> For the complete documentation index, see [llms.txt](https://docs.gxc.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gxc.io/docs/application-notes/4g-and-5g-onyx-portal-integration-with-customer-idp.md).

# 4G & 5G Onyx Portal Integration with Customer IdP

## Introduction

There are two approaches to integrating a Customer IdP with the Onyx Portal:

1. Direct Integration — In this approach, the customer IdP is configured and integrated directly with Onyx Portal. All IdP-related configuration like entity ID, IdP metadata, Single Sign-On/Single Logout URLs, and certificates are configured directly in the Onyx Portal.
   1. Login
      1. Single Sign-On and Single Logout requests are directly redirected from Onyx Portal to the customer IdP.
      2. User is authenticated by customer IdP and SAML response is sent from the customer IdP to Onyx Portal.
   2. Logout
      1. Single Logout requests are directly redirected from Onyx Portal to the customer IdP.
      2. The logout request is validated by the customer IdP and the SAML response (if any) is sent from the customer IdP to Onyx Portal.
2. IdP-to-IdP SAML Proxying Integration — In this approach, the customer IdP is configured and integrated with the Onyx IdP. All IdP-related configurations such as entity ID, IdP metadata, Single Sign-On/Single Logout URLs, and certificates are configured in the Onyx IdP. The Single Sign-On and Single Logout requests are redirected from Onyx Portal to the Onyx IdP. Onyx IdP does target IdP discovery based on the RequestedAuthnContext in the SAML authentication request and redirects the Single Sign-On/Logout request to the target IdP.

{% hint style="info" %}
**NOTE:** We have chosen to integrate with customer IdPs in IdP Proxy configuration.
{% endhint %}

## IdP-to-IdP Integration Using SAML Proxying

<figure><img src="https://4071075005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZc9hpHmiTCrh1sn4mWXn%2Fuploads%2FzXklkEL4BFNtXHEwtHpZ%2Fimage.png?alt=media&amp;token=2032227c-4bc5-40ee-8e60-c67f6159fee1" alt=""><figcaption></figcaption></figure>

We can use SAML Proxying mechanism to integrate the authentication flows with other SAML2-compliant identity providers.

If a customer has a SAML2-compliant Identity Provider, the process of authenticating users will be delegated to the customer's IdP, instead of relying on Onyx IdP. The resulting assertion is used to generate the user's local username, which is then used in the standard Attribute Resolution process.

The Onyx IdP will become a Service Provider (SP) to the customer's IdP.

### Login Flow

#### Login via Customer IdP (Using SAML Proxying)

<figure><img src="https://4071075005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZc9hpHmiTCrh1sn4mWXn%2Fuploads%2FAj8Xj6nMWyivCB5cUIsl%2Fimage.png?alt=media&amp;token=aa828462-44b7-498c-9a95-1d3bd9b11735" alt=""><figcaption></figcaption></figure>

{% stepper %}
{% step %}
If the user is from a partner organization having its own IdP integrated with the Onyx Solution, the user should click the **Sign In to an Organization** link.

<figure><img src="https://4071075005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZc9hpHmiTCrh1sn4mWXn%2Fuploads%2F6lXcax3vVHNYAYsIk6Bc%2Fimage.png?alt=media&amp;token=04104d85-628e-4804-b46d-a3272ff415a2" alt="" width="426"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
The user enters his/her organization's name and clicks **Login**.

<figure><img src="https://4071075005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZc9hpHmiTCrh1sn4mWXn%2Fuploads%2FGJCflZjaR7grEdJYMCao%2Fimage.png?alt=media&amp;token=39cacb9c-a2f5-4b09-a1d6-b6109da61d68" alt="" width="426"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
The Onyx Portal backend generates an authentication request and sends it to the Onyx IdP's SSO URL. The authentication request passes the customer IdP's entityID in RequestedAuthnContext. This helps the Onyx IdP in doing an IdP discovery and proxy the request to the customer's IdP.

```
<samlp:RequestedAuthnContext Comparison="exact">
<saml:AuthnContextClassRef>[entityID of customer IdP]</saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>
```

{% endstep %}

{% step %}
The Onyx IdP receives the SAML authentication request. Based on the attributes (Tenant ID), it does IdP discovery. Onyx IdP maintains the tenant and target IdP mapping. Based on this mapping, the IdP discovery process identifies the entityID of the target IdP. The authentication request is proxied to the target IdP's SSO URL for SSO authentication.
{% endstep %}

{% step %}
The Customer IdP's login page is displayed, where the user enters his/her user ID/password and proceeds to login.
{% endstep %}

{% step %}
The Customer IdP authenticates the user.
{% endstep %}

{% step %}
On successful authentication, the Customer IdP does attribute resolution to generate the SAML authentication response. Onyx Portal expects the following attributes to be present in the SAML assertion to allow the user access to Onyx Portal.

{% code overflow="wrap" %}

```
email – User Email
onyxPortalRole – User Role
onyxPortalTenantId – User Organization
```

{% endcode %}
{% endstep %}

{% step %}
SAML response is generated and sent back to the Onyx IdP.
{% endstep %}

{% step %}
The Onyx IdP receives the SAML response. After attribute resolution and based on the attribute release policy it passes the required attributes in the SAML assertion to the Onyx Portal.
{% endstep %}

{% step %}
The Onyx Portal receives the SAML response from the Onyx IdP. It validates the SAML response and extracts the SAML attributes. The SAML attributes are validated and after all the validations have passed, it allows the user to access the Onyx Portal. The user is redirected to the Onyx Portal's Dashboard page.
{% endstep %}
{% endstepper %}

### User Profile

The Identity Provider shall configure the following user attributes in their user information directory/repository and release the same attributes in SAML assertion.

