SSO

Single-Sign-On (via SAML2) is available on OpenReplay Enterprise Edition only.

In you Identity Provider’s dashboard, create a new app called openreplay (you can use this icon), In the configuration page, make sure to set the following value (please make sure to replace YOUR_DOMAIN with the correct value, example https://openreplay.mycompany.com):

In the ‘Attribute Statements’, or the ‘Parameters’ section, please make sure to define the following fields:

You should now have all the required values for the next step/section.

To enable SSO, edit openreplay/scripts/helmcharts/vars.yaml and uncomment then update the below env variables in chalice section:

Then, reinstall the web server for the changes to take effect:

cd openreplay/scripts/helmcharts && ./openreplay-cli -I

1. Login to your Okta administration dashboard and go to ‘Applications’ > ‘Applications’
2. Press ‘Create new app integration’, then select SAML 2.0 and press ‘Next’
3. Set the ‘App Name’ to OpenReplay (you can upload this icon) for your application) then press ‘Next’
4. Set:

• Single sign on URL to YOUR_DOMAIN/api/sso/saml2/acs/
• Audience URI (SP Entity ID) to YOUR_DOMAIN/api/sso/saml2/metadata/
• Name ID format to EmailAddress

5. Define the below fields in ‘Attribute Statements’:

• tenantKey: format Basic and set the value to TENANT_KEY, found in OpenReplay dashboard under ‘Preferences’ > ‘Account’
• firstName: format Basic and set the value to user.firstName
• lastName: format Basic and set the value to user.lastName
• internalId: format Basic and set the value to user.email

6. Define the below field in ‘Group Attribute Statements’:

• role: format Basic filter Match Regex value .* (or you can specify a different filter and regex according to your needs)
• adminPrivileges: format Basic filter Match Regex value admin (the current user will have admin privileges if he is part of the admin group)

7. Press Next, Select ‘I’m an Okta customer adding an internal app’ and ‘This is an internal app that we have created’ then press ‘Finish’
8. In the Sign On tab, scroll down and press ‘View Setup Instructions’ to see you SAML2 configuration
9. In your server, edit your openreplay/scripts/helmcharts/vars.yaml
10. Under the chalice section, uncomment then set the following env variables:

• idp_entityId: Identity Provider Issuer
• idp_sso_url: Identity Provider Single Sign-On URL
• idp_x509cert: X.509 Certificate, must be a one-line string, without line breaks (you can use this tool to format your value)
• idp_name: Okta

12. Finally, save your changes and reinstall the web server:

cd openreplay/scripts/helmcharts && ./openreplay-cli -I

1. In the Google Admin console, go to ‘Directory’ > ‘Users’ > ‘More options’ > ‘Manage custom attributes’.
2. Click ‘Add Custom Attribute’.
3. Set the following fields:

• Category: ‘OpenReplay’
• Custom fields:
• Name: ‘role’
• Info type: ‘Text’
• Visibility: ‘Visible to user and admin’
• No. of values: ‘Single-value’
• Custom fields:
• Name: ‘adminPrivileges’
• Info type: ‘Yes or No’
• Visibility: ‘Visible to user and admin’
• No. of values: ‘Single-value’

4. Click ‘Add’
5. To add values to the new custom attributes, go to ‘Users’
6. Select the desired user(s)
7. Click on ‘User information’ then edit the ‘OpenReplay’ section
8. Change the value of role to the desired role in ‘OpenReplay’ (the role should match the one created in OpenReplay dashboard under ‘Preferences’ > ‘Roles’)
9. Change the value of adminPrivileges to ‘Yes’ if the user is allowed to have Admin Privileges in OpenReplay
10. Click ‘Save’

1. Login to your Google Admin Console and go to ‘Apps’
2. Press ‘Web and mobile apps’ then click ‘Add app’ > ‘Add custom SAML app’
3. Set the ‘App name’ to OpenReplay (you can upload this icon for ‘App icon”) then press ‘Continue’
4. Copy ‘SSO URL’, ‘Entity ID’ and ‘Certificate’ then click ‘Continue’ (we will use these values in step 11)
5. Set:

• ACS URL to YOUR_DOMAIN/api/sso/saml2/acs/TENANT_KEY/ (TENANT_KEY is found in OpenReplay dashboard under ‘Preferences’ > ‘Account’)
• Entity ID to YOUR_DOMAIN/api/sso/saml2/metadata/
• Name ID format to Email
• Name ID to Basic information > Primary Email

