diff --git a/docs/documentation/platform/sso/azure.mdx b/docs/documentation/platform/sso/azure.mdx
index b280feaa9..20137c19b 100644
--- a/docs/documentation/platform/sso/azure.mdx
+++ b/docs/documentation/platform/sso/azure.mdx
@@ -10,97 +10,97 @@ description: "Configure Azure SAML for Infisical SSO"
then you should contact team@infisical.com to purchase an enterprise license to use it.
-1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
- Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application.
+
+
+ In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
-
+ Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application.
-2. In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select
- **+ New application**.
+ 
+
+
+ In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select **+ New application**.
-
+ 
-
+ 
+
+ On the next screen, press the **+ Create your own application** button.
+ Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)"
+ option and hit the **Create** button.
-2. On the next screen, press the **+ Create your own application** button.
- Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)"
- option and hit the **Create** button.
+ 
-
+ On the application overview screen, select **Single sign-on** from the left sidebar. From there, select the **SAML** single sign-on method.
-3. On the application overview screen, select **Single sign-on** from the left sidebar. From there,
- select the **SAML** single sign-on method.
+ 
-
+ Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)** to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1.
-4. Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)**
- to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1.
+ 
-
+ 
-
+
+ If you're self-hosting Infisical, then you will want to replace
+ `https://app.infisical.com` with your own domain.
+
-
- If you're self-hosting Infisical, then you will want to replace
- `https://app.infisical.com` with your own domain.
-
+ Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map:
-5. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map:
+ - `email -> user.userprinciplename`
+ - `firstName -> user.firstName`
+ - `lastName -> user.lastName`
-- `email -> user.userprinciplename`
-- `firstName -> user.firstName`
-- `lastName -> user.lastName`
+ 
-
+ 
-
+ Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**.
-6. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**.
+ 
-
+ 
+
+
+ In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical.
-
+ 
-7. Get IdP values:
+ In the **Properties** screen, copy the **Application ID** to use when finishing configuring Azure SAML in Infisical.
-In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical.
+ 
+
+
+ Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration.
-
+ 
-In the **Properties** screen, copy the **Application ID** to use when finishing configuring Azure SAML in Infisical.
+
+ When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
+ CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
+ of the text area respectively.
-
+ Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure.
-Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from above. Once you've done that, press **Update** to complete the required configuration.
+
+
+
+ Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level.
+
+ 
+
+
+ Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure.
-
-
-
-When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
- CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
- of the text area respectively.
-
-Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure.
-
-
-
-7. Assignments
-
-Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level.
-
-
-8. Return to Infisical and enable SAML SSO.
-
-Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure.
-
-
+ 
+
+
If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
- set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
+ set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
- - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
+ - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
-
-
-
+
\ No newline at end of file
diff --git a/docs/documentation/platform/sso/github.mdx b/docs/documentation/platform/sso/github.mdx
index faab5a074..87d1b3cf7 100644
--- a/docs/documentation/platform/sso/github.mdx
+++ b/docs/documentation/platform/sso/github.mdx
@@ -5,38 +5,39 @@ description: "Configure GitHub SSO for Infisical"
Using GitHub SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GitHub and registering your instance with it.
-## Create an OAuth application in GitHub
+
+
+ Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
-Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
+ 
+ 
+ 
-
-
-
+ Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
+ and the **Authorization callback URL** to `https://your-domain.com/api/v1/sso/github`.
-Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
-and the **Authorization callback URL** to `https://your-domain.com/api/v1/sso/github`.
+ 
-
+
+ If you have a GitHub organization, you can create an OAuth application under it
+ in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
+
+
+
+ Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
-
- If you have a GitHub organization, you can create an OAuth application under it
- in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
-
+ 
-## Add your OAuth application credentials to Infisical
+ Back in your Infisical instance, make sure to set the following environment variables:
-Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
-
-
-
-Back in your Infisical instance, make sure to set the following environment variables:
-
-- `CLIENT_ID_GITHUB_LOGIN`: The **Client ID** of your GitHub OAuth application.
-- `CLIENT_SECRET_GITHUB_LOGIN`: The **Client Secret** of your GitHub OAuth application.
-- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
-- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
-
-Once added, restart your Infisical instance and log in with GitHub.
+ - `CLIENT_ID_GITHUB_LOGIN`: The **Client ID** of your GitHub OAuth application.
