1. Login to the SASE Orchestrator as a Partner.
2. In the Partner portal, select Administration from the top menu.
3. From the left menu, select User Management. The Users tab is displayed by default.
4. Select New User.

   

5. Enter the following details for the new user:
   Note: The Next button is activated only when you enter all the mandatory details in each section.

   Table 3. User Parameters

   Option	Description
   General information	Enter the required personal details of the user.
   Role	Select a role that you want to assign to the user. For information on roles, see Roles.
   Edge Access	Choose one of the following options: Basic: Allows you to perform certain basic debug operations such as ping, tcpdump, PCAP, remote diagnostics, and so on. Privileged: Grants you the root-level access to perform all basic debug operations along with Edge actions such as restart, deactivate, reboot, hard reset, and shutdown. In addition, you can access Linux shell. The default value is Basic.

6. Select the Add another user check box if you wish to create another user, and then select Add User. The new user appears in the User Management > Users page. Select the link to the user to view or modify the details. As a Partner Administrator, you can manage the Roles, Service Permissions, and API Tokens for the Partner users. For additional information on API Tokens, see API Tokens.
   Note: Partner Administrator should manually delete inactive Identity Provider (IdP) users from the Orchestrator to prevent unauthorized access via API Token.

• Enterprise users can Create, Download, and Revoke tokens for them.
• Partner Super users can manage tokens of Enterprise users, if the Enterprise user has delegated user permissions to the Partner.
• Partner Super users can only create and revoke the tokens for other users.
• Users can download only their own tokens and cannot download other users' tokens.

1. Login to the SASE Orchestrator as a Partner and navigate to Administration > User Management > Users .
2. Select a user and select Modify or select the link to the username. Go to the API Tokens section.

   

3. Select New API Token.

   

4. In the New Token window, enter a Name and Description for the token, and then choose the Lifetime from the drop-down menu.
5. Select Save. The new token is displayed in the API Tokens table. Initially, the status of the token is displayed as Pending. Once you download it, the status changes to Enabled.
6. To deactivate a token, select the token, and then select Revoke API Token. The status of the token is displayed as Revoked.
7. Select CSV to download the complete list of API tokens in a .csv file format.
8. When the Lifetime of the token is over, the status changes to Expired.

curl -k -H "Authorization: Token <Token>" -X POST https://vco/portal/ -d '{ "id": 1, "jsonrpc": "2.0", "method": "enterprise/getEnterpriseUsers", "params": { "enterpriseId": 1 }}'

1. Login to the SASE Orchestrator as a Partner.
2. Select Administration from the top menu.
3. From the left menu, select User Management, and then select the Roles tab.
4. Select Add Role.

   

5. Enter the following details for the new custom role:

   Table 8. Role Details

   Option	Description
   Role Details
   Role Name	Enter a name for the new role.
   Role Description	Enter a description for the role.
   Template	Optionally, select an existing role as template from the drop-down list. The privileges of the selected template are assigned to the new role.
   Scope	Select either Partner or Enterprise as the scope for the new role. A role with the Partner scope can be applied to Partner level Administrators for the current Partner. A role with the Enterprise scope appears in the role list for all of the Partner's Customers.
   Role Creation: The options in this section vary depending on the selected Scope.
   Global Settings & Administration	These privileges provide access to user management and global settings that are shared across all services. Choosing one of the privileges is mandatory. By default, Global Settings MSP Support is selected for the Partner scope. For the Enterprise scope, Global Settings Enterprise Read Only is selected by default.
   SD-WAN	These privileges provide the Partner or Enterprise Administrator with different levels of read and/or write access around SD-WAN configuration, monitoring, and diagnostics. You can optionally choose an SD-WAN privilege. The default value is No Privileges.
   Cloud Web Security	These privileges provide the Partner or Enterprise Administrator with different levels of access around Cloud Web Security features. You can optionally choose a Cloud Web Security privilege. The default value is No Privileges.
   Secure Access	These privileges provide the Partner or Enterprise Administrator with different levels of read and/or write access around Secure Access features. You can optionally choose a Secure Access function privilege. The default value is No Privileges.
   Multi Cloud	These privileges provide the Partner or Enterprise Administrator with different levels of read and/or write access around Multi Cloud features. You can optionally choose a Multi Cloud function privilege. The default value is No Privileges.
   App Catalog	These privileges provide the Partner or Enterprise Administrator with different levels of read and/or write access around App Catalog features. You can optionally choose an App Catalog function privilege. The default value is No Privileges.