6. Click ‘Continue’ then hit ‘Add Mapping’ to add the below attributes:

• Basic information > First Name -> firstName
• Basic information > Last Name -> lastName
• Basic information > Primary Email -> internalId
• OpenReplay > role -> role
• OpenReplay > adminPrivileges -> adminPrivileges

7. Click ‘Finish’
8. In the Google Admin Console, go to ‘Apps’ > ‘Web and mobile apps’ and select ‘OpenReplay’
9. Click ‘User access’, select ‘ON for everyone’ then hit ‘Save’
10. In your server, go to openreplay/scripts/helmcharts and edit vars.yaml
11. Under the chalice > env section, uncomment and set the following attributes using the values from step 4:

• idp_sso_url: paste the value of ‘SSO URL’
• idp_entityId: paste the value of ‘Entity ID’
• idp_x509cert: use this tool to format the copied/downloaded certificate
• idp_name: set the value to G-Suite
• idp_tenantKey: TENANT_KEY found in OpenReplay dashboard under ‘Preferences’ > ‘Account’

15. Finally, save your changes and reinstall the web server:

cd openreplay/scripts/helmcharts && ./openreplay-cli -I

1. Login to your JumpCloud administration dashboard and in the left menu, go to ‘SSO’
2. Press ’+ Add New Application’, then select ‘Custom SAML App’
3. Set the ‘Display Label’ to OpenReplay (you can upload this icon for your application) then move to ‘SSO’ tab
4. Set:

• IdP Entity ID to openreplay/TENANT_KEY
• SP Entity ID to YOUR_DOMAIN/api/sso/saml2/metadata/
• ACS URL to YOUR_DOMAIN/api/sso/saml2/acs/
• SAMLSubject NameID to email
• SAMLSubject NameID Format: to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
• Signature Algorithm to RSA-SHA256
• Check Sign Assertion
• IDP URL to end with openreplay-TENANT_KEY (this value cannot be changed later)

5. Define the below fields in ‘USER ATTRIBUTE MAPPING’ by pressing the ‘add attribute’ button:

• firstName: set the value to firstname
• lastName: set the value to lastname
• internalId: set the value to email
• role: optional, the user’s role in OpenReplay, if it is a constant value for all users, you should define it in the next step, otherwise you have to add a new string-attribute to the JumpCloud’s group, call it OpenReplayRole and set the value to the role’s name, and then in the SSO configuration, select ‘Custom User or Group Attribute’ and set the value to OpenReplayRole.
• adminPrivileges: optional, if it is a constant value for all users, you should define it in the next step, otherwise you have to add a new boolean-attribute to the JumpCloud’s group, call it OpenReplayAdminPrivileges and set the value to the role’s name, and then in the SSO configuration, select ‘Custom User or Group Attribute’ and set the value to OpenReplayAdminPrivileges.

6. Define the below fields in ‘CONSTANT ATTRIBUTES’ by pressing the ‘add attribute’ button:

• tenantKey: set the value to TENANT_KEY, found in OpenReplay dashboard under ‘Preferences’ > ‘Account’
• role: optional, ignore if defined in the previous step, the user’s role in OpenReplay, should match role name already defined in OpenReplay (default = member)
• adminPrivileges: optional, ignore if defined in the previous step, set the value to true if you want to give new users admin privilege, false if not (default = false)

7. At this stage, you can move to the ‘User Groups’ tab, and select the group of users that will have access to OpenReplay, or you can do it later
8. Press ‘activate’ and ‘continue’ in the confirmation popup
9. Press the new OpenReplay application icon, then on the left dropdown ‘IDP Certificate Valid’ choose ‘Download certificate’
10. In your server, edit your openreplay/scripts/helmcharts/vars.yaml
11. Under the chalice section, uncomment then set the following env variables:

• idp_entityId: openreplay/TENANT_KEY
• idp_sso_url: https://sso.jumpcloud.com/saml2/openreplay-TENANT_KEY
• idp_x509cert: the downloaded certificate, must be a one-line string, without line breaks (you can use this tool to format your value)
• idp_name: JumpCloud

12. Finally, save your changes and reinstall the web server:

cd openreplay/scripts/helmcharts && ./openreplay-cli -I

If you have any questions about this process, feel free to reach out to us on our Slack or check out our Forum.