> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OneLogin

> Connect ThreatAware to OneLogin for identity and access management visibility

## Overview

The OneLogin integration enables ThreatAware to connect with your OneLogin identity platform to collect authentication and access management data, helping you validate identity controls and monitor access patterns across your organisation.

<Info>
  **Connection Method**: API
  **Setup Time**: 10 minutes
  **Access Required**: OneLogin Administrator account
</Info>

## Data collected

The OneLogin integration provides:

* User authentication events
* Access management policies
* Identity security indicators
* MFA and authentication data

## Use cases

<CardGroup cols={2}>
  <Card title="Identity Monitoring" icon="shield">
    Track authentication patterns and user access events
  </Card>

  <Card title="Access Validation" icon="key">
    Verify identity controls are properly configured
  </Card>

  <Card title="Security Compliance" icon="clipboard-check">
    Monitor identity-based security controls for compliance
  </Card>

  <Card title="Audit Support" icon="file-contract">
    Generate reports on authentication and access management
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to ThreatAware">
    Navigate to your ThreatAware dashboard and go to **Settings → Integrations**.
  </Step>

  <Step title="Find and Connect OneLogin">
    * Use the search bar to locate **OneLogin**
    * Click **Connect** - a pop-up window will appear with configuration options
  </Step>

  <Step title="Determine Your API Region">
    * OneLogin operates multiple API regions such as `api.eu.onelogin.com`
    * Contact OneLogin Support to confirm your organisation's API region
    * Note the region for the next steps in ThreatAware
  </Step>

  <Step title="Generate API Credentials">
    * Log in to your **OneLogin Admin console**
    * Click **Developers** in the top navigation bar
    * Go to the **API Credentials** page
    * Click the **New Credential** button
    * Provide a suitable name (e.g., "ThreatAware Integration")
    * Select **Manage all** for permissions
    * Click **Save**
    * Copy the **Client ID** and **Client Secret** that are displayed
    * Click **Done**
  </Step>

  <Step title="Configure in ThreatAware">
    In the ThreatAware pop-up window, enter:

    * **Client ID**: The Client ID from OneLogin
    * **Client Secret**: The Client Secret from OneLogin
    * **API Region**: The API region (e.g., `api.eu.onelogin.com`)
    * Click **Authorize** to establish the connection
  </Step>

  <Step title="Verify Connection">
    * Check the systems list to verify OneLogin status shows as **Active**
    * Data collection will begin within 1 hour
    * Monitor the integration status in **Settings → Integrations**
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Client ID" icon="user">
    **Field Name**: OneLogin Client ID
    **Type**: String
    **Description**: The unique identifier for your OneLogin API application

    This is generated in the OneLogin Admin console under API Credentials.
  </Accordion>

  <Accordion title="Client Secret" icon="lock">
    **Field Name**: OneLogin Client Secret
    **Type**: Password (encrypted)
    **Description**: The secret key used to authenticate API requests to OneLogin

    <Tip>
      Store this credential securely in your organisation's password manager for future reference.
    </Tip>
  </Accordion>

  <Accordion title="API Region" icon="server">
    **Field Name**: OneLogin API Region
    **Type**: String
    **Description**: The regional API endpoint for your OneLogin instance

    **Examples**:

    * `api.eu.onelogin.com` (Europe)
    * `api.us.onelogin.com` (United States)
    * Contact OneLogin Support to confirm your region
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm OneLogin shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 60 minutes for the initial data poll
   * Check for OneLogin events in your device or user records

3. **Test Queries**
   * Create a test query to filter data by OneLogin authentication events
   * Verify the data matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Client ID** and **Client Secret** are correct
    * Ensure credentials were copied completely without extra spaces
    * Check that the credentials have not expired in OneLogin
    * Verify the API Region is correct for your OneLogin instance
  </Accordion>

  <Accordion title="API Region Not Found" icon="map">
    **Symptoms**: Integration fails when validating the API region

    **Solutions**:

    * Contact OneLogin Support to confirm your organisation's API region
    * Verify the region format (e.g., `api.eu.onelogin.com`)
    * Check that the region is accessible from ThreatAware infrastructure
  </Accordion>

  <Accordion title="Permission Denied" icon="ban">
    **Symptoms**: Integration connects but fails to retrieve data

    **Solutions**:

    * Verify the API credentials were created with **Manage all** permissions
    * Check that the OneLogin account has not been revoked or disabled
    * Ensure the API credentials have not expired
    * Regenerate credentials if needed and update ThreatAware
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no data appears

    **Solutions**:

    * Verify there is authentication data in OneLogin to collect
    * Check API rate limits haven't been exceeded
    * Review ThreatAware integration logs (contact support if needed)
    * Confirm the connection status remains **Active**
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="OneLogin API Documentation" icon="book" href="https://developers.onelogin.com/">
    Official OneLogin API documentation for detailed setup and permissions
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **API Credential Security**

  * Create a dedicated API credential for ThreatAware integration
  * Store credentials securely in your organisation's password manager
  * Rotate API credentials annually or per your security policy
  * Monitor OneLogin logs for API usage activity
</Tip>

<Tip>
  **Integration Maintenance**

  * Regularly verify the integration status remains active
  * Test the connection periodically to ensure uninterrupted data flow
  * Review OneLogin audit logs for any suspicious API activity
  * Keep credentials updated if OneLogin access policies change
</Tip>