<table><thead><tr><th width="303">Attribute Name</th><th width="290">Description</th><th width="173">Example</th><th width="125">Mandatory</th></tr></thead><tbody><tr><td><code>mail</code> / <code>urn:oid:0.9.2342.19200300.100.1.3</code></td><td>Email ID of the subject. Not used as primary identifier; honored as long as Subject ID or IDM ID is present in the SAML assertion.</td><td>abc@example.com</td><td>Y</td></tr><tr><td><code>firstName</code> / <code>givenName</code></td><td>The user's first name.</td><td>Roger</td><td>N</td></tr><tr><td><code>lastName</code> / <code>sn</code></td><td>The user's last name.</td><td>Smith</td><td>N</td></tr><tr><td><code>onyxPortalTenantId</code></td><td>Tenant ID of the customer account in Onyx Portal. Communicated to the customer by GXC when the account is created.</td><td>CNH</td><td>C</td></tr><tr><td><code>onyxPortalRole</code></td><td>Role assigned to the user in Onyx Portal. One of: SUPER ADMIN, ADMIN, VIEWER.</td><td>ADMIN</td><td>C</td></tr></tbody></table>

C - Conditional. These attributes are required for us to support dynamic User Profile creation in the portal. If they cannot be supplied for some reason, then we have to create an upstream IdP user profile in the Onyx Portal and map it with the customer's tenant and a role (SUPER ADMIN, ADMIN or VIEWER). For information on adding an upstream IdP user, refer to *Add Upstream IDP User*.

## Integration Procedure

### Configure Onyx Portal as Service Provider

#### Get Onyx IdP Metadata to Configure Onyx Portal as a Service Provider in the Customer IdP

The latest Onyx IdP metadata is available at <https://idp.gxc.io/idp/shibboleth>. This metadata or the URL will be shared with the customer to integrate Onyx Portal as a service provider in their IdP. The necessary service provider specific details are available in the "SPSSODescriptor" block in the Onyx IdP metadata. The configuration procedure is specific to the IdP solution used by the customer and outside the scope of this document. A sample metadata is provided below for reference.