6. Select Save Changes. The new custom role appears in the User Management > Roles page of the user, depending on the selected Scope. Select the link to the custom role to view the settings.

1. Login to the SASE Orchestrator as a Partner.
2. Select Administration from the top menu.
3. From the left menu, select User Management, and then select the Service Permissions tab.
4. Select New Permission. The following screen appears:

   

5. Enter the following details to create a new permission:

   Table 11. New Permission Option Descriptions

   Option	Description
   Name	Enter an appropriate name for the permission.
   Description	Enter a description. This field is optional.
   Scope	Select Partner or Enterprise as the scope. A Partner can customize the permissions for Partners and Customers.
   Service	Select a service from the drop-down menu. The available services are: Global Settings SD-WAN Cloud Web Security Secure Access Edge Network Intelligence App Catalog MCS Private Mobile Network
   Privilege Bundle	Select a privilege bundle from the drop-down menu. The privileges are populated depending on the selected Service.
   Privileges	Displays the list of privileges based on the selected Privilege Bundle. You can edit only those privileges that are eligible for customization.

6. Select Download CSV to download the list of all privileges, descriptions, and associated actions, into a file in CSV format.
7. Select Save to save the new permission. Select Save and Apply to save and publish the permission.
   Note: The Save and Save and Apply buttons are activated only after you modify the permissions.
   The new permission is displayed on the Service Permissions page.

1. Log in to your Microsoft Azure account as an Admin user. The Microsoft Azure home screen appears.
2. To create a new application:
   1. Search and select the Azure Active Directory service.

      

   2. Go to App registration > New registration . The Register an application screen appears.

      

   3. In the Name field, enter the name for your SASE Orchestrator application.
   4. In the Redirect URL field, enter the redirect URL that your SASE Orchestrator application uses as the callback endpoint.

      In the SASE Orchestrator application, at the bottom of the Configure Authentication screen, you can find the redirect URL link. Ideally, the SASE Orchestrator redirect URL will be in this format: https://<Orchestrator URL>/login/ssologin/openidCallback.

   5. Select Register. Your SASE Orchestrator application will be registered and displayed in the All applications and Owned applications tabs. Make sure to note down the Client ID/Application ID to be used during the SSO configuration in SASE Orchestrator.
   6. Select Endpoints and copy the well-known OIDC configuration URL to be used during the SSO configuration in SASE Orchestrator.
   7. To create a client secret for your SASE Orchestrator application, on the Owned applications tab, select your SASE Orchestrator application.
   8. Go to Certificates & secrets > New client secret . The Add a client secret screen appears.

      

   9. Provide details such as description and expiry value for the secret and select Add.

      The client secret is created for the application. Note down the new client secret value to be used during the SSO configuration in

      SASE Orchestrator.
   10. To configure permissions for your SASE Orchestrator application, select your SASE Orchestrator application and go to API permissions > Add a permission . The Request API permissions screen appears.

       

   11. Select Microsoft Graph and select Application permissions as the type of permission for your application.
   12. Under Select permissions, from the Directory drop-down menu, select Directory.Read.All and from the User drop-down menu, select User.Read.All.
   13. Select Add permissions.
   14. To add and save roles in the manifest, select your SASE Orchestrator application and from the application Overview screen, select Manifest. A web-based manifest editor opens, allowing you to edit the manifest within the portal. Optionally, you can select Download to edit the manifest locally, and then use Upload to reapply it to your application.

       

   15. In the manifest, search for the appRoles array and add one or more role objects as shown in the following example and select Save.
       Note: The value property from appRoles must be added to the Identity Provider Role Name column of the Role Map table, located on the Authentication tab, in order to map the roles correctly.
       Sample role objects

       { "allowedMemberTypes": [ "User" ], "description": "Standard Administrator who will have sufficient privilege to manage resource", "displayName": "Standard Admin", "id": "18fcaa1a-853f-426d-9a25-ddd7ca7145c1", "isEnabled": true, "lang": null, "origin": "Application", "value": "standard" }, { "allowedMemberTypes": [ "User" ], "description": "Super Admin who will have the full privilege on SASE Orchestrator", "displayName": "Super Admin", "id": "cd1d0438-56c8-4c22-adc5-2dcfbf6dee75", "isEnabled": true, "lang": null, "origin": "Application", "value": "superuser" }

       Note: Make sure to set id to a newly generated Global Unique Identifier (GUID) value. You can generate GUIDs online using web-based tools (for example, https://www.guidgen.com/), or by running the following commands:

       • Linux/OSX- uuidgen
       • Windows- powershell [guid]::NewGuid()

       

       Roles are manually set up in the SASE Orchestrator, and must match the ones configured in the Microsoft Azure portal.

