Merge pull request #804 from Infisical/jumpcloud-saml

Optimize SAML SSO configuration flow and add documentation for Azure AD SAML

docs/documentation/platform/saml.mdx

@@ -1,100 +0,0 @@
----
-title: "SSO"
-description: "Log in to Infisical via SSO protocols"
----
-
-<Warning>
-  Infisical currently only supports SAML SSO authentication with [Okta as the
-  identity provider (IDP)](https://www.okta.com/). We're expanding support for
-  other IDPs in the coming months, so stay tuned with this issue
-  [here](https://github.com/Infisical/infisical/issues/442).
-</Warning>
-
-You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0).
-
-To note, configuring SSO retains the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps. In all login with SSO implementations,
-your IDP cannot and will not have access to the decryption key needed to decrypt your secrets.
-
-## Configuration
-
-Head over to your organization Settings > Authentication > SAML SSO Configuration.
-
-Next, press "Set up SAML SSO" in the SAML SSO and follow the instructions
-below to configure SSO for your identity provider:
-
-<Note>
-  Note that only members with the `owner` or `admin` roles in an organization
-  can configure SSO for it.
-</Note>
-
-<AccordionGroup>
-  <Accordion title="Okta SAML 2.0">
-    1. In the Okta Admin Portal, select Applications > Applications from the
-    navigation. On the Applications screen, select the Create App Integration
-    button.
-    
-    ![SAML Okta create app integration](../../images/saml-okta-1.png)
-
-    2. In the Create a New Application Integration dialog, select the SAML 2.0 radio button:
-
-    ![SAML Okta create SAML 2.0 integration](../../images/saml-okta-2.png)
-
-    3. On the General Settings screen, give the application a unique, Infisical-specific name and select Next.
-
-    4. On the Configure SAML screen, configure the following fields:
-
-    - Single sign on URL: `https://app.infisical.com/api/v1/sso/saml2/:identifier`; we'll update the `:identifier` part later in step 6.
-    - Audience URI (SP Entity ID): `https://app.infisical.com`
-
-    ![SAML Okta configure IDP fields](../../images/saml-okta-3.png)
-
-    <Note>
-        If you're self-hosting Infisical, then you will want to replace `https://app.infisical.com` with your own domain.
-    </Note>
-
-    4. Also on the Configure SAML screen, configure the Attribute Statements to map:
-
-    - `id -> user.id`,
-    - `email -> user.email`,
-    - `firstName -> user.firstName`
-    - `lastName -> user.lastName`
-
-    ![SAML Okta attribute statements](../../images/saml-okta-4.png)
-
-    Once configured, select the Next button to proceed to the Feedback screen and select Finish.
-
-    5. Get IDP values
-
-    Once your application is created, select the Sign On tab for the app and select the View Setup Instructions button located on the right side of the screen:
-
-    Copy the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate to be pasted into your Infisical SAML SSO configuration details with the following map:
-
-    - `Audience -> Okta Audience URI (SP Entity ID)`
-    - `Entrypoint -> Okta Identity Provider Single Sign-On URL`
-    - `Issuer -> Identity Provider Issuer`
-    - `Certificate -> X.509 Certificate`.
-
-    ![SAML Okta IDP values](../../images/saml-okta-5.png)
-
-    ![SAML Okta paste values into Infisical](../../images/saml-okta-6.png)
-
-    6. Create the SSO configuration and copy your SSO identifier in Infisical; update `:identifier` from step 4 earlier to be this value.
-
-    ![SAML Okta assignments](../../images/saml-okta-7.png)
-
-    7. Assignments
-
-    Finally, Navigate to the Assignments tab and select the Assign button:
-
-    You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
-
-    ![SAML Okta assignment](../../images/saml-okta-8.png)
-
-    At this point, you have configured everything you need within the context of the Okta Admin Portal.
-
-    8. Return to Infisical and enable SAML SSO.
-
-    Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.
-
-  </Accordion>
-</AccordionGroup>

