Integrating Lucid with OneLogin enables your users to securely authenticate using SAML single sign-on through OneLogin. The SCIM integration allows admins to create users and provision and deprovision users within OneLogin itself, without having to sign in to Lucid. You will need admin privileges in both Lucid and OneLogin to complete this process.

Free	Individual	Team	Enterprise	FedRAMP

See the Upgrade your Lucid account article for instructions to upgrade.

Configure the SAML integration for Lucidchart

In OneLogin:

Browse "Applications", and add the Lucidchart application to your OneLogin instance.
Navigate to the Configuration tab and enter your domain under “Application details".
Click Save.
Go to the SSO tab and specify a SHA-256 encryption.
Click Save.
In the top right corner, click More Actions.
From the dropdown, select SAML Metadata to download the OneLogin metadata.
- This will download as an XML file with metadata containing instructions that Lucid will need to communicate with OneLogin. You will upload this file to Lucid.

In Lucid:

Select Admin.
Click Identity management in the left-hand menu.
Select Configure to the right of the “Allow SAML authentication” option to navigate to your SAML Activation page in Lucid.
- You will not be able to enable SAML until you have populated your domain and uploaded metadata.
Under “Lucidchart Sign in URL”, enter your Domain name.
Click Save Changes.
Scroll down on the SAML Activation page of Lucidchart and click Add Identity Provider.
Upload the XML file (metadata) that you downloaded from OneLogin.
Click Test SAML connection to verify that Lucid is properly communicating with OneLogin.
- The connection will only work if the Lucid app has been assigned to your test user in OneLogin. You can assign the app to users in the Assignments section of the app page.
Navigate back to the Identity management page.
Check the box next to “Allow SAML authentication”.
Click Save Changes.

Note: You can select the Default Authentication method in Lucid, after you have checked the methods that you would like to allow as sign in options above. Users will be prompted to sign in using the default authentication you set up in the Identity management page.

Add a Lucidspark Shortcut App

Add a new Application in OneLogin. Find the Shortcut App published by OneLogin.
Under the SSO tab, swap the Encryption Algorithm to SHA-265
Under the Configuration tab add your sign in URL.
Click here to download a Lucidspark logo to upload as the Application logo. This will show up in your users Application gallery if they are assigned to the access.
Add any users that need Lucidspark access to the application.

Note: For this type of provisioning to work, you must have Domain Control enabled.

You can set up Just-In-Time provisioning in the License settings section of your Lucid admin panel.

If you would like all users to come onto your Lucid account with full-edit licenses, set the setting for "When a new user joins the account” to "Automatically grant license."

If you want all users to come in as limited-access users, set the setting for "When a new user joins the account" to “Do not automatically grant.” Your users will then be able to request full-edit licenses. Depending on the “When a user requests a license” setting, you can have licenses be automatically granted to users upon their request, or you can have the requests turn into pending requests in your user list.

Note: We strongly recommend that you have a custom request dialog if you have users requesting licenses from an admin.

Configure SCIM for Lucidchart in OneLogin

If you would like to create Lucid users before their first log-in and determine their license type (full-edit vs. limited-access) through OneLogin, you can set up the Lucid SCIM integration.

Before configuring SCIM, please do the following:

Confirm that you are on an Enterprise account with an up-to-date pricing plan. To upgrade, contact our sales team.
Contact your Lucid Customer Success Manager or contact support to request that SCIM be enabled for your account.
Make sure that auto-upgrade is enabled in your Licensing settings. You will be unable to generate a bearer token to configure SCIM if this setting is not enabled. You will want to turn off auto-upgrade after generating a bearer token to prevent unwanted licensing during the configuration process.

Once you have followed the pre-configuration steps listed above, you can configure SCIM for Lucid in OneLogin by following these steps:

In OneLogin, go to your Provisioning tab and click Enable under “API Connection.”
Open Lucid in a new window and go to Admin > App Integration > SCIM.
Copy the Lucid Base URL and paste it into the "SCIM Base URL" text box in OneLogin.
In Lucid, click Generate token. Lucid will populate the “Bearer Token” text field with a unique code for you to share with OneLogin.
Copy the bearer token from Lucid and paste it into the "SCIM Bearer Token" text box in OneLogin.