       

3. To assign groups and users to your SASE Orchestrator application:
   1. Go to Azure Active Directory > Enterprise applications .
   2. Search and select your SASE Orchestrator application.
   3. Select Users and groups and assign users and groups to the application.
   4. Select Submit.

1. Log in to your OneLogin account as an Admin user. The OneLogin home screen appears.
2. To create a new application:
   1. In the upper navigation bar, select Apps > Add Apps .
   2. In the Find Applications text box, search for “OpenId Connect” or “oidc” and then select the OpenId Connect (OIDC) app. The Add OpenId Connect (OIDC) screen appears.

      

   3. In the Display Name text box, enter the name for your application and select Save.
   4. On the Configuration tab, enter the Login URL (auto-login URL for SSO) and the Redirect URI that SASE Orchestrator uses as the callback endpoint, and select Save.
      • Login URL- The login URL will be in this format: https://<Orchestrator URL>/<Domain>/ login/doEnterpriseSsoLogin. Where, <Domain> is the domain name of your Enterprise that you must have already set up to enable SSO authentication for the SASE Orchestrator. You can get the Domain name from the Enterprise portal > Administration > System Settings > General Information page.
      • Redirect URI's- The SASE Orchestrator redirect URL will be in this format: https://<Orchestrator URL>/login/ssologin/openidCallback. In the SASE Orchestrator application, at the bottom of the Authentication screen, you can find the redirect URL link.

      

   5. On the Parameters tab, under OpenId Connect (OIDC), double select Groups. The Edit Field Groups popup appears.

      

   6. Configure User Roles with value “--No transform--(Single value output)” to be sent in groups attribute and select Save.
   7. On the SSO tab, from the Application Type drop-down menu, select Web.
   8. From the Authentication Method drop-down menu, select POST as the Token Endpoint and select Save.

      Also, note down the Client Credentials (Client ID and Client Secret) to be used during the SSO configuration in SASE Orchestrator.

      

   9. On the Access tab, choose the roles allowed to login and select Save.

      

3. To add roles and users to your SASE Orchestrator application:
   1. Select Users > Users and select a user.
   2. On the Application tab, from the Roles drop-down menu, on the left, select a role to be mapped to the user.
   3. Select Save Users.

1. Log in to your PingOne account as an Admin user. The PingOne home screen appears.
2. To create a new application:
   1. In the upper navigation bar, select Applications.

      

   2. On the My Applications tab, select OIDC and then select Add Application. The Add OIDC Application pop-up window appears.

      

   3. Provide basic details such as name, short description, and category for the application and select Next.
   4. Under AUTHORIZATION SETTINGS, select Authorization Code as the allowed grant types and select Next.

      Also, note down the Discovery URL and Client Credentials (Client ID and Client Secret) to be used during the SSO configuration in SASE Orchestrator.

   5. Under SSO FLOW AND AUTHENTICATION SETTINGS, provide valid values for Start SSO URL and Redirect URL and select Next.

      In the SASE Orchestrator application, at the bottom of the Configure Authentication screen, you can find the redirect URL link. Ideally, the SASE Orchestrator redirect URL will be in this format: https://<Orchestrator URL>/login/ssologin/openidCallback. The Start SSO URL will be in this format: https://<Orchestrator URL>/<domain name>/login/doEnterpriseSsoLogin.

   6. Under DEFAULT USER PROFILE ATTRIBUTE CONTRACT, select Add Attribute to add additional user profile attributes.
   7. In the Attribute Name text box, enter group_membership and then select the Required checkbox, and select Next.
      Note: The group_membership attribute is required to retrieve roles from PingOne.
   8. Under CONNECT SCOPES, select the scopes that can be requested for your SASE Orchestrator application during authentication and select Next.
   9. Under Attribute Mapping, map your identity repository attributes to the claims available to your SASE Orchestrator application.
      Note: The minimum required mappings for the integration to work are email, given_name, family_name, phone_number, sub, and group_membership (mapped to memberOf).
   10. Under Group Access, select all user groups that should have access to your SASE Orchestrator application and select Done. The application will be added to your account and will be available in the My Application screen.