> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OneLogin integration setup

> Connect OneLogin to Living Security for user lifecycle, authentication, MFA, and administrative activity.

export const EgressIpAllowlistBothSets = ({system}) => <Warning>
    <strong>{system} needs two sets of addresses, not one.</strong> Living Security mints this
    integration's access token on its own infrastructure and refreshes it continuously, so setup
    traffic and sync traffic leave from different networks. Allowlist both sets in {system}, and
    keep both in place — this is not a setup-only requirement.
    <br />
    <br />
    <strong>Integration sync traffic</strong> — the same in every region:
    <br />
    <code>52.34.139.153/32</code>, <code>54.69.127.183/32</code>, <code>44.247.133.183/32</code>,{' '}
    <code>52.26.211.56/32</code>
    <br />
    <br />
    <strong>Platform traffic</strong> — use only the row for the region that hosts your
    organization:
    <br />
    United States: <code>98.91.60.249/32</code>, <code>13.216.91.102/32</code>
    <br />
    European Union: <code>34.246.236.210/32</code>, <code>52.31.102.238/32</code>
    <br />
    <br />
    Allowlist only the sync set and setup never completes. Allowlist only the platform set and
    setup succeeds while every sync fails. See{' '}
    <a href="/integrations/managing/egress-ip-addresses">
      Configuring Integration Egress IP Addresses
    </a>{' '}
    for both failure signatures and the change policy.
  </Warning>;

export const PublicIntegrationNextSteps = () => <>
    <hr />
    <h2>Related resources</h2>
    <ul>
      <li>
        <a href="/signals/data-sources">Learn how integration data becomes Human Risk Management signals</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/integrations">Explore Living Security integrations</a>
      </li>
      <li>
        <a href="https://app.livingsecurity.ai/">Open the Living Security Platform</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/request-demo/">Request a Living Security demo</a>
      </li>
    </ul>
  </>;

export const ConnectInPlatform = ({tile, children}) => <Step title="Enter the credentials in the Living Security Platform">
    <p>
      Completed by whoever holds Living Security access — the program owner, or the system
      admin if they've been invited (delegated setup).
    </p>
    <ol>
      <li>
        Go to <strong>Settings → Integrations → Catalog</strong>, find the{' '}
        <strong>{tile}</strong> tile, click <strong>Connect</strong>.
      </li>
      <li>
        Fill in the fields below, then click <strong>Connect</strong>.
      </li>
    </ol>
    {children}
  </Step>;

export const SystemAdminBanner = ({system, recommendDelegated}) => <Note>
    <p>
      <strong>This guide is for your {system} administrator.</strong> It covers creating API
      credentials inside {system}, which requires admin access to {system} — not to the
      Living Security Platform.
    </p>
    <p>
      If you're the Living Security <strong>program owner</strong> and don't administer {system},
      send this page to whoever does. They complete Part A and hand the credentials back to you
      (or enter them directly if you've invited them into the platform).
      {recommendDelegated && <>
          {' '}Because setup produces sensitive key material, we recommend the{' '}
          <strong>delegated setup</strong> path so the secret is never sent back to you.
        </>}
    </p>
  </Note>;

<SystemAdminBanner system="OneLogin" recommendDelegated={true} />

## What this integration contributes

OneLogin can contribute normalized user lifecycle, authentication, MFA, and administrative activity. Reviewed examples include:

* `mfa.success` — completes MFA challenges
* `mfa.failed` — fails MFA challenges
* `account.locked` — account locked

See [how integration data becomes signals](/signals/data-sources).

## What Living Security needs

| Credential           | Description                                                                               |
| -------------------- | ----------------------------------------------------------------------------------------- |
| **Client ID**        | The client ID of a OneLogin API credential pair with permission to read users and events. |
| **Client secret**    | That credential pair's client secret.                                                     |
| **Tenant subdomain** | The value before `.onelogin.com` in your OneLogin tenant URL.                             |

## Setup

<Steps>
  <Step title="Create API credentials in OneLogin">
    As an account owner or administrator, open **Developers → API Credentials**, create a dedicated credential, and select a scope that can read users and events. Store the client ID and secret securely.
  </Step>

  <ConnectInPlatform tile="OneLogin">
    Enter the tenant subdomain, client ID, and client secret, then connect.
  </ConnectInPlatform>
</Steps>

Living Security exchanges the credential pair for an access token and renews it
before it expires, so there is no token for you to generate or rotate. Rotate the
credential pair itself on your usual schedule and reconnect the tile afterwards.

## Verify and troubleshoot

Verify that the connection can read at least one user. Audit events may be empty when the tenant has no recent activity.

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    The client ID or client secret is wrong, or the credential pair was deleted in OneLogin. Confirm the pair still exists under **Developers → API Credentials**, then reconnect with the current values.
  </Accordion>

  <Accordion title="403 Forbidden">
    Recreate the API credential with permission to read OneLogin resource APIs, users, and events.
  </Accordion>

  <Accordion title="The tenant cannot be reached">
    Enter only the tenant subdomain, not a full URL and not the administrative display name.

    If the subdomain is correct and the tenant still cannot be reached, check whether OneLogin restricts API access by source IP address in your account. This integration needs **two** sets of addresses allowlisted, because Living Security mints the access token itself and renews it continuously — so token requests and scheduled syncs leave from different networks.

    <EgressIpAllowlistBothSets system="OneLogin" />
  </Accordion>
</AccordionGroup>

For vendor-side details, see [OneLogin's API credential guide](https://developers.onelogin.com/api-docs/2/getting-started/working-with-api-credentials).

<PublicIntegrationNextSteps />