+ - `CLIENT_SECRET_GITHUB_LOGIN`: The **Client Secret** of your GitHub OAuth application.
+ - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
+ - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+
+ Once added, restart your Infisical instance and log in with GitHub.
+
+
## FAQ
@@ -45,7 +46,7 @@ Once added, restart your Infisical instance and log in with GitHub.
It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
- Check that you have set the `CLIENT_ID_GITHUB_LOGIN`, `CLIENT_SECRET_GITHUB_LOGIN`,
- `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
+ `AUTH_SECRET`, and `SITE_URL` environment variables.
- Check that the **Authorization callback URL** specified in GitHub matches the `SITE_URL` environment variable.
For example, if the former is `https://app.infisical.com/api/v1/sso/github` then the latter should be `https://app.infisical.com`.
diff --git a/docs/documentation/platform/sso/gitlab.mdx b/docs/documentation/platform/sso/gitlab.mdx
index 7ae6e4a95..446758ae0 100644
--- a/docs/documentation/platform/sso/gitlab.mdx
+++ b/docs/documentation/platform/sso/gitlab.mdx
@@ -5,38 +5,39 @@ description: "Configure GitLab SSO for Infisical"
Using GitLab SSO on a self-hosted instance of Infisical requires configuring an OAuth application in GitLab and registering your instance with it.
-## Create an OAuth application in GitLab
+
+
+ Navigate to your user Settings > Applications to create a new GitLab application.
-Navigate to your user Settings > Applications to create a new GitLab application.
+ 
+ 
-
-
+ Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/api/v1/sso/gitlab`.
+ Note that only `read_user` is required as part of the **Scopes** configuration.
-Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/api/v1/sso/gitlab`.
-Note that only `read_user` is required as part of the **Scopes** configuration.
+ 
-
+
+ If you have a GitLab group, you can create an OAuth application under it
+ in your group Settings > Applications.
+
+
+
+ Obtain the **Application ID** and **Secret** for your GitLab application.
-
- If you have a GitLab group, you can create an OAuth application under it
- in your group Settings > Applications.
-
+ 
-## Add your OAuth application credentials to Infisical
+ Back in your Infisical instance, make sure to set the following environment variables:
-Obtain the **Application ID** and **Secret** for your GitLab application.
-
-
-
-Back in your Infisical instance, make sure to set the following environment variables:
-
-- `CLIENT_ID_GITLAB_LOGIN`: The **Client ID** of your GitLab application.
-- `CLIENT_SECRET_GITLAB_LOGIN`: The **Secret** of your GitLab application.
-- (optional) `URL_GITLAB_LOGIN`: The URL of your self-hosted instance of GitLab where the OAuth application is registered. If no URL is passed in, this will default to `https://gitlab.com`.
-- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
-- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
-
-Once added, restart your Infisical instance and log in with GitLab.
+ - `CLIENT_ID_GITLAB_LOGIN`: The **Client ID** of your GitLab application.
+ - `CLIENT_SECRET_GITLAB_LOGIN`: The **Secret** of your GitLab application.
+ - (optional) `URL_GITLAB_LOGIN`: The URL of your self-hosted instance of GitLab where the OAuth application is registered. If no URL is passed in, this will default to `https://gitlab.com`.
+ - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
+ - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+
+ Once added, restart your Infisical instance and log in with GitLab.
+
+
## FAQ
@@ -45,7 +46,7 @@ Once added, restart your Infisical instance and log in with GitLab.
It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
- Check that you have set the `CLIENT_ID_GITLAB_LOGIN`, `CLIENT_SECRET_GITLAB_LOGIN`,
- `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
+ `AUTH_SECRET`, and `SITE_URL` environment variables.
- Check that the **Redirect URI** specified in GitLab matches the `SITE_URL` environment variable.
For example, if the former is `https://app.infisical.com/api/v1/sso/gitlab` then the latter should be `https://app.infisical.com`.
diff --git a/docs/documentation/platform/sso/google.mdx b/docs/documentation/platform/sso/google.mdx
index 2546a5be8..cf35dcb68 100644
--- a/docs/documentation/platform/sso/google.mdx
+++ b/docs/documentation/platform/sso/google.mdx
@@ -5,31 +5,32 @@ description: "Configure Google SSO for Infisical"
Using Google SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GCP and registering your instance with it.
