From 6db797a67c3f873546ecb4e82da2fdab6c2965c6 Mon Sep 17 00:00:00 2001
From: Tim Hansen <timbonicus@gmail.com>
Date: Tue, 6 Apr 2021 20:38:12 -0600
Subject: [PATCH] Add OneLogin auth documentation

Signed-off-by: Tim Hansen <timbonicus@gmail.com>
---
 docs/auth/index.md             |  2 +-
 docs/auth/onelogin/provider.md | 54 ++++++++++++++++++++++++++++++++++
 microsite/sidebars.json        |  3 +-
 3 files changed, 57 insertions(+), 2 deletions(-)
 create mode 100644 docs/auth/onelogin/provider.md

diff --git a/docs/auth/index.md b/docs/auth/index.md
index 6e3747dd25..fc6ce33e2b 100644
--- a/docs/auth/index.md
+++ b/docs/auth/index.md
@@ -22,7 +22,7 @@ Backstage comes with many common authentication providers in the core library:
 - [GitLab](gitlab/provider.md)
 - [Google](google/provider.md)
 - [Okta](okta/provider.md)
-- OneLogin
+- [OneLogin](onelogin/provider.md)
 
 These built-in providers handle the authentication flow for a particular service
 including required scopes, callbacks, etc. These providers are each added to a
diff --git a/docs/auth/onelogin/provider.md b/docs/auth/onelogin/provider.md
new file mode 100644
index 0000000000..62c1657fea
--- /dev/null
+++ b/docs/auth/onelogin/provider.md
@@ -0,0 +1,54 @@
+---
+id: provider
+title: OneLogin Authentication Provider
+sidebar_label: OneLogin
+description: Adding OneLogin OIDC as an authentication provider in Backstage
+---
+
+The Backstage `core-api` package comes with a OneLogin authentication provider
+that can authenticate users using OpenID Connect.
+
+## Create an Application on OneLogin
+
+To support OneLogin authentication, you must create an Application:
+
+1. From the OneLogin Admin portal, choose Applications
+2. Click `Add App` and select `OpenID Connect`
+   - Display Name: Backstage (or your custom app name)
+3. Click Save
+4. Go to the Configuration tab for the Application and set:
+   - `Login Url`: `http://localhost:3000`
+   - `Redirect URIs`: `http://localhost:7000/api/auth/onelogin/handler/frame`
+5. Click Save
+6. Go to the SSO tab for the Application and set:
+   - `Token Endpoint` > `Authentication Method`: `POST`
+7. Click Save
+
+## Configuration
+
+The provider configuration can then be added to your `app-config.yaml` under the
+root `auth` configuration:
+
+```yaml
+auth:
+  environment: development
+  providers:
+    onelogin:
+      development:
+        clientId: ${AUTH_ONELOGIN_CLIENT_ID}
+        clientSecret: ${AUTH_ONELOGIN_CLIENT_SECRET}
+        issuer: https://<company>.onelogin.com/oidc/2
+```
+
+The OneLogin provider is a structure with three configuration keys; **these are
+found on the SSO tab** for the OneLogin Application:
+
+- `clientId`: The client ID
+- `clientSecret`: The client secret
+- `issuer`: The issuer URL
+
+## Adding the provider to the Backstage frontend
+
+To add the provider to the frontend, add the `oneloginAuthApi` reference and
+`SignInPage` component as shown in
+[Adding the provider to the sign-in page](../index.md#adding-the-provider-to-the-sign-in-page).
diff --git a/microsite/sidebars.json b/microsite/sidebars.json
index 0a438b7653..3eb887d357 100644
--- a/microsite/sidebars.json
+++ b/microsite/sidebars.json
@@ -195,7 +195,8 @@
           "auth/github/provider",
           "auth/gitlab/provider",
           "auth/google/provider",
-          "auth/okta/provider"
+          "auth/okta/provider",
+          "auth/onelogin/provider"
         ]
       },
       "auth/add-auth-provider",