{% code overflow="wrap" %}

```
<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor  xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="http://www.w3.org/XML/1998/namespace" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:req-attr="urn:oasis:names:tc:SAML:protocol:ext:req-attr"  entityID="https://idp.gxc.io/idp/shibboleth">

    <IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">gxc.io</shibmd:Scope>
            <mdui:UIInfo>
                <mdui:DisplayName xml:lang="en">Onyx IdP</mdui:DisplayName>
                <mdui:Description xml:lang="en">Onyx IdP - GXC</mdui:Description>
                <mdui:Logo height="80" width="80">https://nms-images-1.s3.us-west-2.amazonaws.com/placeholder-gxc-logo.png</mdui:Logo>
            </mdui:UIInfo>
        </Extensions>

        <!-- First signing certificate is BackChannel, the Second is FrontChannel--> 
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIEEzCCAnugAwIBAgIUOsjLRS1A/Nd6p5OeC2n8NL2Bgu4wDQYJKoZIhvcNAQEL
BQAwFTETMBEGA1UEAwwKaWRwLmd4Yy5pbzAeFw0yMzA4MjQwODA1MjBaFw00MzA4
MjQwODA1MjBaMBUxEzARBgNVBAMMCmlkcC5neGMuaW8wggGiMA0GCSqGSIb3DQEB
AQUAA4IBjwAwggGKAoIBgQCNBsrfk3iRdVZc6fuSekvXuZdAN1RJFfeXpP0/tneb
kmdMrDURL0ZcHtQnyCgdgnypYmbZKrwBT4PAMW8b6Qex32M5ctAHoqwWshIg15As
iSou8+gxOVZbdRAfigmCH7aDuJ0mJhpAhOE4rMGCo+Hkpb/S03jcD/iJLSb6sgIR
mCnF6CYtaGFHYkko02YerDF7ZYoGLLg2CGijnhHugpMSCFqG/vqvC63EQ+xtpz5i
4ZYGRpykBaEdeiZIxYsJZqJtAQUlNgbcyi+hBEe56QgUwOQxr1kpcHxk27RJhJqD
/AfSc/NG88KoSxFWHPOLakkyq+dEkwxiEBd+SArXW8YjhDH+zM3Jsc2BDU18XEBz
R85VUwjOaCUhhXox3NFHlYipcz4yTHf/mfpNziXeDvjXv5/0PcTa6KCjb9W3cMK/
FluT8F5GvytL0JuWBJq6I+zC+cvs7rwrndkHMAZKZfI3pu7teBjNC+1beqve4Aa4
94mBbvo5uvlNdVdeWXO1YoECAwEAAaNbMFkwHQYDVR0OBBYEFHDnMPoNAC3Q7gEa
zRVNrCEkNwVQMDgGA1UdEQQxMC+CCmlkcC5neGMuaW+GIWh0dHBzOi8vaWRwLmd4
Yy5pby9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAYEAcUCDuZsXQqTA
9ZkA45KvQzk1/7spCIqDMeIHDneYV5QxjE4DwKmDmUUXBqrFEuZUE4cGOxkyCEca
mPH8/TmRxFPImlS2yh45yn/uVsL7DRMjsJUiOTHiN2HaEitOhNkuxJCJ1WdZW/y9
6/ojallbnVxXOndB8+hKuKATsCmL0HD1w9RQy+kwgEFJ7rwS6fNLoESHFQkk9Yrt
xZtF8rxNgnhEmMKIbo9pUU5Z7nQI3YLAWDOmucsqHg6hEkyIgu8RzzuLeKu2udot
d258+Jt3BAvWO0qDPMYt/iAPqRfPCGtvDd0xb8dmL3Pt28picMWOkmir8LUw/62j
tDOTKhiKLe6dpBSrAPfsb56W5OkcN7OzaEPQ+cwUnnNTvIIQMS57N1YIf3/IQbxW
TdoiOJ9MhAzbDCkD8cnK7pLq1lO4zxRI580RLpnZ4tYA0xAl+75jnGJr0m4ecyBJ
BlpI2HUx48iXjdcR79RyH7W0ume6LBRwqsd6Go/UjXM53S8EwtYk
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIEFDCCAnygAwIBAgIVAJNFLERWE0TU3pSnjJNDu7SRXiIoMA0GCSqGSIb3DQEB
CwUAMBUxEzARBgNVBAMMCmlkcC5neGMuaW8wHhcNMjMwODI0MDgwNDQzWhcNNDMw
ODI0MDgwNDQzWjAVMRMwEQYDVQQDDAppZHAuZ3hjLmlvMIIBojANBgkqhkiG9w0B
AQEFAAOCAY8AMIIBigKCAYEAnqSsNnebqwG5YYlbCulWZILf0RactSxywT1SEKiB
kUkfF1Y8uGljYPZ2hvBgoaWEnCx13HOJ7nDJ/9tXbTgL+EB6WhOIaB7NUpZqsDf2
02hKrlgVNC00Hwphn10SLXQsIi28aiYeM51OOQjIButlkxXtAlLPYk1R1lRBfihf
XlA5docC65WRW4g5JEztR27YPU3eqbowvhnyYLnj9tpQ5Wp3HjavP+u5ubUUp47+
ukLGlIDv6V1OgAvWrHSc9KYQ0Pb6pAAZwJxESkZveH+7HZJJjr4Qvd3daqSQA3Mi
Da2qV9iXV2+CDdroKHG/WCyZHvXkCyrfYzCE9JiksT2g9Z4sk3jyAwV/8F19Ku0z
uY3xxo9hlp+uIRBAyf1Emh/+H1/C6B5BV4w47WUsa5xdDo1Uya1+mpgBQxi6JnJU
rw03i8fwgMrBsndXdxEZf02yzwjSd8n/2f2eu1zh1TQwHe9/lUTZuBOXFZlEZiPK
X1OXR8R0mVXwfMMSDOuCMzXzAgMBAAGjWzBZMB0GA1UdDgQWBBTl0ifX7BNL5vmO
A6tlP9BmKHphezA4BgNVHREEMTAvggppZHAuZ3hjLmlvhiFodHRwczovL2lkcC5n
eGMuaW8vaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQELBQADggGBACUp0UHthDLt
Ry3VbxG5uvGxw+fR3X6FimhtyfaATdjwBXtZKoHHvOc3qawZKGoj4bgACua7IAb7
hM+G/x+y+PIqYON22Pge7K9U85OcI5sJ1MBsW+CEiT7deVDLdIr8y9Ohxi+KH8QE
3737jX9rrW6YFTQUawzkfwJ7d4gNVk0J9YP1Y1NUsKE+5RRwJl8wearxnXQ4CG3I
CCg16OU7tAXn5wNDKm1AjOru417Q2UBRAXW/ttE1DY8na6tJOjsKpnji4xDfMlQV
Ul9BV3CSSokO1jbaXDenyb9z7aOiSE6UKgKcWsjt+ZcwPpY5TI41LHwLmW24vQTX
qYRf2JxUxuksYm2cxTdBZrzJNrimuHE3i2BOHIs8C5ZuFF9LmOrwqaDUVbBbxQcA
1qHmGn1wXz4tqRbRB6rLJx86c8rg8u83fIN9SNlg9Pi/+l5iYEeCBebwuuiy2hw2
yH+Tsk8vobnOKrj1qUvOmTQ/N2GqNs/INKv6kIyifn0p0s0KlBm3hw==
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
MIIEEzCCAnugAwIBAgIUWI5+HkN1ouywsuKbY+HCnIfU7ZMwDQYJKoZIhvcNAQEL
BQAwFTETMBEGA1UEAwwKaWRwLmd4Yy5pbzAeFw0yMzA4MjQwODA0NDRaFw00MzA4
MjQwODA0NDRaMBUxEzARBgNVBAMMCmlkcC5neGMuaW8wggGiMA0GCSqGSIb3DQEB
AQUAA4IBjwAwggGKAoIBgQCyf92pAKarIdeeJt9XkiwPyzIfR7CkZNWKndXw4Zg6
vp2zefk7zfxgbfbfw4hi/fhfaefTOPOPvTy2QksbNor+XVOdBKgoW2mhb1BVz0CC
gOKgTECYLBnRgUQgBSv/UVr6vni4DgsuKk89I5h08HrRAkTUDI0cfrVOTyPZoE35
jz/JNII05MIkh+KPPPbIHXUkpZyR6kF5eCOuToa94UoQLL7nng6JhgvcjuNrMMHG
wXaB8Mcmwn/0QbCemM49IXZNA4FLuCg+qVvJmc3GTaLad+7FE76YHmrieyrIERqH
eiLSkMm4FkztxUFHmkCTpcZCM4BJr3LyKXEysjobvQ0IhRvoUh96JLBJfAg2BgQy
/vofCp6TQt+GyL8lryKiKuv/5WMwsSUxCKAfVWDfsAW0PtyeD4W8fbYC9BofvFcO
cFKCakeKFlwxJGcPxrh2HU3epiSe7A/5gbW2vDiVtJwJxe8fwFJ1Vkh6abGkWudn
BjxPdTWeSisEhGrM3rHgWBUCAwEAAaNbMFkwHQYDVR0OBBYEFL6vZHH4bZ8/4Z5t
CNAizAF3wUTcMDgGA1UdEQQxMC+CCmlkcC5neGMuaW+GIWh0dHBzOi8vaWRwLmd4
Yy5pby9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAYEAUk8d8/zXuMPH
W7HUBvdvThxGIYBrcywJ4/EAAn9vZnaGn6RE5GnMRpn8KBQlq9vMp4HDd2o+112l
IHzEBmJSDcZO0/NgeYalVEfMocaZvHwvhm2oaWp9B8BTp/7sNNBDOJsxtaMCnG/x
Pw10zieRs1CLDyEPAbaejVFP5Px1FB2n+fhwejIScxmrxVvkHhEd1WHSA/tOBn7r