-## Create an OAuth2 application in GCP
+
+
+ Navigate to your project API & Services > Credentials to create a new OAuth2 application.
+
+ 
+ 
-Navigate to your project API & Services > Credentials to create a new OAuth2 application.
-
-
-
+ Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/api/v1/sso/google`.
-Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/api/v1/sso/google`.
+ 
+
+
+ Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application.
-
+ 
+
+ Back in your Infisical instance, make sure to set the following environment variables:
-## Add your OAuth2 application credentials to Infisical
-
-Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application.
-
-
-
-Back in your Infisical instance, make sure to set the following environment variables:
-
-- `CLIENT_ID_GOOGLE_LOGIN`: The **Client ID** of your GCP OAuth2 application.
-- `CLIENT_SECRET_GOOGLE_LOGIN`: The **Client Secret** of your GCP OAuth2 application.
-- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
-- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
-
-Once added, restart your Infisical instance and log in with Google
+ - `CLIENT_ID_GOOGLE_LOGIN`: The **Client ID** of your GCP OAuth2 application.
+ - `CLIENT_SECRET_GOOGLE_LOGIN`: The **Client Secret** of your GCP OAuth2 application.
+ - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
+ - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
+
+ Once added, restart your Infisical instance and log in with Google
+
+
## FAQ
@@ -38,7 +39,7 @@ Once added, restart your Infisical instance and log in with Google
It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
- Check that you have set the `CLIENT_ID_GOOGLE_LOGIN`, `CLIENT_SECRET_GOOGLE_LOGIN`,
- `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
+ `AUTH_SECRET`, and `SITE_URL` environment variables.
- Check that the **Authorized redirect URI** specified in GCP matches the `SITE_URL` environment variable.
For example, if the former is `https://app.infisical.com/api/v1/sso/google` then the latter should be `https://app.infisical.com`.
diff --git a/docs/documentation/platform/sso/jumpcloud.mdx b/docs/documentation/platform/sso/jumpcloud.mdx
index 4c2908416..e9ffb4f5e 100644
--- a/docs/documentation/platform/sso/jumpcloud.mdx
+++ b/docs/documentation/platform/sso/jumpcloud.mdx
@@ -10,73 +10,77 @@ description: "Configure JumpCloud SAML for Infisical SSO"
then you should contact team@infisical.com to purchase an enterprise license to use it.
-1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
- Next, copy the **ACS URL** and **SP Entity ID** to use when configuring the JumpCloud SAML application.
+
+
+ In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
-
+ Next, copy the **ACS URL** and **SP Entity ID** to use when configuring the JumpCloud SAML application.
-2. In the JumpCloud Admin Portal, navigate to User Authentication > SSO and create an application. If this is your first application, select **Get Started**;
- if not, select **+Add New Application**
+ 
+
+
+ 2.1. In the JumpCloud Admin Portal, navigate to User Authentication > SSO and create an application. If this is your first application, select **Get Started**; if not, select **+Add New Application**
-
+ 
-3. Next, select **Custom SAML App** to open up the **New SSO** dialog.
+ 2.2. Next, select **Custom SAML App** to open up the **New SSO** dialog.
-
+ 
-4. In the **General Info** tab, give the application a unique name like Infisical.
+ 2.3. In the **General Info** tab, give the application a unique name like Infisical.
-
+ 
-5. In the **SSO** tab, set the **SP Entity ID** and **ACS URL** from step 1; set the **IdP Entity ID** to the same value as the **SP Entity ID**.
+ 2.4. In the **SSO** tab, set the **SP Entity ID** and **ACS URL** from step 1; set the **IdP Entity ID** to the same value as the **SP Entity ID**.
-
+ 
-6. On the same tab, check the **Sign Assertion** checkbox and fill the **IDP URL** to something unique.
- Copy the **IDP URL** to use when finishing configuring the JumpCloud SAML in Infisical.
+ 2.5. On the same tab, check the **Sign Assertion** checkbox and fill the **IDP URL** to something unique.
+ Copy the **IDP URL** to use when finishing configuring the JumpCloud SAML in Infisical.
-
+ 
-7. On the same tab, in the **Attributes** section, configure the following map:
+ 2.6. On the same tab, in the **Attributes** section, configure the following map:
-- `email -> email`
-- `firstName -> firstname`
-- `lastName -> lastname`
+ - `email -> email`
+ - `firstName -> firstname`
+ - `lastName -> lastname`
-
+ 
-Finally press activate to create the SAML application.
