Connect OneLogin (identity audit)

A Read all API credential pair — MFA devices, privileged users, and lockout signals across your OneLogin org.

1. 1Connect OneLogin to Cybermatic. You need: • A OneLogin Account Owner or Administrator account. • Access to Cybermatic's Connections page. • A password manager or approved secrets vault. • Approval for the API permission level you will grant.
2. 2Step 1 — Sign in to the OneLogin administration portal. 1. Open your organization's OneLogin address, such as: https://yourcompany.onelogin.com 2. Sign in using an Account Owner or Administrator account. 3. Make sure you are in the administrative interface rather than the normal user application portal. OneLogin requires an owner or administrator to create API credentials.
3. 3Step 2 — Open API Credentials. 1. From the OneLogin administration portal, select Developers. 2. Select API Credentials. 3. The API Access page should open. 4. Select New Credential. OneLogin's current credential-creation path is Developers → API Credentials → New Credential. Some existing-credential management screens may also appear under Settings → API, depending on the interface or tenant configuration.
4. 4Step 3 — Configure the credential. Enter the following: Name: CybermaticScanner (OneLogin doesn't allow any spaces in the name) Scope: select Read all for the initial connection. Do not choose: • Authentication Only — insufficient for the audit. • Manage All — excessive for this use case. • Read Users — insufficient for the audit. • Manage users — use only when required for the documented MFA-device endpoint and after accepting the broader permission risk.
5. 5Step 4 — Save and capture the credentials. 1. Select Save. 2. OneLogin will display: Client ID Client Secret 3. Copy both values. 4. Store them immediately in your approved password manager or secrets vault. 5. Select Done. Do not place the secret in: • Email • Teams or Slack • Service tickets • Screenshots • Source code
6. 6Step 5 — Determine the OneLogin subdomain. Look at your native OneLogin address. For example: https://cybermatic.onelogin.com The subdomain is: cybermatic Enter only the first portion. Do not enter: • https:// • .onelogin.com • A trailing slash • Any path after the domain OneLogin identifies the API domain using the tenant's OneLogin subdomain. If employees normally use a custom branded login address, determine the underlying native OneLogin tenant address ending in .onelogin.com and use that tenant's subdomain.
7. 7Step 6 — Enter the connection in Cybermatic. 1. Sign in to Cybermatic. 2. Open Connections. 3. Locate Identity providers. 4. Select OneLogin. 5. Enter: Subdomain: yourcompany API client ID: paste the OneLogin Client ID. API client secret: paste the OneLogin Client Secret. 6. Verify that there are no leading or trailing spaces. 7. Select Connect. Cybermatic saves the connection and starts the initial scan.
8. 8What Cybermatic checks. • Every active user appears on the Identities page with their MFA-device status — with a Critical finding for privileged users without a device. • Multiple simultaneously locked accounts (a classic password-spray signature). • Active accounts with no sign-in for 90+ days. Privileged-user detection uses the privileges API where your plan exposes it; the scanner skips what it can't read rather than failing.
9. 9Troubleshooting. "OneLogin auth failed: 401" — the client ID/secret pair was mistyped or revoked; re-copy from Developers → API Credentials or create a new pair and use Connections → Update credentials. "OneLogin: the API credential isn't allowed to read users (403)" — the credential's scope is too narrow; recreate it with the Read all scope (Developers → API Credentials). "Subdomain should be just the first part…" — enter only yourcompany, not https:// or .onelogin.com. MFA counts look incomplete — some tenants gate the MFA-device endpoint behind broader scopes; if device reads fail on Read all, recreate the credential with Manage users after weighing the added permissions.

Tip: Three or more simultaneously locked accounts is one of the clearest early signs of an active password-spray — when that finding appears, check your sign-in events the same day.