5C9UwFoUcvpwjfikuIj0y2BGOZGs7xcxLRz92k2KXCzlK/bP3Z/ISemDzo9ZCJiq
WWxOQG6GRJxZxScB6sLURgEuh/ShHwqR8HlhbQNqRWaulmatnX07pKYm3R8PsJ4G
1O8U62YFwlmZjuN4MhADe/162ujxSO4Lak7XV70JpjckwVO10+3SQfg6fBlDeoB3
vdIKKy4QkbWqj9SXnWPMef7MwIbfisZStmpGYIGrjSo6wBKiJWjSfW/DFaPosstZ
+sqkD6W4Fi6HTZGS0ZWFu32n7w25DMSpn1PMNM07RVqtyhvWq48L
                        </ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>

        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.gxc.io:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="1"/>

        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.gxc.io/idp/profile/SAML2/Redirect/SLO"/>
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://idp.gxc.io/idp/profile/SAML2/POST-SimpleSign/SLO"/>
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.gxc.io/idp/profile/SAML2/POST/SLO"/>
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.gxc.io:8443/idp/profile/SAML2/SOAP/SLO"/>

        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" req-attr:supportsRequestedAttributes="true" Location="https://idp.gxc.io/idp/profile/SAML2/POST-SimpleSign/SSO"/>
        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" req-attr:supportsRequestedAttributes="true" Location="https://idp.gxc.io/idp/profile/SAML2/Redirect/SSO"/>
        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" req-attr:supportsRequestedAttributes="true" Location="https://idp.gxc.io/idp/profile/SAML2/POST/SSO"/>
    </IDPSSODescriptor>

    <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">gxc.io</shibmd:Scope>
        </Extensions>

	<AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.gxc.io:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>
    </AttributeAuthorityDescriptor> 
    <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>
MIIEIzCCAougAwIBAgIUZSxb98yWCiOFzEJGlOF2XmlUZTwwDQYJKoZIhvcNAQEL BQAwGTEXMBUGA1UEAwwOaWRwLXN2dC5neGMuaW8wHhcNMjMwNzAyMDk1ODA3WhcN NDMwNzAyMDk1ODA3WjAZMRcwFQYDVQQDDA5pZHAtc3Z0Lmd4Yy5pbzCCAaIwDQYJ KoZIhvcNAQEBBQADggGPADCCAYoCggGBAI/ZKhNKsEvGDh2nzrCXtWg3BbHrAnpw VJtVfcouVDoehKyiN6nu/47QO3VKsuZZfting/W+HIoigiR3A2FvOeDsaS4NKJMy EHhz+z0uPhYiJ1rjs0vdD0+BtXOP5IZKGBBSwTrHTJCvdI3oQXP3aB4jPgBL84ND OGZlQUXkRmaxQ0cAMzPY/6RRalA3CPT2tfuvf27LppedO1MWvej0CGSpdmz+4SHI Pd7n7T0323QOFjsShNCGS/YxTBxNSzTll5BHz0UnDtzKFyq54iQzHHAhMXnUB/WB awax1IQrjDslQZtlZ+7+05CzHCThFQkSpmWwUu83Ccc+vUZdCE2q9uCTo04Yxdra 5B3eVnWd2BSLEDFntGL6glxzgtKpC9vykMvl4Th1/pc2THz+XTsnb5I2XSfIOz/c iu00TXWfkL3OIHxDIhXMmcyB32s9EWbZH9UR2rgHNZRxPOYbC7VAFXEmcn+BKjQ2 iZRipaLlE0NyxmLj7kLR6u84dY/l3v1bKQIDAQABo2MwYTAdBgNVHQ4EFgQU9zlv E9P51S+5rJSZOpVWQz8+xtIwQAYDVR0RBDkwN4IOaWRwLXN2dC5neGMuaW+GJWh0 dHBzOi8vaWRwLXN2dC5neGMuaW8vaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL BQADggGBAIJUqMZEA6AxPcOe8uaP3pfhOlZnYsLpcAjfUm9dtXf63Z9hMa/Tung9 6wSs5ugKieIPKxibCqz806t/WrLcGRsGj6nfKC5vAsG5q8irwUQsHz7/Ckh8BRox 8Q1QN7tC5efqBaLVFOOE8y1N+j+8/1MVbZOHl8SPChx/hiI7TBU5i382rJ2z5Hfm wy9Dc7ZBFIHUnwjhCFoRqyGhHnDO7AbsA8lL7SwuMIDahIZh6DfaNA3yZkJGlA7X 6K3jIOsTWqru7OyjbsIxWkifb++W3mOTcYp5FhC9LgTtFRUgr3bCNQcF3Wxylbgy e7RoKwRV9RdGYhTb+gOEZWsTV5yWFQmAlKxJWNahjV6TGvUUxDgICFaupeCYLjQx 1GAdULHbgxCuraPE2bS//eK4bMf+GJsQZ7lJt47tp/09WCC8TBqndZ/BqYfRldxV XnhUlxSVOvgcnasGai4Ho2wn8O1TyJsXk6f2PHWJwhlg9H2isblxHkfdQA+zA3Uo
thWc6nOyoA==
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>
MIIEJDCCAoygAwIBAgIVAPtcYiUFZQH7C7bvM1CxPDnoithcMA0GCSqGSIb3DQEB CwUAMBkxFzAVBgNVBAMMDmlkcC1zdnQuZ3hjLmlvMB4XDTIzMDcwMjA5NTgwOFoX DTQzMDcwMjA5NTgwOFowGTEXMBUGA1UEAwwOaWRwLXN2dC5neGMuaW8wggGiMA0G CSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDLXHVjsUkGB0ZzXeIo5+0+JptkZu3R zl8gJBpp/XdxPNaX8nP5ocYHNzYjLzUT7uRvE+YIOME8rZ8CVM6qI9A58VJfr7s/ lnfKHSQd5Sf4CIrG6cwYQTAKh9Pb4swWSIV8RK3YB6h5yPF7WueZ45O4dVggBqKu LQReVfyS2Ujw4ytb+oeFbWM/huuwLoUv7FeK3OaBriu5uUbYuKV2dNpH6tdl/rWZ JFlgW6H/XjpSWTOz/W+/tN9c3Y4LzA243q3WTD/DShlb/OS7axc6nwyPXEgI5Wug QYbKclFrdTs3Kxx3IJfoTqwsgLh0sd2TsMp67ni9ORhkk2sqO1VSlMPZZv0fgqis ba7L2laKO5nB9lxEGfxUwqWa/kTDJ60Hq+C2vRYSsx6Y247dOfsAbJYYzdIguqt+ bKic+rHXHZZGXQqvnOZlD7m+NLF4FYQn5ii5p/WaN+7kEaJxFj+CBFTjF76Fjj1t oKzu0OIzLaFMg+yuR1tsOHuDsX/IiP7xJnECAwEAAaNjMGEwHQYDVR0OBBYEFPoC MiLymf7M7jgGbJt/Nt6Jbp/yMEAGA1UdEQQ5MDeCDmlkcC1zdnQuZ3hjLmlvhiVo dHRwczovL2lkcC1zdnQuZ3hjLmlvL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB CwUAA4IBgQAdB8bgnLm8PR2q8nF43TYr27ySq2G7e9rjbaeE7xiYu2PTt/0fBCn6 UhWCNSJcRk3wKLEk9RSrlPN5VNh77YCjqSiLJscsOY0N9t2+LzMXeHDrvKs58ujp A73AiNsFV4RXwAB+a8F/pu6ybgvtthBu013MiU+1y7evfjGrN8R6mKsAKYLfipFN jcHvSwiAIh/+tiwIbCBQWYpJXH/Q2gC5hMnsM3jj0pfSrA8QYCs5JKx6ekLColaw x+7ujjgmDvnKrOOD+Cd/n/dkgkqi1ned0y8TbTg1wH92P2HGr8fJ07PK3Hfgdbr2 o/55NxgFnpqrNn2+PPnIKXPSodQNVNtPpYydeqifeblLWS7K0W/Fhag9ejCcEVnz c1Tl7RGzVtqxDuB7WxSN2GYGNIGE9ZS5yvK258zHTk7dyRAZdQJiERoW4W78CInf xG+xTMUBM1LRq0vklQxxXTx+BrahbuDnkcuaBrS/+4SSpn0QW1CJFqH9584N6wBJ
ZQA4nHeApog=
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>

        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.gxc.io/idp/profile/Authn/SAML2/POST/SSO" index="0"/>
    </SPSSODescriptor>
</EntityDescriptor>

