awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 15:27:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update SSO docs to use Mintlify steps

Browse Source
This commit is contained in:
Tuan Dang
2023-12-15 13:54:28 +07:00
parent 7aa3cb53a2
commit 14c8e3fa3b
6 changed files with 245 additions and 236 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/documentation/platform/sso/azure.mdx
+26 -26
View File
@@ -10,31 +10,32 @@ description: "Configure Azure SAML for Infisical SSO"
then you should contact [email protected] to purchase an enterprise license to use it.
</Info>
1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
<Steps>
<Step title="Prepare the SAML SSO configuration in Infisical">
In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application.
![Azure SAML initial configuration](../../../images/sso/azure/init-config.png)
2. In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select
**+ New application**.
</Step>
<Step title="Create a SAML application in Azure">
In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select **+ New application**.
![Azure SAML enterprise applications](../../../images/sso/azure/enterprise-applications.png)
![Azure SAML new application](../../../images/sso/azure/new-application.png)
2. On the next screen, press the **+ Create your own application** button.
On the next screen, press the **+ Create your own application** button.
Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)"
option and hit the **Create** button.
![Azure SAML create own application](../../../images/sso/azure/create-own-application.png)
3. On the application overview screen, select **Single sign-on** from the left sidebar. From there,
select the **SAML** single sign-on method.
On the application overview screen, select **Single sign-on** from the left sidebar. From there, select the **SAML** single sign-on method.
![Azure SAML sign on method](../../../images/sso/azure/sso-method.png)
4. Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)**
to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1.
Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)** to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1.
![Azure SAML edit basic configuration](../../../images/sso/azure/edit-basic-config.png)
@@ -45,7 +46,7 @@ description: "Configure Azure SAML for Infisical SSO"
`https://app.infisical.com` with your own domain.
</Note>
5. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map:
Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map:
- `email -> user.userprinciplename`
- `firstName -> user.firstName`
@@ -55,14 +56,13 @@ description: "Configure Azure SAML for Infisical SSO"
![Azure SAML edit attributes and claims 2](../../../images/sso/azure/edit-attributes-claims-2.png)
6. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**.
Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**.
![Azure SAML edit certificate](../../../images/sso/azure/edit-saml-certificate.png)
![Azure SAML edit certificate signing option](../../../images/sso/azure/edit-saml-certificate-2.png)
7. Get IdP values:
</Step>
<Step title="Retrieve Identity Provider (IdP) Information from Okta">
In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical.
![Azure SAML identity provider values 1](../../../images/sso/azure/idp-values.png)
@@ -70,8 +70,9 @@ In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **
In the **Properties** screen, copy the **Application ID** to use when finishing configuring Azure SAML in Infisical.
![Azure SAML identity provider values 2](../../../images/sso/azure/idp-values-2.png)
Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from above. Once you've done that, press **Update** to complete the required configuration.
</Step>
<Step title="Finish configuring SAML in Infisical">
Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration.
![Azure SAML paste identity provider values](../../../images/sso/azure/idp-values-3.png)
@@ -83,24 +84,23 @@ When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure.
</Note>
7. Assignments
</Step>
<Step title="Assign users in Azure to the application">
Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level.
![Azure SAML assignment](../../../images/sso/azure/assignment.png)
8. Return to Infisical and enable SAML SSO.
</Step>
<Step title="Enable SAML SSO in Infisical">
Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure.
![Azure SAML assignment](../../../images/sso/azure/enable-saml.png)
</Step>
</Steps>
<Note>
If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
- `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
</Note>
docs/documentation/platform/sso/github.mdx
+8 -7
View File
@@ -5,8 +5,8 @@ description: "Configure GitHub SSO for Infisical"
Using GitHub SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GitHub and registering your instance with it.
## Create an OAuth application in GitHub
<Steps>
<Step title="Create an OAuth application in GitHub">
Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application.
![GitHub settings](../../../images/sso/github/settings.png)
@@ -22,9 +22,8 @@ and the **Authorization callback URL** to `https://your-domain.com/api/v1/sso/gi
If you have a GitHub organization, you can create an OAuth application under it
in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App.
</Note>
## Add your OAuth application credentials to Infisical
</Step>
<Step title="Add your OAuth application credentials to Infisical">
Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application.
