Revspire Resources

OneLogin Connection

Connect Revspire to OneLogin for SAML 2.0 single sign-on. OneLogin connector labels and available signing options vary by edition, so verify that the selected connector can sign both the response and assertion.

Before You Start

  • OneLogin administrator access.
  • An active Revspire Deal Room entitlement and access to Revspire > Setup > SSO.
  • View SSO Settings, View SAML SP Certificate, and Create SSO Providers permissions.
  • An active, licensed Revspire test user with a username or email that will match the OneLogin parameter mapping.

Step 1: Copy Revspire SP Values

ACS URL = <copy from Revspire>
SP Entity ID = <copy from Revspire>
SP Signing Certificate = <download or copy from Revspire>
SP Cert SHA256 Fingerprint = <copy from Revspire>

Do not configure the Revspire SP Login URL or SP Logout URL as OneLogin SAML endpoints.

Step 2: Add the Advanced SAML Connector

Path: OneLogin Administration > Applications > Applications > Add App

Search for Advanced SAML Custom Connector or SAML Custom Connector (Advanced). The catalog name can vary by OneLogin edition.

Step 3: Configure the SAML Service Provider

Open the connector’s Configuration tab and map:

OneLogin Field Label: Audience (EntityID)
Value: <Revspire SP Entity ID>

OneLogin Field Label: Recipient
Value: <Revspire ACS URL>

OneLogin Field Label: ACS (Consumer) URL
Value: <Revspire ACS URL>

OneLogin Field Label: ACS (Consumer) URL Validator
Value: exact-match regular expression for the Revspire ACS URL

Example only:
^https:\/\/tenant-api\.example\.com\/assert$

OneLogin Field Label: SAML initiator
Value: Service Provider

OneLogin Field Label: SAML nameID format
Value: Persistent

OneLogin Field Label: SAML issuer type
Value: Specific

OneLogin Field Label: SAML signature element
Value: Both / Response and Assertion

OneLogin Field Label: SAML Signature Algorithm
Value: SHA-256

Assertion encryption
Value: disabled

Revspire requires both the top-level SAML Response and the Assertion to be signed with RSA-SHA256/SHA-256. If the connector only offers Response or Assertion and has no option to sign both, it does not meet Revspire’s signing requirement; choose a capable connector or contact OneLogin. Never use a wildcard ACS URL Validator in production.

Step 4: Configure Identity Parameters

On the connector’s Parameters tab, choose an immutable, non-reassigned OneLogin identifier as NameID. Use the connector’s internal OneLogin user ID when available.

NameID value = <immutable OneLogin user identifier>

Parameter name = revspire_username
Include in SAML assertion = enabled
Value = <OneLogin field that exactly matches the Revspire username>

Parameter name = email
Include in SAML assertion = enabled
Value = Email

At least one bootstrap parameter must exactly and uniquely match an existing Revspire user on first login.

Step 5: Trust Revspire Signed Requests

Where the connector exposes signed-request verification, upload the Revspire SP signing certificate and compare its SHA-256 fingerprint. Leave assertion encryption disabled.

Step 6: Copy OneLogin IdP Values

Open the connector’s SSO tab and copy:

OneLogin Issuer URL = <paste into Revspire Issuer Entity ID>
OneLogin SAML 2.0 Endpoint (HTTP) = <paste into Revspire SSO URL>
OneLogin X.509 Certificate = <paste active certificate in PEM format>
OneLogin IdP logout endpoint = <optional; only if supplied>

Step 7: Add the OneLogin Provider in Revspire

Path: Revspire > Setup > SSO > Add

Provider Type = One Login
Provider Display Name = OneLogin
Issuer Entity ID = <OneLogin Issuer URL>
SSO URL (IdP Login URL) = <SAML 2.0 Endpoint (HTTP)>
IdP SLO URL (Optional) = <OneLogin IdP logout endpoint, if supplied>
X.509 Certificate = <active OneLogin signing certificate>
Set as Primary Provider = enabled for the controlled login test when this is not the first provider

The first provider becomes primary automatically. When multiple providers exist, only the primary provider handles normal Revspire-initiated login.

Step 8: Assign and Test

  1. Assign one pre-provisioned test user to the OneLogin application.
  2. Start at the Revspire login page and choose Sign In with SSO after resolving the account.
  3. Confirm the first login creates the expected immutable binding, then test a second user and logout.
  4. Keep SSO optional until testing succeeds. Do not rely on a OneLogin app tile unless IdP-initiated SAML has been deliberately enabled for your deployment.

Certificate Rollover

Add the replacement OneLogin signing certificate to the existing Revspire provider before OneLogin activates it. Test after the switch, then deactivate the old certificate in Revspire.

Troubleshooting

  • Invalid ACS: verify Recipient, ACS URL, and the exact-match ACS URL Validator.
  • User not found or ambiguous: verify a bootstrap claim matches exactly one active, licensed Revspire user.
  • Signature validation: verify the connector signs both response and assertion and that Revspire holds the active OneLogin certificate.
  • Unsolicited response: start from Revspire; IdP-initiated login is disabled by default.

For lifecycle provisioning, continue with OneLogin SCIM Provisioning.