Assign Lucid Suite licenses to users with SCIM

The following steps only apply if you have been migrated to a Lucid Suite Enterprise account.

In order for OneLogin SCIM to properly update, add, or remove licenses, we recommend that there be only one group or one role that determines licenses. If there were separate groups/roles for Lucidchart licensed users and Lucidspark licensed users, those groups/roles should be combined into one with all users in each group/role added to this new combined group.

Once this has been completed, and your SCIM connection has been made, set up OneLogin license provisioning by following these steps:

In the “Rules” tab in OneLogin, select one of the rules that is currently granting licenses.
Update the Conditions to reflect the new combined group/role that you’ve created.
Under “Actions,” add the necessary actions so that “Set Lucidchart Licensed in Lucid SCIM” is set to “true” and “Set Lucidspark Licensed in Lucid SCIM” to “true”.
Select Update.
In the “Provisioning” tab, ensure the box next to “Enable provisioning” is checked.
In the “Parameters” tab, ensure the Lucidchart Licensed and Lucidspark Licensed are enabled and the box for “Include in User Provisioning” is checked for both.
In the “Rules” tab, remove all other rules so that only two rules remain, one for Lucid Suite licenses assignment and one for limited-access assignment.
Click Save.
Select the More Actions drop-down menu.
Click reapply provisioning mapping to apply the new rule.

Group provisioning

Lucid's OneLogin app supports group provisioning to Lucid from OneLogin and also imports existing groups from Lucid into OneLogin. There are several ways to assign group membership in OneLogin, but we will focus on using Rules to Import and map users to groups and how to use Rules to create new groups in Lucid.

Import your Groups from Lucid and assign users to those Groups

You will need to open the Rules tab within your Lucid OneLogin app. From there you can create a new rule. Under actions, you will see "Set Groups in Lucidchart." Next, if you select the "From Existing" radio button, your existing groups in Lucidchart should appear in the dropdown.

In the "Actions" section you can submit your conditions for applying for this Group membership. Note that you can assign these groups at an individual level when assigning users to your app.

Create your Groups from OneLogin in Lucid and assign users to those Groups

Selecting the "Map From OneLogin" radio button allows you to create existing OneLogin groups in Lucid.

FAQ

What happens to documents when I delicense a user via SCIM?

When you delicense or delete a user via SCIM, you must transfer their documents to another user on your Enterprise account. This does not apply when deactivating users.
By default, the account owner will be the recipient of the documents that are automatically transferred upon delicensing or deleting a user. You can change the recipient of the transferred documents by navigating to the SCIM integration settings in the Admin Panel and selecting Modify default owner to the right-hand side of the email address. See the screenshot below for reference.

Clicking Modify default owner redirects you to the “Document & Folder Settings” page of the Admin Panel where you can change who the default document owner on your account is. Refer to Lucid admin panel: Documents and folders article for additional details.

change-recipient-of-documents-when-deleting-or-delicensing-users-via-SCIM.png

What are the benefits of integrating with SAML?
Lucid’s SAML integration allows users on your Lucid account to authenticate quickly and securely. Additionally, if you enable user provisioning, a SAML connection will create users in Lucid automatically upon their first log-in if they are assigned the Lucid app in your IdP.

What can I do with the OneLogin SCIM integration?
With the SCIM integration, you can sync user information between Lucid and OneLogin and make changes to users in your Lucid account directly in OneLogin. Some things you can do with this integration include creating, licensing, deactivating, and updating attributes to users on your Lucid Enterprise account.

Does Lucidchart support group management through OneLogin?
Please see OneLogin’s group management page for more information.

Resources

To learn more about this feature or to ask additional questions, explore the additional resources below. These resources are available in English only.

Community post

Instructions to update IDP metadata certificate (renew SSO cert)

Give feedback on this article

Have feedback about this article? Tell us about your experience here.

Related articles