1. In the Enterprise portal, go to Enterprise Applications > Global Settings .
2. From the left menu, select User Management, and then select the Users tab.
3. Select New User.

   

4. Enter the following details for the new user:
   Note: The Next button is activated only when you enter all the mandatory details in each section.

   Table 3. New User Details

   Option	Description
   General information	Enter the required personal details of the user. Note: Starting from the 4.5 release, the use of the special character "<" in the password is no longer supported. In cases where users have already used "<" in their passwords in previous releases, they must remove it to save any changes on the page.
   Role	Select a role that you want to assign to the user. For information on roles, see the topic Roles.
   Edge Access	Choose one of the following options: Basic: Allows you to perform certain basic debug operations such as ping, tcpdump, pcap, remote diagnostics, and so on. Privileged: Grants you the root-level access to perform all basic debug operations along with Edge actions such as restart, deactivate, reboot, hard reset, and shutdown. In addition, you can access linux shell. The default value is Basic.

5. Select the Add another user check box if you wish to create another user, and then select Add User. The new user appears in the User Management > Users page. Select the link to the user to view or modify the details. As an Enterprise Administrator, you can manage the Roles, Service Permissions, and API Tokens for the Enterprise users.
   Note: Enterprise Administrator should manually delete inactive Identity Provider (IdP) users from the Orchestrator to prevent unauthorized access via API Token.
   Important: Customers created on a Release 5.2.0 Orchestrator who are not assigned to a Partner are automatically configured for Single Sign On (SSO) using Cloud Services Platform (CSP) as the Identity Provider (IdP). As a result:

   • New administrators are created by an administrator with a Superuser role through the CSP portal.
   • There is one exception to this: the customer is permitted one administrator account with Native authentication (username/password) to allow them to access their portal in the event there is an issue with CSP authentication.
   • For additional information about using CSP as an IdP in SD-WAN, see the topic Configure CSP for Single Sign On.

1. In the Enterprise portal, on the Global Navigation bar, expand the Enterprise Applications drop-down menu.
2. Select Global Settings service.
3. Navigate to User Management > Users .
4. Select a user and select Modify or select the link to the username. Go to the API Tokens section.

   

5. Select New API Token.

   

6. In the New Token window, enter a Name and Description for the token, and then choose the Lifetime from the drop-down menu.
7. Select Save. The new token is displayed in the API Tokens table. Initially, the status of the token is displayed as Pending. Once you download it, the status changes to Enabled.
8. To download the token, select the token, and then select Download API Token.
9. To deactivate a token, select the token, and then select Revoke API Token. The status of the token is displayed as Revoked.
10. Select CSV to download the complete list of API tokens in a .csv file format.
11. When the Lifetime of the token is over, the status changes to Expired.

curl -k -H "Authorization: Token <Token>" -X POST https://vco/portal/ -d '{ "id": 1, "jsonrpc": "2.0", "method": "enterprise/getEnterpriseUsers", "params": { "enterpriseId": 1 }}'

1. In the Enterprise portal, on the Global Navigation bar, expand the Enterprise Applications drop-down menu.
2. Select Global Settings service.
3. From the left menu, select User Management, and then select the Roles tab.
4. Select Add Role.

   

5. Enter the following details for the new custom role:

   Table 8. New Custom Role Options

   Option	Description
   Role Details
   Role Name	Enter a name for the new role.
   Role Description	Enter a description for the role.
   Template	Optionally, select an existing role as template from the drop-down list. The privileges of the selected template are assigned to the new role.
   Role Creation
   Global Settings & Administration	These privileges provide access to user management and global settings that are shared across all services. Choosing one of the privileges is mandatory. By default, Global Settings Enterprise Read Only is selected.
   SD-WAN	These privileges provide the Enterprise Administrator with different levels of access around SD-WAN configuration, monitoring, and diagnostics. You can optionally choose an SD-WAN privilege. The default value is No Privileges.

   Note: The Role Creation section displays the privileges only for which the Customer has licenses.
6. Select Save Changes. The new custom role appears in the User Management > Roles page. Select the link to the custom role to view the settings.

1. In the Enterprise portal, on the Global Navigation bar, expand the Enterprise Applications drop-down menu.
2. Select Global Settings service.
3. From the left menu, select User Management, and then select the Service Permissions tab.
4. Select New Permission. The following screen appears:

   

5. Enter the following details to create a new permission:

   Table 11. New Permission Option Descriptions

   Option	Description
   Name	Enter an appropriate name for the permission. Note: The permission name must be unique within the Orchestrator it is hosted upon.
   Description	Enter a description. This field is optional.
   Service	Select a service from the drop-down menu. The available services are: Global Settings SD-WAN Edge Compute
   Privilege Bundle	Select a privilege bundle from the drop-down menu. The privileges are populated depending on the selected Service.
   Privileges	Displays the list of privileges based on the selected Privilege Bundle. You can edit only those privileges that are eligible for customization.

6. Select Download CSV to download the list of all privileges, their description, and associated actions, into a file in CSV format.
7. Select Save to save the new permission. Select Save and Apply to save and publish the permission.
   Note: The Save and Save and Apply buttons are activated only after you modify the permissions.
   The new permission is displayed on the Service Permissions page.

1. Log in to your Microsoft Azure account as an Admin user. The Microsoft Azure home screen appears.
2. To create a new application:
   1. Search and select the Azure Active Directory service.