+ Finally press activate to create the SAML application.
-8. Next, select the newly created SAML application and select **Download certificate** under the **IDP Certificate Valid** dropdown
+ 2.7. Next, select the newly created SAML application and select **Download certificate** under the **IDP Certificate Valid** dropdown
-
+ 
+
+
+ Back in Infisical, set the **IDP URL** from step 2.5 and the **IdP Entity ID** from step 2.4. Also, paste the certificate from the previous step.
-9. Back in Infisical, set the **IDP URL** from step 6 and the **IdP Entity ID** from step 5. Also, paste the certificate from the previous step.
+ 
-
+
+ When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
+ CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
+ of the text area respectively.
+
+
+
+ Back in JumpCloud, navigate to the **User Groups** tab and assign users to the newly created application.
-
- When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
- CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
- of the text area respectively.
-
+ 
+
+
+ Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via JumpCloud.
-10. Assignments
-
-Back in JumpCloud, navigate to the **User Groups** tab and assign users to the newly created application.
-
-
-
-11. Return to Infisical and enable SAML SSO.
-
-Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via JumpCloud.
-
-
+ 
+
+
If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
- set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
+ set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
- - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
+ - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
diff --git a/docs/documentation/platform/sso/okta.mdx b/docs/documentation/platform/sso/okta.mdx
index f5db2529c..c07aca9ac 100644
--- a/docs/documentation/platform/sso/okta.mdx
+++ b/docs/documentation/platform/sso/okta.mdx
@@ -10,78 +10,80 @@ description: "Configure Okta SAML 2.0 for Infisical SSO"
then you should contact team@infisical.com to purchase an enterprise license to use it.
-1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
- Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application.
+
+
+ In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
+
+ Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application.
+ 
+
+
+ In the Okta Admin Portal, select Applications > Applications from the navigation. On the Applications screen, select the **Create App Integration**
+ button.
-
+ 
+
+ In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
-2. In the Okta Admin Portal, select Applications > Applications from the
- navigation. On the Applications screen, select the **Create App Integration**
- button.
+ 
+
+ On the General Settings screen, give the application a unique name like Infisical and select **Next**.
+
+ 
+
+ On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1.
-
+ 
+
+
+ If you're self-hosting Infisical, then you will want to replace
+ `https://app.infisical.com` with your own domain.
+
+
+ Also on the Configure SAML screen, configure the **Attribute Statements** to map:
-3. In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
+ - `id -> user.id`,
+ - `email -> user.email`,
+ - `firstName -> user.firstName`
+ - `lastName -> user.lastName`
-
+ 
-4. On the General Settings screen, give the application a unique name like Infisical and select **Next**.
+ Once configured, select **Next** to proceed to the Feedback screen and select **Finish**.
+
+
+ Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen:
-
+ 
-5. On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1.
+ Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical.
-
+ 
+
+
+ Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**,
+ and **Certificate** to **X.509 Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration.
-
- If you're self-hosting Infisical, then you will want to replace
- `https://app.infisical.com` with your own domain.
-
+ 
+
+
+ Back in Okta, navigate to the **Assignments** tab and select **Assign**. You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
-6. Also on the Configure SAML screen, configure the **Attribute Statements** to map:
+ 
-- `id -> user.id`,
-- `email -> user.email`,
-- `firstName -> user.firstName`
-- `lastName -> user.lastName`
+ At this point, you have configured everything you need within the context of the Okta Admin Portal.
+
+
+ Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.
-
-
-Once configured, select **Next** to proceed to the Feedback screen and select **Finish**.
-
-7. Get IdP values
-
-Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen:
-
-
-
-Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical.
-
-
-
-Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**,
-and **Certificate** to **X.509 Certificate** from above. Once you've done that, press **Update** to complete the required configuration.
-
-
-
-8. Finally, navigate to the **Assignments** tab and select **Assign**
-
-You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
-
-
-
-At this point, you have configured everything you need within the context of the Okta Admin Portal.
-
-9. Return to Infisical and enable SAML SSO.
-
-Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.
-
-
+ 
+
+
If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
- set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
+ set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
- - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
+ - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
\ No newline at end of file