# OneLogin
{% hint style="success" %}
Please complete the steps in the [Admin Console Configuration](https://docs.keeper.io/en/sso-connect-cloud/admin-console-configuration) section first.
{% endhint %}
### OneLogin Setup:
1. Login to the OneLogin portal.
2\. Select Administration to enter the admin section.
3\. From the onelogin menu select **Applications** then **Add App**.
In the Search field, do a search for **Keeper Password Manager** and select it from the search result.
4\. On the **Add Keeper Manager** screen click Save.
5\. The next step is to download the SAML Metadata from OneLogin. Select the down arrow on the **MORE ACTIONS** button and select **SAML Metadata**.
Drag and drop or browse to this saved file on the SAML Metadata Section of the Single Sign-On with SSO Connect™ Cloud section on the Keeper Admin Console.
6\. On the Keeper Admin Console, copy the Assertion Consumer Service (ACS) Endpoint field.
7\. Back on the OneLogin Configuration tab, paste in the Keeper SSO Connect **Assertion Consumer Service (ACS) Endpoint** field and then click **Save**.
8\. If SCIM is desired then go back on the Keeper Provisioning tab, click on "Add Method" and select SCIM. If not skip to step to step 12.
9\. Click Generate then copy the URL and Token.
10\. Paste the "URL" into the **SCIM Base URL**, and paste the "Token" into the **SCIM Bearer Token**.
11\. On the Keeper Admin Console make sure to **Save** the SCIM token.
{% hint style="info" %}
For more detailed configuration of SCIM visit the [User and Team Provisioning section in the Enterprise Guide](https://app.gitbook.com/s/-LO5CAzpxoaEquZJBpYz/user-and-team-provisioning/onelogin-provisioning-with-scim)
{% endhint %}
12\. Click **Save** and the integration is complete.
#### Move existing users/initial admin to SSO authentication
Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.
{% hint style="warning" %}
An admin can not move themselves to the SSO enabled node. It requires another admin to perform this action.
{% endhint %}
After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.
Initially select 'Enterprise SSO Login'
Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.
They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation [can be found here](https://app.gitbook.com/s/-LO5CAzpxoaEquZJBpYz/domain-reservation).
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.keeper.io/en/sso-connect-cloud/identity-provider-setup/onelogin-keeper.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