      

   2. Go to App registration > New registration . The Register an application screen appears.

      

   3. In the Name field, enter the name for your Orchestrator application.
   4. In the Redirect URL field, enter the redirect URL that your Orchestrator application uses as the callback endpoint.

      In the Orchestrator application, at the bottom of the Configure Authentication screen, you can find the redirect URL link. Ideally, the Orchestrator redirect URL will be in this format: https://<Orchestrator URL>/login/ssologin/openidCallback.

   5. Select Register. Your Orchestrator application will be registered and displayed in the All applications and Owned applications tabs. Make sure to note down the Client ID/Application ID to be used during the SSO configuration in Orchestrator.
   6. Select Endpoints and copy the well-known OIDC configuration URL to be used during the SSO configuration in Orchestrator.
   7. To create a client secret for your Orchestrator application, on the Owned applications tab, select your Orchestrator application.
   8. Go to Certificates & secrets > New client secret . The Add a client secret screen appears.

      

   9. Provide details such as description and expiry value for the secret and select Add.

      The client secret is created for the application. Note down the new client secret value to be used during the SSO configuration in Orchestrator.

   10. To configure permissions for your Orchestrator application, selectyour Orchestrator application and go to API permissions > Add a permission . The Request API permissions screen appears.

       

   11. Select Microsoft Graph and select Application permissions as the type of permission for your application.
   12. Under Select permissions, from the Directory drop-down menu, select Directory.Read.All, and from the User drop-down menu, select User.Read.All.
   13. Select Add permissions.
   14. To add and save roles in the manifest, select your Orchestrator application and from the application Overview screen, select Manifest. A web-based manifest editor opens, allowing you to edit the manifest within the portal. Optionally, you can select Download to edit the manifest locally, and then use Upload to reapply it to your application.

       

   15. In the manifest, search for the appRoles array and add one or more role objects as shown in the following example and select Save.
       Note: The value property from appRoles must be added to the Identity Provider Role Name column of the Role Map table, located in the Authentication tab, in order to map the roles correctly.
       Sample role objects

       { "allowedMemberTypes": [ "User" ], "description": "Standard Administrator who will have sufficient privilege to manage resource", "displayName": "Standard Admin", "id": "18fcaa1a-853f-426d-9a25-ddd7ca7145c1", "isEnabled": true, "lang": null, "origin": "Application", "value": "standard" }, { "allowedMemberTypes": [ "User" ], "description": "Super Admin who will have the full privilege on Orchestrator", "displayName": "Super Admin", "id": "cd1d0438-56c8-4c22-adc5-2dcfbf6dee75", "isEnabled": true, "lang": null, "origin": "Application", "value": "superuser" }

       Note: Make sure to set id to a newly generated Global Unique Identifier (GUID) value. You can generate GUIDs online using web-based tools (for example, https://www.guidgen.com/), or by running the following commands:

       • Linux/OSX- uuidgen
       • Windows- powershell [guid]::NewGuid()

       

       Roles are manually set up in the Orchestrator, and must match the ones configured in the Microsoft Azure portal.

       

3. To assign groups and users to your Orchestrator application:
   1. Go to Azure Active Directory > Enterprise applications .
   2. Search and select your Orchestrator application.
   3. Select Users and groups and assign users and groups to the application.
   4. Select Submit.

1. Log in to your Okta account as an Admin user. The Okta home screen appears.
   Note: If you are in the Developer Console view, then you must switch to the Classic UI view by selecting Classic UI from the Developer Console drop-down list.
2. To create a new application:
   1. In the upper navigation bar, select Applications > Add Application . The Add Application screen appears.

      

   2. Select Create New App. The Create a New Application Integration dialog box appears.
   3. From the Platform drop-drop menu, select Web.
   4. Select OpenID Connect as the Sign on method and select Create. The Create OpenID Connect Integration screen appears.

      

   5. Under the General Settings area, in the Application name text box, enter the name for your application.
   6. Under the CONFIGURE OPENID CONNECT area, in the Login redirect URIs text box, enter the redirect URL that your Orchestrator application uses as the callback endpoint.

      In the Orchestrator application, at the bottom of the Configure Authentication screen, you can find the redirect URL link. Ideally, the Orchestrator redirect URL will be in this format: https://<Orchestrator URL>/login/ssologin/openidCallback.

   7. Select Save. The newly created application page appears.
   8. On the General tab, select Edit and select Refresh Token for Allowed grant types, and select Save.

      Note down the Client Credentials (Client ID and Client Secret) to be used during the SSO configuration in

      Orchestrator.

      

   9. Select the Sign On tab and under the OpenID Connect ID Token area, select Edit.
   10. From the Groups claim type drop-down menu, select Expression. By default, Groups claim type is set to Filter.
   11. In the Groups claim expression textbox, enter the claim name that will be used in the token, and an Okta input expression statement that evaluates the token.
   12. Select Save. The application is setup in IDP. You can assign user groups and users to your Orchestrator application.

       

3. To assign groups and users to your Orchestrator application:
   1. Go to Application and select your Orchestrator application link.
   2. On the Assignments tab, from the Assign drop-down menu, select Assign to Groups or Assign to People. The Assign > Application > Assign to Groups or Assign > Application > Assign to People dialog box appears.
   3. Select Assign next to available user groups or users you want to assign the Orchestrator application and select Done. The users or user groups assigned to the Orchestrator application will be displayed.