OneLogin - How can I retrieve user password needed for 3rd party API calls?

0
votes

We're using OneLogin w/Active Directory to achieve Single Sign On with a SAML enabled 3rd party application. We would additionally like to perform API calls related to the 3rd party app. The API calls require a 'basic authentication' header which depend on the 3rd party app's username and password being available. Is it possible to retrieve the username/password information through OneLogin for a SAML integrated application?

From what I understand, apps integrated via SAML or OAuth do not store their passwords with OneLogin. Which means I cannot look them up in our integrated Active Directory (they would be encrypted anyway). However... if during user provisioning, I were to force all 3rd party accounts to have the same username/password as the OneLogin account... might that work?

Any assistance or suggestions would be appreciated. I have some flexibility to work with here as we have not yet created any OneLogin or 3rd party accounts.

1
onelogin
Can you provide some more details about your code that needs to call the API? Also knowing what app it is (and more details on how it's provisioned) would be helpful. But in general, using the same password everywhere is bad security (then again, so are APIs that use basic auth) - John Offenhartz

1 Answers

0
votes

Passwords are not provided by the SAML protocol.

You will find this thread interesting:

Alternatives:

  • Use SAML on the API calls (Oauth2 SAML2 token).
  • When provisioning the user account on the 3rd party app, force the user to set a local password to be used on the API calls.