```

{% endcode %}

Key information in this IdP metadata:

* **entity ID:** `https://idp.gxc.io/idp/shibboleth`
* **ACS URL:** `https://idp-svt.gxc.io/idp/profile/Authn/SAML2/POST/SSO`
* Signing Key in SPSSODescriptor block
* Encryption Key in SPSSODescriptor block

### Configure Customer IdP as Upstream IdP in Onyx IdP

#### Accessing Onyx Portal Before the Customer IdP is Integrated

The first Super Admin user of a customer account (created when the customer account was created) will have an Onyx Portal localized account. This user can log in to the Onyx Portal to configure the customer's own IdP's details.

#### User Interface to Register Customer IdP Details in Onyx Portal

The Onyx Portal provides a UI screen to register IdP metadata and endpoint details. The customer account's Super Admin user can configure their IdP's metadata (or metadata URL), SSO URL, SLO URL, and entity ID in this screen.

To register the customer IdP's details, click **Administration** > **Add/Edit SSO Config**.

<figure><img src="https://4071075005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZc9hpHmiTCrh1sn4mWXn%2Fuploads%2FQUZP8QJkiJW0rY7w85Mj%2Fimage.png?alt=media&amp;token=395783ea-114e-4a72-8337-60e86d287b19" alt=""><figcaption></figcaption></figure>

#### Add Upstream IDP User

In case the IdP is not releasing the onyxPortalTenantId and onyxPortalRole attributes, the upstream IdP SSO users can be created in the Onyx Portal.

To create upstream IdP user accounts, click **Administration** > **Add User**. The **Upstream IdP User** option must be enabled for the Onyx Portal to treat the user as an upstream IdP user. The details are used only for mapping the tenant ID and user's role.