![GCP obtain OAuth2 credentials](../../../images/sso/github/credentials.png)
@@ -33,10 +32,12 @@ Back in your Infisical instance, make sure to set the following environment vari
- `CLIENT_ID_GITHUB_LOGIN`: The **Client ID** of your GitHub OAuth application.
- `CLIENT_SECRET_GITHUB_LOGIN`: The **Client Secret** of your GitHub OAuth application.
- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
Once added, restart your Infisical instance and log in with GitHub.
</Step>
</Steps>
## FAQ
@@ -45,7 +46,7 @@ Once added, restart your Infisical instance and log in with GitHub.
It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
- Check that you have set the `CLIENT_ID_GITHUB_LOGIN`, `CLIENT_SECRET_GITHUB_LOGIN`,
`JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
`AUTH_SECRET`, and `SITE_URL` environment variables.
- Check that the **Authorization callback URL** specified in GitHub matches the `SITE_URL` environment variable.
For example, if the former is `https://app.infisical.com/api/v1/sso/github` then the latter should be `https://app.infisical.com`.
</Accordion>
docs/documentation/platform/sso/gitlab.mdx
+8 -7
View File
@@ -5,8 +5,8 @@ description: "Configure GitLab SSO for Infisical"
Using GitLab SSO on a self-hosted instance of Infisical requires configuring an OAuth application in GitLab and registering your instance with it.
## Create an OAuth application in GitLab
<Steps>
<Step title="Create an OAuth application in GitLab">
Navigate to your user Settings > Applications to create a new GitLab application.
![sso gitlab config](/images/sso/gitlab/edit-profile.png)
@@ -21,9 +21,8 @@ Note that only `read_user` is required as part of the **Scopes** configuration.
If you have a GitLab group, you can create an OAuth application under it
in your group Settings > Applications.
</Note>
## Add your OAuth application credentials to Infisical
</Step>
<Step title="Add your OAuth application credentials to Infisical">
Obtain the **Application ID** and **Secret** for your GitLab application.
![sso gitlab config](/images/sso/gitlab/credentials.png)
@@ -33,10 +32,12 @@ Back in your Infisical instance, make sure to set the following environment vari
- `CLIENT_ID_GITLAB_LOGIN`: The **Client ID** of your GitLab application.
- `CLIENT_SECRET_GITLAB_LOGIN`: The **Secret** of your GitLab application.
- (optional) `URL_GITLAB_LOGIN`: The URL of your self-hosted instance of GitLab where the OAuth application is registered. If no URL is passed in, this will default to `https://gitlab.com`.
- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
Once added, restart your Infisical instance and log in with GitLab.
</Step>
</Steps>
## FAQ
@@ -45,7 +46,7 @@ Once added, restart your Infisical instance and log in with GitLab.
It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
- Check that you have set the `CLIENT_ID_GITLAB_LOGIN`, `CLIENT_SECRET_GITLAB_LOGIN`,
`JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
`AUTH_SECRET`, and `SITE_URL` environment variables.
- Check that the **Redirect URI** specified in GitLab matches the `SITE_URL` environment variable.
For example, if the former is `https://app.infisical.com/api/v1/sso/gitlab` then the latter should be `https://app.infisical.com`.
</Accordion>
docs/documentation/platform/sso/google.mdx
+8 -7
View File
@@ -5,8 +5,8 @@ description: "Configure Google SSO for Infisical"
Using Google SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GCP and registering your instance with it.
## Create an OAuth2 application in GCP
<Steps>
<Step title="Create an OAuth2 application in GCP">
Navigate to your project API & Services > Credentials to create a new OAuth2 application.
![GCP API services](../../../images/sso/google/api-services.png)
@@ -15,9 +15,8 @@ Navigate to your project API & Services > Credentials to create a new OAuth2 app
Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/api/v1/sso/google`.
![GCP create new OAuth2 application form](../../../images/sso/google/new-app-form.png)
## Add your OAuth2 application credentials to Infisical
</Step>
<Step title="Add your OAuth2 application credentials to Infisical">
Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application.