docs/documentation/platform/sso/azure.mdx

@@ -0,0 +1,84 @@
+---
+title: "Azure SAML"
+description: "Configure Azure SAML for Infisical SSO"
+---
+
+1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
+   Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application.
+
+![Azure SAML initial configuration](../../../images/sso/azure/init-config.png)
+
+2. In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select
+   **+ New application**.
+
+![Azure SAML enterprise applications](../../../images/sso/azure/enterprise-applications.png)
+
+![Azure SAML new application](../../../images/sso/azure/new-application.png)
+
+2. On the next screen, press the **+ Create your own application** button.
+   Give the application a unique, Infisical-specific name; choose the "Integrate any other application you don't find in the gallery (Non-gallery)"
+   option and hit the **Create** button.
+
+![Azure SAML create own application](../../../images/sso/azure/create-own-application.png)
+
+3. On the application overview screen, select **Single sign-on** from the left sidebar. From there,
+   select the **SAML** single sign-on method.
+
+![Azure SAML sign on method](../../../images/sso/azure/sso-method.png)
+
+4. Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)**
+   to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1.
+
+![Azure SAML edit basic configuration](../../../images/sso/azure/edit-basic-config.png)
+
+![Azure SAML edit basic configuration 2](../../../images/sso/azure/edit-basic-config-2.png)
+
+<Note>
+  If you're self-hosting Infisical, then you will want to replace
+  `https://app.infisical.com` with your own domain.
+</Note>
+
+5. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map:
+
+- `email -> user.userprinciplename`
+- `firstName -> user.firstName`
+- `lastName -> user.lastName`
+
+![Azure SAML edit attributes and claims](../../../images/sso/azure/edit-attributes-claims.png)
+
+![Azure SAML edit attributes and claims 2](../../../images/sso/azure/edit-attributes-claims-2.png)
+
+6. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**.
+
+![Azure SAML edit certificate](../../../images/sso/azure/edit-saml-certificate.png)
+
+![Azure SAML edit certificate signing option](../../../images/sso/azure/edit-saml-certificate-2.png)
+
+7. Get IdP values:
+
+Back in the **Set up Single Sign-On with SAML** screen, copy the **Login URL**, **Azure AD Identifier** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical.
+
+Back in Infisical, set **Login URL** and **Azure AD Identifier** from above. Once you've done that, press **Update** to complete the required configuration.
+
+![Azure SAML identity provider values](../../../images/sso/azure/idp-values.png)
+![Azure SAML paste identity provider values](../../../images/sso/azure/idp-values-2.png)
+
+<Note>
+When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
+  CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
+  of the text area respectively.
+
+Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure.
+
+</Note>
+
+7. Assignments
+
+Finally, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level.
+![Azure SAML assignment](../../../images/sso/azure/assignment.png)
+
+8. Return to Infisical and enable SAML SSO.
+
+Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure.
+
+![SAML Okta assignment](../../../images/sso/azure/enable-saml.png)

docs/documentation/platform/sso/jumpcloud.mdx

@@ -0,0 +1,6 @@
+---
+title: "JumpCloud SAML"
+description: "Configure JumpCloud SAML for Infisical SSO"
+---
+
+Coming soon.

docs/documentation/platform/sso/okta.mdx

@@ -0,0 +1,76 @@
+---
+title: "Okta SAML"
+description: "Configure Okta SAML 2.0 for Infisical SSO"
+---
+
+Prerequisites:
+
+- Okta Developer Account with access to create custom application integrations.
+
+1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
+   Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application.
+
+![Okta SAML initial configuration](../../../images/sso/okta/init-config.png)
+
+2. In the Okta Admin Portal, select Applications > Applications from the
+   navigation. On the Applications screen, select the **Create App Integration**
+   button.
+
+![SAML Okta create app integration](../../../images/sso/okta/create-app-integration.png)
+
+3. In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
+
+![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/create-saml-app.png)
+
+4. On the General Settings screen, give the application a unique name like Infisical and select **Next**.
+
+![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/general-settings.png)
+
+5. On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1.
+
+![SAML Okta configure IdP fields](../../../images/sso/okta/configure-saml.png)
+
+<Note>
+  If you're self-hosting Infisical, then you will want to replace
+  `https://app.infisical.com` with your own domain.
+</Note>
+
+6. Also on the Configure SAML screen, configure the **Attribute Statements** to map:
+
+- `id -> user.id`,
+- `email -> user.email`,
+- `firstName -> user.firstName`
+- `lastName -> user.lastName`
+
+![SAML Okta attribute statements](../../../images/sso/okta/attribute-statements.png)
+
+Once configured, select **Next** to proceed to the Feedback screen and select **Finish**.
+
+7. Get IdP values
+
+Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen:
+
+![SAML Okta view setup instructions](../../../images/sso/okta/view-setup-instructions.png)
+
+Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical.
+
+![SAML Okta IdP values](../../../images/sso/okta/idp-values.png)
+
+Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**,
+and **Certificate** to **X.509 Certificate** from above. Once you've done that, press **Update** to complete the required configuration.
+
+![SAML Okta paste values into Infisical](../../../images/sso/okta/idp-values-2.png)
+
+8. Finally, navigate to the **Assignments** tab and select **Assign**
+
+You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
+
+![SAML Okta assignment](../../../images/sso/okta/assignment.png)
+
+At this point, you have configured everything you need within the context of the Okta Admin Portal.
+
+9. Return to Infisical and enable SAML SSO.
+
+Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.
+
+![SAML Okta assignment](../../../images/sso/okta/enable-saml.png)

docs/documentation/platform/sso/overview.mdx

@@ -0,0 +1,18 @@
+---
+title: "SSO Overview"
+description: "Log in to Infisical via SSO protocols"
+---
+
+<Warning>
+  Infisical currently only supports SAML SSO authentication with Okta and Azure
+  AD. We're expanding support for other IdPs in the coming months, so stay tuned
+  with this issue [here](https://github.com/Infisical/infisical/issues/442).
+</Warning>
+
+You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0).
+
+To note, configuring SSO retains the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps. In all login with SSO implementations,
+your IdP cannot and will not have access to the decryption key needed to decrypt your secrets.
+
+- [Okta SAML](/documentation/platform/sso/okta)
+- [Azure SAML](/documentation/platform/sso/azure)

docs/mint.json

@@ -121,7 +121,15 @@
         "documentation/platform/token",
         "documentation/platform/ip-allowlisting",
         "documentation/platform/mfa",
-        "documentation/platform/saml"
+        {
+          "group": "SSO",
+          "pages": [
+            "documentation/platform/sso/overview",
+            "documentation/platform/sso/okta",
+            "documentation/platform/sso/azure",
+            "documentation/platform/sso/jumpcloud"
+          ]
+        }
       ]
     },
     {