<figure><img src="https://4071075005-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZc9hpHmiTCrh1sn4mWXn%2Fuploads%2FNrsFZnQvZHjkX3VSFP9Y%2Fimage.png?alt=media&amp;token=eb7a09b4-83d0-4f02-af0e-44280f51dd3e" alt=""><figcaption></figcaption></figure>

#### Register Customer IdP Metadata in Onyx IdP

After the customer IdP's details are registered, the details are configured in the Onyx IdP (currently, this is a manual procedure as documented below; however, it is planned to be automated in an upcoming release).

1. Copy the customer IdP's metadata at /opt/shibboleth-idp/metadata/upstream--idp.xml and do the following configuration in metadata-providers.xml.

{% code overflow="wrap" %}

```
<MetadataProvider id="upstream-<customername>-idp-metadata"
        xsi:type="FilesystemMetadataProvider"
        metadataFile="/opt/idp/metadata/upstream-<customername>-idp.xml"
/>

```

{% endcode %}

{% hint style="info" %}
**NOTE:** For information on OSU-specific steps to configure OSU IdP, see [OSU IdP Integration](#osu-idp-integration).
{% endhint %}

2. Configure attribute-resolver, attribute-filter, or attribute proxy-pass-through to proxy pass the assertion attributes received from the customer IdP to the Onyx Portal.
3. Restart the Jetty service.

{% code overflow="wrap" %}

```
systemctl restart jetty.service
```

{% endcode %}

{% hint style="info" %}
**NOTE:** Service restart is required when we configure and integrate a customer IdP with the Onyx IdP. The downtime is less than a minute. Any new login attempts during this downtime will fail. Existing user sessions will not be impacted during this downtime, and the user will continue to use the Onyx Portal without any service interruption.
{% endhint %}

### OSU IdP Integration

#### How to Get OSU IdP Metadata

OSU's suggestion for federating with them is to define an InCommon metadata source to the Onyx IdP. It is the most secure way to do it, and will automate getting updated information if it changes. It is "set and forget".

1. Configure a DynamicHTTPMetataProvider to consume per-entity metadata with a minimum cache duration of 10 minutes, and a maximum cache duration of one day.

{% code overflow="wrap" %}

```
<!-- InCommon Per-Entity Metadata Distribution Service -->
<MetadataProvider id="incommon" xsi:type="DynamicHTTPMetadataProvider"
                  maxCacheDuration="PT24H" minCacheDuration="PT10M">
  <!-- Verify the signature on the root element (i.e., the EntityDescriptor element) -->
  <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
                  certificateFile="%{idp.home}/credentials/inc-md-cert-mdq.pem" />
 
  <!-- Require a validUntil XML attribute no more than 14 days into the future -->
  <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D" />
 
  <!-- The MetadataQueryProtocol element specifies the base URL for the query protocol -->
  <MetadataQueryProtocol>https://mdq.incommon.org/</MetadataQueryProtocol>
</MetadataProvider>

```

{% endcode %}

2. Create a file %{idp.home}/credentials/inc-md-cert-mdq.pem with the following content.

{% code overflow="wrap" %}

```
-----BEGIN CERTIFICATE-----
MIIEvjCCAyagAwIBAgIJANpi9/mkU/zoMA0GCSqGSIb3DQEBCwUAMHQxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJNSTESMBAGA1UEBwwJQW5uIEFyYm9yMRYwFAYDVQQK
DA1JbnRlcm5ldDIuZWR1MREwDwYDVQQLDAhJbkNvbW1vbjEZMBcGA1UEAwwQbWRx
LmluY29tbW9uLm9yZzAeFw0xODExMTMxNDI5NDNaFw0zODExMTAxNDI5NDNaMHQx
CzAJBgNVBAYTAlVTMQswCQYDVQQIDAJNSTESMBAGA1UEBwwJQW5uIEFyYm9yMRYw
FAYDVQQKDA1JbnRlcm5ldDIuZWR1MREwDwYDVQQLDAhJbkNvbW1vbjEZMBcGA1UE
AwwQbWRxLmluY29tbW9uLm9yZzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoC
ggGBAJ0+fUTzYVSP6ZOutOEhNdp3WPCPOYqnB4sQFz7IeGbFL1o0lZjx5Izm4Yho
4wNDd0h486iSkHxNf5dDhCqgz7ZRSmbusOl98SYn70PrUQj/Nzs3w47dPg9Tpb/x
y44PvNLS/rE56hPgCz/fbHoTTiJt5eosysa1ZebQ3LEyW3jGm+LGtLbdIfkynKVQ
vpp1FVeCamzdeB3ZRICAvqTYQKE1JQDGlWrEsSW0VVEGNjfbzMzr/g4l8JRdMabQ
Jig8tj3UIXnu7A2CKSMJSy3WZ3HX+85oHEbL+EV4PtpQz765c69tUIdNTJax9jQ2
1c3wL0K27HE8jSRlrXImD50R3dXQBKH+iiynBWxRPdyMBa1YfK+zZEWPbLHshSTc
9hkylQv3awmPR/+Plz5AtTpe5yss/Ifyp01wz1jt42R+6jDE+WbUjp5XDBCAjGEE
0FPaYtxjZLkmNl367bdTN12OIn/ixPNH+Z/S/4skdBB9Gc4lb2fEBywJQY0OYNOd
WOxmPwIDAQABo1MwUTAdBgNVHQ4EFgQUMHZuwMaYSJM5mlu3Wc4Ts5xq4/swHwYD
VR0jBBgwFoAUMHZuwMaYSJM5mlu3Wc4Ts5xq4/swDwYDVR0TAQH/BAUwAwEB/zAN
BgkqhkiG9w0BAQsFAAOCAYEAMr4wfLrSoPTzfpXtvL+2vrKBJNnRfuJpOYTbPKUc
DOP2QfzRlczi7suYJvd5rLiRonq8rjyPUyM8gvTfbTps+JhJ6S9mS6dTBxOV1qPZ
3Ab+XKmq8LUtguGRabKgJgmJH0+inR/wVoal7EVHcWXfij9AT8DZOXW88shc6grh
jUaFZBu/2+q8c8ee0e4ip8B+CVEnCwDKI0d+nTcSmPvAE34CNa33F+QGpXawv5yv
VvIpSaLAeFQhc/jKcnNHfy+Zi7JmSnKZiMvQCbWANQmDjHg7pGmBW9nyQcm6P2/B
0AVcEj1YTpAR8Mbh1pUdIhoB+chaNnFEIZsXeRsdbbAFpxodInlJ7WekfuvSQ6sU
EXpoyBGOeuuTmR1va8k3QeL8Wc4yNu/g5LwjmtvPrh2jBF8xujc4J6VzP8K2BjA4
xk4LnXgjHOT93dBAJhVYJkykDHwyvHUvsBHoP6lfjrt5P8zunK2mdP/AZKik+Rdt
1GGlErV2AyWShTOaDLW6NxdP
-----END CERTIFICATE-----

