awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'heads/main' into daniel/ms-teams-integration

Browse Source
This commit is contained in:
Daniel Hougaard
2025-04-30 02:39:08 +04:00
parent ff0ff622a6 ba94b91974
commit 1ec7c67212
147 changed files with 3429 additions and 526 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
docs/documentation/platform/access-controls/assume-privilege.mdx Normal file
View File

@@ -0,0 +1,40 @@
---
title: "Assume Privileges"
description: "Learn how to temporarily assume the privileges of a user or machine identity within a project."
---
This feature allows authorized users to temporarily take on the permissions of another user or identity. It helps administrators and access managers test and verify permissions before granting access, ensuring everything is set up correctly.
It also reduces back-and-forth with end users when troubleshooting permission-related issues.
## How It Works
When an authorized user activates assume privileges mode, they temporarily inherit the target user or identity’s permissions for up to one hour.
During this time, they can perform actions within the system with the same level of access as the target user.
- **Permission-based**: Only permissions are inherited, not the full identity
- **Time-limited**: Access automatically expires after one hour
- **Audited**: All actions are logged under the original user's account. This means any action taken during the session will be recorded under the entity assuming the privileges, not the target entity.
- **Authorization required**: Only users with the specific **assume privilege** permission can use this feature
- **Scoped to a single project**: You can only assume privileges for one project at a time
## How to Assume Privileges
<Steps>
<Step title="Go to Project Access">
Click on the user or identity you want to assume.
![Access control page](/images/platform/access-controls/assume-privileges/access-control.png)
</Step>
<Step title="Click Assume Privilege">
Click **Assume Privilege**, then type `assume` to confirm and start your session.
![Access control detail page](/images/platform/access-controls/assume-privileges/access-control-detail.png)
</Step>
<Step title="Session is Active">
You will see a yellow banner indicating that your assume privilege session is active. You can exit at any time by clicking **Exit**.
![session start](/images/platform/access-controls/assume-privileges/session-start.png)
</Step>
</Steps>

56
docs/documentation/platform/github-org-sync.mdx Normal file
View File

@@ -0,0 +1,56 @@
---
title: "GitHub Team Sync"
description: "Learn how to automatically synchronize your GitHub teams with Infisical Groups."
---
## Overview
The GitHub Organization Synchronization feature streamlines user and group management by automatically syncing users belonging to your specified GitHub organization with corresponding groups within Infisical. This integration ensures that users logging in via GitHub are automatically added to or removed from Infisical groups based on their team memberships within your GitHub organization.
## Configuration
To enable and configure GitHub Organization Synchronization, follow these steps:
<Steps>
<Step title="Set up GitHub organization configuration">
1. Navigate to **Organization Settings** and select the **Security Tab**.
![config](../../images/platform/external-syncs/github-org-sync-section.png)
2. Click the **Configure** button and provide the name of your GitHub Organization.
![config-modal](../../images/platform/external-syncs/github-org-sync-config-modal.png)
</Step>
<Step title="Enable GitHub organization sync">
Toggle ON GitHub Organization sync to activate sync.
![toggle-on](../../images/platform/external-syncs/github-org-sync-active.png)
</Step>
<Step title="Approve the Infisical OAuth application on your organization">
Connecting the Infisical OAuth application grants it permission to **read:org** details. This approval is done by selecting your organization during the GitHub OAuth login process.
1. Initiate the login process via the GitHub OAuth flow.
![oauth-flow-start](../../images/platform/external-syncs/github-org-sync-oauth-flow-start.png)
2. Select the organization you have connected.
3. Grant access to Infisical oauth application to your configured organization. Infisical shown here is an organization, just for walkthrough.
![grant-access](../../images/platform/external-syncs/github-org-sync-oauth.png)
<Info>
This action only needs to be done once and authorizes the Infisical OAuth app to read organization details, including team information.
The following users don't need to select organization in GitHub on login anymore.
</Info>
</Step>
</Steps>
## Working
Once configured, the GitHub Organization Synchronization feature functions as follows:
When a user logs in via the GitHub OAuth flow and selects the configured organization, the system will then automatically synchronize the teams they are a part of in GitHub with corresponding groups in Infisical.
## Troubleshooting
<Accordion title="Please check if your organization has approved the Infisical OAuth application.">
If you encounter an error related to this, it indicates that you need to approve the Infisical OAuth application within your GitHub organization.
You can verify the application's approval status by navigating to **https://github.com/organizations/__your-organization__/settings/oauth_application_policy**. Replace `__your-organization__` with the actual name of your GitHub organization.
![check-approval](../../images/platform/external-syncs/github-org-sync-approved-oauth-apps.png)
</Accordion>