About OneLogin Trusted IdPs
The OneLogin Trusted IdP (TIdP) feature is also known as inbound federation. With it, an admin can add an external identity provider as one of the “spokes” of a OneLogin tenant, over SAML, OAuth, or OpenID Connect. You can add a Trusted IdP as an additional factor. It does not replace the current sign-in. This is why it is good for identity verification. Employees continue to sign in to OneLogin as they do today, and Persona verification is an added step-up check for that TIdP.
Persona is an OpenID Connect (OIDC) identity provider. Thus, your OneLogin administrator can require a live identity verification before an employee signs in. This helps to protect your workforce against social engineering, deepfakes, and account takeover at the most important moments.
Configure the Authentications product feature to get the client ID and client secret that you use below.
OneLogin Configuration Guide
Do the steps below to configure Persona OIDC as a Trusted IdP in OneLogin.
1. Configure the Persona authentication template
In the Persona Dashboard, create an authentication template with these settings:
- Allowed redirect URIs: The return URL of your OneLogin tenant,
https://<your-subdomain>.onelogin.com/access/idp. Your subdomain is in the OneLogin URL of the tenant. - Token endpoint authentication method: Client secret basic, unless your OneLogin configuration specifies a different method.
- PKCE: Optional. Persona recommends that you enable it when it is supported.
2. Add Persona as a Trusted IdP in OneLogin
In the OneLogin admin portal, go to:
- Authentication > Trusted IdPs
- Select New Trust.
Give the trust a name (for example, “Persona”). Set Protocol Type to OIDC, and check Enable Trusted IDP. In the OIDC configuration fields, enter the values from your Persona authentication template:
- Issuer:
https://authenticate.withpersona.com/authenticate/oidc - Client ID: The Client ID from your Persona authentication template
- Client Secret: The Client Secret from your Persona authentication template
- Authentication Endpoint (the label is sometimes Authorization Endpoint):
https://authenticate.withpersona.com/authenticate/oidc/authorize - Token Endpoint:
https://authenticate.withpersona.com/authenticate/oidc/token
These values are also on the Persona OIDC discovery endpoint:
https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configurationTo test with your sandbox environment, use this configuration instead: Openid Configuration
For the exact field names in the Trusted IdP setup screen, use the OneLogin documentation. These names changed between OneLogin releases.
3. Require the Trusted IdP as a sign-in factor
Under Security > Policies, edit the policy that applies to the users that you want to verify. Add the Persona Trusted IdP as a required authentication factor. First, assign the policy to a test group. After you confirm that the flow works, assign it to more users.
4. Configure Persona Marketplace Integration for Employee Data
Persona needs API access to your OneLogin account to compare the verification result with the OneLogin profile of the employee. The Persona OneLogin Marketplace integration can get the profile attributes of the employee, for example their name. Persona compares these attributes with their government ID.
- Use the OneLogin integration guide to add your OneLogin API credential in the Persona Dashboard.
- Notify your Persona account team so they can finalize setup and enable profile comparison.
5. Test the integration
- Sign in to OneLogin as a user that the policy from step 3 applies to.
- When OneLogin tells you, complete the Persona identity verification.
- After verification passes, make sure that you are signed in to OneLogin.
Related resources
- OneLogin integration overview
- How to configure Persona Authentications with OpenID Connect
- OneLogin: Configuring Trusted IdP (Relying Party Trust)
Plans Explained
OneLogin Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| OneLogin Integration | Not Available | Not Available | Limited | Available |