```

{% endcode %}

3. To "harden" it to *only* allow OSU's metadata to be loaded, the following metadata filter can be added.

{% code overflow="wrap" %}

```
<MetadataFilter xsi:type="Predicate" direction="include">
        <Entity>urn:mace:incommon:osu.edu</Entity>
</MetadataFilter>
```

{% endcode %}

4. Configure proxy-pass-through to proxy pass the attributes released by the OSU IdP.

#### Sharing Onyx IdP's Metadata with OSU

To integrate with the Onyx Portal, OSU must register the Onyx IdP as a service provider. Onyx IdP's metadata is available at <https://idp.gxc.io/idp/shibboleth>. The metadata also contains signing and encryption certificates.

#### Finalize the Foreign IdP Integration with Onyx IdP

Shibboleth IdP requires a service restart to apply the configuration changes.

To restart Shibboleth IdP, run the following command.

```
systemctl restart jetty.service
```

{% hint style="info" %}
**NOTE:** Service restart is required when configuring and integrating a customer IdP with the Onyx IdP. The downtime is less than a minute. Any new login attempt during this downtime will fail. Existing user sessions will not be impacted during this downtime, and the user will continue to use the Onyx Portal without any service interruption.
{% endhint %}

## Appendix

### Sample SAML Request

{% code overflow="wrap" %}

```
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest
	xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://api-dev.gxc.io/tms/authenticate/login/sso/handler" Destination="https://accounts.google.com/o/saml2/idp?idpid=C040ly2b0" ID="_f27484aaa0fed12bd830d49290fb656e" IssueInstant="2023-06-26T07:18:21.353Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
	<saml2:Issuer
		xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://accounts.google.com/o/saml2?idpid=C040ly2b0
	</saml2:Issuer>
	<saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
</saml2p:AuthnRequest>
```

