reference-guide-3-9-0/onelogin-configuration description: Learn how to configure OneLogin and Kron PAM for SAML authentication with this comprehensive guide. Discover the step-by-step instructions for adding Kron PAM as an application in OneLogin, along with essential configurations for Kron PAM. Additionally, g docTags: createdAt: 2022-12-23T08:43:03.000Z --- First, you need to add Kron PAM to OneLogin as an application. To add Kron PAM as an application, perform the following configuration steps in OneLogin: 1. Go to the** Applications** section in OneLogin. 2. Click **Add App** and search for SAML Custom Connector (Advance). 3. Enter a display name (such as "Kron PAM") and then click **Save**. 4. Navigate to the **Configuration** tab of the created Kron PAM App. 5. Enter the following parameters related to Kron PAM. 6. The following parameters are required, but there are more optional parameters in OneLogin. :::hint{type="info"} The Email (SAML NameID) should be the same as the Kron PAM username. "10.10.10.10" represents the Kron PAM address. ::: | **Parameter Name** | **Kron PAM Parameter** | | ---------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | **Audience (EntityID)** | [https://10.10.10.10/aioc-rest-web/servlet/saml/samlCheck](https://10.10.10.10/aioc-rest-web/servlet/saml/samlCheck) | | **Recipient** | [https://10.10.10.10/login-ui/samlRecipient](https://10.10.10.10/login-ui/samlRecipient) | | **ACS (Consumer) URL Validator\*** | .\* | | **ACS (Consumer) URL\*** | [https://10.10.10/login-ui/samlRecipient](https://10.10.10/login-ui/samlRecipient) | | **Single Logout URL** | [https://10.10.10.10/login-ui/samlLogout](https://10.10.10.10/login-ui/samlLogout) | - After saving the configurations above, go to the **SSO **tab of the added application to extract some information for filling the Kron PAM SAML configuration. | **Parameter Name** | **Example Value** | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Issuer URL** | [https://app.onelogin.com/saml/metadata/2e0421c6-f623-4f9f-XXXX-YYY](https://app.onelogin.com/saml/metadata/2e0421c6-f623-4f9f-XXXX-YYY) | | **SAML 2.0 Endpoint (HTTP)** | [https://single.onelogin.com/trust/saml2/http-post/sso/2e0421c6-f623-4f9f-XXXX-YYY](https://single.onelogin.com/trust/saml2/http-post/sso/2e0421c6-f623-4f9f-XXXX-YYY) | | **SLO Endpoint (HTTP)** | [https://single.onelogin.com/trust/saml2/http-redirect/slo/1708XXX](https://single.onelogin.com/trust/saml2/http-redirect/slo/1708XXX) | | **X.509 Certificate** | *-----BEGIN CERTIFICATE-----*
*MIIEMjCCAxqgAwIBAgIUG2HXQgRMpy/pUehFqTqzw0YaelAwDQYJKoZIhvcNAQEF*
*BQAwYTEsMCoGA1UECgwjS3JvbiBUZWxla29tdW5pa2FzeW9uIEhpem1ldGxlcmkg*
*QXMxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEaMBgGA1UEAwwRT25lTG9naW4gQWNj*
*hkQm6mlNsRnfCipDrtz1lqf2VKgc9g==*
*-----END CERTIFICATE-----* | After adding Kron PAM as an application in OneLogin, you need to set additional configurations in Kron PAM. **Step 1**: Define the required parameters in Kron PAM. 1. Navigate to **Administration **> **System Config. Man**. 2. Open the **SAML Config** tab. 3. Fill in the following parameters related to OneLogin: | **Parameter Name** | **Description** | **Example Value** | | --------------------------------- | ---------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Enable SAML** | It must be enabled to use SAML authentication. | | | **SAML Entity ID** | SAML Test Connector **Issuer UR**L from the OneLogin Portal. | [https://app.onelogin.com/saml/metadata/2e0421c6-f623-4f9f-XXXX-YYY](https://app.onelogin.com/saml/metadata/2e0421c6-f623-4f9f-XXXX-YYY) | | **SAML Logout URL** | SAML Connector **SLO Endpoint (HTTP) URL** from the OneLogin Portal | [https://single.onelogin.com/trust/saml2/http-redirect/slo/1708XXX](https://single.onelogin.com/trust/saml2/http-redirect/slo/1708XXX) | | **SAML Remote URL** | **Personal Portal URL** | ****[https://single.onelogin.com/portal](https://single.onelogin.com/portal)**** | | **SAML Login URL** | SAML Connector **SAML 2.0 Endpoint (HTTP) URL** from the OneLogin Portal | [https://single.onelogin.com/trust/saml2/http-post/sso/2e0421c6-f623-4f9f-XXXX-YYY](https://single.onelogin.com/trust/saml2/http-post/sso/2e0421c6-f623-4f9f-XXXX-YYY) | | **SAML X509 Cert. Key** | SAML Connector **X.509 Certificate** from the OneLogin Portal. | \*-----BEGIN CERTIFICATE-----
MIIEMjCCAxqgAwIBAgIUG2HXQgRMpy/pUehFqTqzw0YaelAwDQYJKoZIhvcNAQEF
BQAwYTEsMCoGA1UECgwjS3JvbiBUZWxla29tdW5pa2FzeW9uIEhpem1ldGxlcmkg
QXMxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEaMBgGA1UEAwwRT25lTG9naW4gQWNj
hkQm6mlNsRnfCipDrtz1lqf2VKgc9g==
\*-----END CERTIFICATE-----
| | **Enable Service Provider Login** | This aims to enable the Service Provider initiator for the Login Page. | | | **Service Provider Name** | If the Service Provider is enabled, the Provider Name must be filled as free text. | OneLogin | | **Icon File** | Service Provider Icon | *Upload a 64\*64 jpeg logo* | | **SAML Launcher URL** | Some IDPs can support this field to launch the application | Optional | ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ERUdqfPVhA1z75gScQV3t_image.png" size="70" caption="Figure - SAML Configurations Description of the figure" isUploading="false" width="640" height="858" darkWidth="640" darkHeight="858" showCaption="true"} **Step 2**: Add** TomcatCorsFilter **to the Tomcat configuration file. After setting the required configuration in Step 1, you need to** TomcatCorsFilter** in the tomcat configuration: - Open the web.xml file under the following directory. /pam/gui/conf - Find the **TomcatCorsFilter** part and add the **Onelogin** URL, as shown below in bold. :::BlockQuote \TomcatCorsFilter\ \org.apache.catalina.filters.CorsFilter\ \ \cors.allowed.origins\ \10.10.10.10,https\://single.onelogin.com\ \ :::