![GCP obtain OAuth2 credentials](../../../images/sso/google/credentials.png)
@@ -26,10 +25,12 @@ Back in your Infisical instance, make sure to set the following environment vari
- `CLIENT_ID_GOOGLE_LOGIN`: The **Client ID** of your GCP OAuth2 application.
- `CLIENT_SECRET_GOOGLE_LOGIN`: The **Client Secret** of your GCP OAuth2 application.
- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
Once added, restart your Infisical instance and log in with Google
</Step>
</Steps>
## FAQ
@@ -38,7 +39,7 @@ Once added, restart your Infisical instance and log in with Google
It is likely that you have misconfigured your self-hosted instance of Infisical. You should:
- Check that you have set the `CLIENT_ID_GOOGLE_LOGIN`, `CLIENT_SECRET_GOOGLE_LOGIN`,
`JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables.
`AUTH_SECRET`, and `SITE_URL` environment variables.
- Check that the **Authorized redirect URI** specified in GCP matches the `SITE_URL` environment variable.
For example, if the former is `https://app.infisical.com/api/v1/sso/google` then the latter should be `https://app.infisical.com`.
</Accordion>
docs/documentation/platform/sso/jumpcloud.mdx
+24 -20
View File
@@ -10,34 +10,37 @@ description: "Configure JumpCloud SAML for Infisical SSO"
then you should contact [email protected] to purchase an enterprise license to use it.
</Info>
1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
<Steps>
<Step title="Prepare the SAML SSO configuration in Infisical">
In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
Next, copy the **ACS URL** and **SP Entity ID** to use when configuring the JumpCloud SAML application.
![JumpCloud SAML initial configuration](../../../images/sso/jumpcloud/init-config.png)
2. In the JumpCloud Admin Portal, navigate to User Authentication > SSO and create an application. If this is your first application, select **Get Started**;
if not, select **+Add New Application**
</Step>
<Step title="Create a SAML application in JumpCloud">
2.1. In the JumpCloud Admin Portal, navigate to User Authentication > SSO and create an application. If this is your first application, select **Get Started**; if not, select **+Add New Application**
![JumpCloud SAML new application](../../../images/sso/jumpcloud/new-application.png)
3. Next, select **Custom SAML App** to open up the **New SSO** dialog.
2.2. Next, select **Custom SAML App** to open up the **New SSO** dialog.
![JumpCloud custom SAML app](../../../images/sso/jumpcloud/custom-saml-app.png)
4. In the **General Info** tab, give the application a unique name like Infisical.
2.3. In the **General Info** tab, give the application a unique name like Infisical.
![JumpCloud general info](../../../images/sso/jumpcloud/general-info.png)
5. In the **SSO** tab, set the **SP Entity ID** and **ACS URL** from step 1; set the **IdP Entity ID** to the same value as the **SP Entity ID**.
2.4. In the **SSO** tab, set the **SP Entity ID** and **ACS URL** from step 1; set the **IdP Entity ID** to the same value as the **SP Entity ID**.
![JumpCloud edit basic config](../../../images/sso/jumpcloud/edit-basic-config.png)
6. On the same tab, check the **Sign Assertion** checkbox and fill the **IDP URL** to something unique.
2.5. On the same tab, check the **Sign Assertion** checkbox and fill the **IDP URL** to something unique.
Copy the **IDP URL** to use when finishing configuring the JumpCloud SAML in Infisical.
![JumpCloud edit basic config 2](../../../images/sso/jumpcloud/edit-basic-config-2.png)
7. On the same tab, in the **Attributes** section, configure the following map:
2.6. On the same tab, in the **Attributes** section, configure the following map:
- `email -> email`
- `firstName -> firstname`
@@ -47,11 +50,12 @@ description: "Configure JumpCloud SAML for Infisical SSO"
Finally press activate to create the SAML application.
8. Next, select the newly created SAML application and select **Download certificate** under the **IDP Certificate Valid** dropdown
2.7. Next, select the newly created SAML application and select **Download certificate** under the **IDP Certificate Valid** dropdown
![JumpCloud download certificate](../../../images/sso/jumpcloud/download-saml-certificate.png)
9. Back in Infisical, set the **IDP URL** from step 6 and the **IdP Entity ID** from step 5. Also, paste the certificate from the previous step.