{% endcode %}

### Sample SAML Response

{% code overflow="wrap" %}

```
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<saml2p:Response
	xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://api-dev.gxc.io/tms/authenticate/login/sso/handler" ID="_49d176eab8f70c4ca15fa20722f69a67" InResponseTo="_f27484aaa0fed12bd830d49290fb656e" IssueInstant="2023-06-26T07:19:29.733Z" Version="2.0">
	<saml2:Issuer
		xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://accounts.google.com/o/saml2?idpid=C040ly2b0
	</saml2:Issuer>
	<saml2p:Status>
		<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
	</saml2p:Status>
	<saml2:Assertion
		xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_92cd96df2ff07fb4d54fa5437ce898c1" IssueInstant="2023-06-26T07:19:29.733Z" Version="2.0">
		<saml2:Issuer>https://accounts.google.com/o/saml2?idpid=C040ly2b0</saml2:Issuer>
		<ds:Signature
			xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
			<ds:SignedInfo>
				<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
				<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
				<ds:Reference URI="#_92cd96df2ff07fb4d54fa5437ce898c1">
					<ds:Transforms>
						<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
						<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
					</ds:Transforms>
					<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
					<ds:DigestValue>qBEualSgvfYQnz8KMoe60paMefGmd5rcxYHh2rkJH5s=</ds:DigestValue>
				</ds:Reference>
			</ds:SignedInfo>
			<ds:SignatureValue>hF6VIfUOhQgcldp05a2qElpSHN4SMuM7jNPXwZFnYjY3w0fwc56VktOcJeTsyOtFgOe2PUz0SIUK
BKTbPxi/FhxUU9ZyAtY0U37DOj/6lwbABVVgI6PweW1S3lP/dMtewfGiJHxvSS7RU1pHU9qaCyaF
Pf0LE5QIOZT2fvz7VZnJsMgnRDIHh9LfEsDov+VV/nMtmopy+zMd7MUKEpjd/oCoA+nNnBFGOhDd
k+Hu7ErKpimMIQoK4LZ+0h/BE7JTXA4cQkgQkELvNE69VJ6vIQB37LdkzxpIoYWMhK50s3SauBH1
fi1Y/lN6BTiucVzpf2kC9BYYA6LdmFVpaOXYZA==</ds:SignatureValue>
			<ds:KeyInfo>
				<ds:X509Data>
					<ds:X509SubjectName>ST=California,C=US,OU=Google For Work,CN=Google,L=Mountain View,O=Google Inc.</ds:X509SubjectName>
					<ds:X509Certificate>MIIDdDCCAlygAwIBAgIGAXW4V2GMMA0GCSqGSIb3DQEBCwUAMHsxFDASBgNVBAoTC0dvb2dsZSBJ
bmMuMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ8wDQYDVQQDEwZHb29nbGUxGDAWBgNVBAsTD0dv
b2dsZSBGb3IgV29yazELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEwHhcNMjAxMTEx
MTcyNTM0WhcNMjUxMTEwMTcyNTM0WjB7MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEWMBQGA1UEBxMN
TW91bnRhaW4gVmlldzEPMA0GA1UEAxMGR29vZ2xlMRgwFgYDVQQLEw9Hb29nbGUgRm9yIFdvcmsx
CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA0yVSlpMvhLYART4e+Fg7DlPFBx1ST2oyyaTi+x59EQfsWh+OUXlFlevnpswSyF51
bof+02pB5X8SGOZ6PhWRhCdqmTgl/m+NNP0E/nYcjI4bjHXo7cQg+ThKujsndg9JyiEBVJLxqWi8
pP5whq6b6HKQOw3OctrJqGDR5SrFgvmVjm3q67eEMUfawk11cZYcO0/GRpww6OPMpQ5Mff4FdXw0
KR8kTkzEMeppp1NR85+PiGADTIKq5HBRJ3/J/uE61hkCtyICh76tykmRPLQHVCraZZhKUEvpv1rU
8veX6zBOZEPJvOnq9y73wgTpUUvt0Ec/tpzwJDqU0KPfrbOzbQIDAQABMA0GCSqGSIb3DQEBCwUA
A4IBAQBdhkt+m1FifgTO3dMYdlSkxm2NIzbOSxQ99ewghc5vUTTnVwcS92Vpe913JHFkx8Yfgtu/
MCj16dk5Xr6g+RRZEoIkzs8JAmUMZP7d7hufBPcIz6XCM3XjkT5ro1twHbME1vR45ioOKni8pDoL
/QVV0/lT2cYmOG1qrjVrI52kqOjgen4FMGbPXDO+h0FZzmbTa2cHf0kiVLAf2OfipwfS6QUo8qYJ
MvoWQxihu+EksZrQR3aHzPHRbv9DKgKwhcRFu3kADTb7HEJF6fi1y+1XsbT5UBgKnNTtwg2P7foa
xqCocpQ9+iVaJHS85x2bmI6jlG5vKRZjAaNVVzzLfif+</ds:X509Certificate>
				</ds:X509Data>
			</ds:KeyInfo>
		</ds:Signature>
		<saml2:Subject>
			<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">guptesh.sahu@gxc.io</saml2:NameID>
			<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
				<saml2:SubjectConfirmationData InResponseTo="_f27484aaa0fed12bd830d49290fb656e" NotOnOrAfter="2023-06-26T07:24:29.733Z" Recipient="https://api-dev.gxc.io/tms/authenticate/login/sso/handler"/>
			</saml2:SubjectConfirmation>
		</saml2:Subject>
		<saml2:Conditions NotBefore="2023-06-26T07:14:29.733Z" NotOnOrAfter="2023-06-26T07:24:29.733Z">
			<saml2:AudienceRestriction>
				<saml2:Audience>https://accounts.google.com/o/saml2?idpid=C040ly2b0</saml2:Audience>
			</saml2:AudienceRestriction>
		</saml2:Conditions>
		<saml2:AttributeStatement>
			<saml2:Attribute Name="firstName">
				<saml2:AttributeValue
					xmlns:xs="http://www.w3.org/2001/XMLSchema"
					xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">Guptesh
				</saml2:AttributeValue>
			</saml2:Attribute>
			<saml2:Attribute Name="lastName">
				<saml2:AttributeValue
					xmlns:xs="http://www.w3.org/2001/XMLSchema"
					xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">Sahu
				</saml2:AttributeValue>
			</saml2:Attribute>
			<saml2:Attribute Name="userId">
				<saml2:AttributeValue
					xmlns:xs="http://www.w3.org/2001/XMLSchema"
					xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">GXC0002011
				</saml2:AttributeValue>
			</saml2:Attribute>
			<saml2:Attribute Name="onyxPortalTenantId">
				<saml2:AttributeValue
					xmlns:xs="http://www.w3.org/2001/XMLSchema"
					xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">gxcdirect
				</saml2:AttributeValue>
			</saml2:Attribute>
			<saml2:Attribute Name="userEmail">
				<saml2:AttributeValue
					xmlns:xs="http://www.w3.org/2001/XMLSchema"
					xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">guptesh.sahu@gxc.io
				</saml2:AttributeValue>
			</saml2:Attribute>
			<saml2:Attribute Name="onyxPortalRole">
				<saml2:AttributeValue
					xmlns:xs="http://www.w3.org/2001/XMLSchema"
					xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">SUPER_ADMIN
				</saml2:AttributeValue>
			</saml2:Attribute>
		</saml2:AttributeStatement>
		<saml2:AuthnStatement AuthnInstant="2023-06-26T07:19:27.000Z" SessionIndex="_92cd96df2ff07fb4d54fa5437ce898c1">
			<saml2:AuthnContext>
				<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef>
			</saml2:AuthnContext>
		</saml2:AuthnStatement>
	</saml2:Assertion>
</saml2p:Response>

```

{% endcode %}

## Related Documentation

* *4G & 5G Onyx Portal Multi-Factor Authentication Application Note*
* *GXC Glossary*

## Contact GXC

To get in touch with GXC, please visit <https://gxc.io/contact-us/>.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.gxc.io/docs/application-notes/4g-and-5g-onyx-portal-integration-with-customer-idp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.