diff --git a/docs/documentation/platform/sso/auth0-oidc.mdx b/docs/documentation/platform/sso/auth0-oidc.mdx index bde87f42f..e8b532c1c 100644 --- a/docs/documentation/platform/sso/auth0-oidc.mdx +++ b/docs/documentation/platform/sso/auth0-oidc.mdx @@ -45,6 +45,10 @@ description: "Learn how to configure Auth0 OIDC for Infisical SSO." 3.2. For configuration type, select **Discovery URL**. Then, set **Discovery Document URL**, **JWT Signature Algorithm**, **Client ID**, and **Client Secret** from step 2.1 and 2.2. ![OIDC auth0 paste values into Infisical](../../../images/sso/auth0-oidc/org-update-oidc.png) + + Currently, the following JWT signature algorithms are supported: RS256, RS512, HS256, and EdDSA + + Once you've done that, press **Update** to complete the required configuration. diff --git a/docs/documentation/platform/sso/general-oidc.mdx b/docs/documentation/platform/sso/general-oidc.mdx index 11216b893..76e364b2f 100644 --- a/docs/documentation/platform/sso/general-oidc.mdx +++ b/docs/documentation/platform/sso/general-oidc.mdx @@ -44,7 +44,9 @@ Prerequisites: To configure OIDC via the custom endpoints, set the **Configuration Type** field to **Custom** and input the required endpoint fields. ![OIDC general custom config](../../../images/sso/general-oidc/custom-oidc-form.png) - 2.3. Optionally, you can define a whitelist of allowed email domains. + 2.3. Select the appropriate JWT signature algorithm for your IdP. Currently, the supported options are RS256, RS512, HS256, and EdDSA. + + 2.4. Optionally, you can define a whitelist of allowed email domains. Finally, fill out the **Client ID** and **Client Secret** fields and press **Update** to complete the required configuration. diff --git a/docs/documentation/platform/sso/keycloak-oidc/overview.mdx b/docs/documentation/platform/sso/keycloak-oidc/overview.mdx index 6d8f4e4c8..803818a0e 100644 --- a/docs/documentation/platform/sso/keycloak-oidc/overview.mdx +++ b/docs/documentation/platform/sso/keycloak-oidc/overview.mdx @@ -72,6 +72,10 @@ description: "Learn how to configure Keycloak OIDC for Infisical SSO." 3.2. For configuration type, select Discovery URL. Then, set the appropriate values for **Discovery Document URL**, **JWT Signature Algorithm**, **Client ID**, and **Client Secret**. ![OIDC keycloak paste values into Infisical](/images/sso/keycloak-oidc/create-oidc.png) + + Currently, the following JWT signature algorithms are supported: RS256, RS512, HS256, and EdDSA + + Once you've done that, press **Update** to complete the required configuration. diff --git a/docs/documentation/platform/sso/overview.mdx b/docs/documentation/platform/sso/overview.mdx index 0d4b8da89..e5d5e5c16 100644 --- a/docs/documentation/platform/sso/overview.mdx +++ b/docs/documentation/platform/sso/overview.mdx @@ -35,6 +35,10 @@ Infisical supports these and many other identity providers: If your required identity provider is not shown in the list above, please reach out to [team@infisical.com](mailto:team@infisical.com) for assistance. + + For enhanced security, Infisical enforces PKCE (Proof Key for Code Exchange) with the OAuth 2.0-based SSO providers and OIDC. This provides additional protection against authorization code interception attacks and strengthens your authentication flow security. + + ## FAQ diff --git a/docs/images/sso/general-oidc/custom-oidc-form.png b/docs/images/sso/general-oidc/custom-oidc-form.png index 2aee02680..92a7a056d 100644 Binary files a/docs/images/sso/general-oidc/custom-oidc-form.png and b/docs/images/sso/general-oidc/custom-oidc-form.png differ diff --git a/docs/images/sso/general-oidc/discovery-oidc-form.png b/docs/images/sso/general-oidc/discovery-oidc-form.png index ae99b35b2..fb0daf1e7 100644 Binary files a/docs/images/sso/general-oidc/discovery-oidc-form.png and b/docs/images/sso/general-oidc/discovery-oidc-form.png differ