</Step>
<Step title="Finish configuring SAML in Infisical">
Back in Infisical, set the **IDP URL** from step 2.5 and the **IdP Entity ID** from step 2.4. Also, paste the certificate from the previous step.
![JumpCloud IdP values](../../../images/sso/jumpcloud/idp-values.png)
@@ -60,23 +64,23 @@ Finally press activate to create the SAML application.
CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
of the text area respectively.
</Note>
10. Assignments
</Step>
<Step title="Assign users in JumpCloud to the application">
Back in JumpCloud, navigate to the **User Groups** tab and assign users to the newly created application.
![JumpCloud SAML assignment](../../../images/sso/jumpcloud/assignment.png)
11. Return to Infisical and enable SAML SSO.
</Step>
<Step title="Enable SAML SSO in Infisical">
Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via JumpCloud.
![JumpCloud SAML assignment](../../../images/sso/jumpcloud/enable-saml.png)
</Step>
</Steps>
<Note>
If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
- `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
</Note>
docs/documentation/platform/sso/okta.mdx
+25 -23
View File
@@ -10,26 +10,28 @@ description: "Configure Okta SAML 2.0 for Infisical SSO"
then you should contact [email protected] to purchase an enterprise license to use it.
</Info>
1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
<Steps>
<Step title="Prepare the SAML SSO configuration in Infisical">
In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application.
![Okta SAML initial configuration](../../../images/sso/okta/init-config.png)
2. In the Okta Admin Portal, select Applications > Applications from the
navigation. On the Applications screen, select the **Create App Integration**
</Step>
<Step title="Create a SAML application in Okta">
In the Okta Admin Portal, select Applications > Applications from the navigation. On the Applications screen, select the **Create App Integration**
button.
![SAML Okta create app integration](../../../images/sso/okta/create-app-integration.png)
3. In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/create-saml-app.png)
4. On the General Settings screen, give the application a unique name like Infisical and select **Next**.
On the General Settings screen, give the application a unique name like Infisical and select **Next**.
![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/general-settings.png)
5. On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1.
On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1.
![SAML Okta configure IdP fields](../../../images/sso/okta/configure-saml.png)
@@ -38,7 +40,7 @@ description: "Configure Okta SAML 2.0 for Infisical SSO"
`https://app.infisical.com` with your own domain.
</Note>
6. Also on the Configure SAML screen, configure the **Attribute Statements** to map:
Also on the Configure SAML screen, configure the **Attribute Statements** to map:
- `id -> user.id`,
- `email -> user.email`,
@@ -48,9 +50,8 @@ description: "Configure Okta SAML 2.0 for Infisical SSO"
![SAML Okta attribute statements](../../../images/sso/okta/attribute-statements.png)
Once configured, select **Next** to proceed to the Feedback screen and select **Finish**.
7. Get IdP values
</Step>
<Step title="Retrieve Identity Provider (IdP) Information from Okta">
Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen:
![SAML Okta view setup instructions](../../../images/sso/okta/view-setup-instructions.png)
@@ -58,30 +59,31 @@ Once your application is created, select the **Sign On** tab for the app and sel
Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical.
![SAML Okta IdP values](../../../images/sso/okta/idp-values.png)
</Step>
<Step title="Finish configuring SAML in Infisical">
Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**,
and **Certificate** to **X.509 Certificate** from above. Once you've done that, press **Update** to complete the required configuration.
and **Certificate** to **X.509 Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration.
![SAML Okta paste values into Infisical](../../../images/sso/okta/idp-values-2.png)
8. Finally, navigate to the **Assignments** tab and select **Assign**
You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
</Step>
<Step title="Assign users in Okta to the application">
Back in Okta, navigate to the **Assignments** tab and select **Assign**. You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
![SAML Okta assignment](../../../images/sso/okta/assignment.png)
At this point, you have configured everything you need within the context of the Okta Admin Portal.
9. Return to Infisical and enable SAML SSO.
</Step>
<Step title="Enable SAML SSO in Infisical">
Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.
![SAML Okta assignment](../../../images/sso/okta/enable-saml.png)
</Step>
</Steps>
<Note>
If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to
set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work:
set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work:
- `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string.
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
</Note>