diff --git a/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx b/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx new file mode 100644 index 000000000..48890dc24 --- /dev/null +++ b/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx @@ -0,0 +1,52 @@ +--- +title: "General OIDC Group Membership Mapping" +sidebarTitle: "Group Membership Mapping" +description: "Learn how to sync OIDC group members to matching groups in Infisical." +--- + +You can have Infisical automatically sync group +memberships between your OIDC provider and Infisical by configuring a `groups` claim on your provider tokens. +When a user logs in via OIDC, they will be added to Infisical groups that are present in their OIDC `groups` claim, +and removed from any Infisical groups not present in the claim. + + + When enabled, manual + management of Infisical group memberships will be disabled. + + + + Group membership changes in your OIDC provider only sync with Infisical when a + user logs in via OIDC. For example, if you remove a user from a group in your OIDC provider, + this change will not be reflected in Infisical until their next OIDC login. + To ensure this behavior, Infisical recommends enabling Enforce OIDC SSO in the OIDC settings. + + + + + + 1. To enable OIDC Group Membership Mapping, you must configure a `groups` claim in your OIDC provider with the following format. + + ```json + { + // "email": "john@provider.com", + // "given_name": "John", + // ...other claims + "groups": ["Billing Group", "Sales Group"] + } + ``` + + + Setup varies between OIDC providers. Please refer to your OIDC provider's documentation for more information. + + + + 2.1. In Infisical, create any groups you would like to sync users to. Make sure the name of the Infisical group is an exact match of the OIDC group name. + ![OIDC general infisical group](/images/sso/keycloak-oidc/group-membership-mapping/create-infisical-group.png) + + 2.2. Next, enable **OIDC Group Membership Mapping** on the **Single Sign-On (SSO)** page under the **General** tab. + ![OIDC general enable group membership mapping](/images/sso/keycloak-oidc/group-membership-mapping/enable-group-membership-mapping.png) + + 2.3. The next time a user logs in they will be synced to their matching OIDC groups. + ![OIDC general synced users](/images/sso/keycloak-oidc/group-membership-mapping/synced-users.png) + + \ No newline at end of file diff --git a/docs/documentation/platform/sso/general-oidc.mdx b/docs/documentation/platform/sso/general-oidc/overview.mdx similarity index 99% rename from docs/documentation/platform/sso/general-oidc.mdx rename to docs/documentation/platform/sso/general-oidc/overview.mdx index a10b05cfc..45592c180 100644 --- a/docs/documentation/platform/sso/general-oidc.mdx +++ b/docs/documentation/platform/sso/general-oidc/overview.mdx @@ -1,5 +1,6 @@ --- title: "General OIDC" +sidebarTitle: "Overview" description: "Learn how to configure OIDC for Infisical SSO with any OIDC-compliant identity provider" --- diff --git a/docs/mint.json b/docs/mint.json index 61b89c609..c22d5ecab 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -273,7 +273,13 @@ ] }, "documentation/platform/sso/auth0-oidc", - "documentation/platform/sso/general-oidc" + { + "group": "General OIDC", + "pages": [ + "documentation/platform/sso/general-oidc/overview", + "documentation/platform/sso/general-oidc/group-membership-mapping" + ] + } ] }, {