From 386bc09d49e6e340c4d7a8dfef9070700949186c Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Fri, 28 Jul 2023 14:52:07 +0700 Subject: [PATCH] Update Okta SSO image convention --- docs/documentation/platform/saml.mdx | 147 ------------------ docs/documentation/platform/sso/azure.mdx | 56 +++++++ docs/documentation/platform/sso/jumpcloud.mdx | 4 + docs/documentation/platform/sso/okta.mdx | 72 +++++++++ docs/documentation/platform/sso/overview.mdx | 23 +++ .../{saml-okta-1.png => sso-okta-1.png} | Bin .../{saml-okta-2.png => sso-okta-2.png} | Bin .../{saml-okta-3.png => sso-okta-3.png} | Bin .../{saml-okta-4.png => sso-okta-4.png} | Bin .../{saml-okta-5.png => sso-okta-5.png} | Bin .../{saml-okta-6.png => sso-okta-6.png} | Bin .../{saml-okta-7.png => sso-okta-7.png} | Bin .../{saml-okta-8.png => sso-okta-8.png} | Bin docs/mint.json | 10 +- 14 files changed, 164 insertions(+), 148 deletions(-) delete mode 100644 docs/documentation/platform/saml.mdx create mode 100644 docs/documentation/platform/sso/azure.mdx create mode 100644 docs/documentation/platform/sso/jumpcloud.mdx create mode 100644 docs/documentation/platform/sso/okta.mdx create mode 100644 docs/documentation/platform/sso/overview.mdx rename docs/images/{saml-okta-1.png => sso-okta-1.png} (100%) rename docs/images/{saml-okta-2.png => sso-okta-2.png} (100%) rename docs/images/{saml-okta-3.png => sso-okta-3.png} (100%) rename docs/images/{saml-okta-4.png => sso-okta-4.png} (100%) rename docs/images/{saml-okta-5.png => sso-okta-5.png} (100%) rename docs/images/{saml-okta-6.png => sso-okta-6.png} (100%) rename docs/images/{saml-okta-7.png => sso-okta-7.png} (100%) rename docs/images/{saml-okta-8.png => sso-okta-8.png} (100%) diff --git a/docs/documentation/platform/saml.mdx b/docs/documentation/platform/saml.mdx deleted file mode 100644 index d74a2ff9a..000000000 --- a/docs/documentation/platform/saml.mdx +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: "SSO" -description: "Log in to Infisical via SSO protocols" ---- - - - Infisical currently only supports SAML SSO authentication with [Okta as the - identity provider (IdP)](https://www.okta.com/). We're expanding support for - other IdPs in the coming months, so stay tuned with this issue - [here](https://github.com/Infisical/infisical/issues/442). - - -You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0). - -To note, configuring SSO retains the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps. In all login with SSO implementations, -your IdP cannot and will not have access to the decryption key needed to decrypt your secrets. - -## Configuration - -Head over to your organization Settings > Authentication > SAML SSO Configuration. - -Next, press "Set up SAML SSO" in the SAML SSO and follow the instructions -below to configure SSO for your identity provider: - - - Note that only members with the `owner` or `admin` roles in an organization - can configure SSO for it. - - - - - 1. In the Okta Admin Portal, select Applications > Applications from the - navigation. On the Applications screen, select the Create App Integration - button. - - ![SAML Okta create app integration](../../images/saml-okta-1.png) - - 2. In the Create a New Application Integration dialog, select the SAML 2.0 radio button: - - ![SAML Okta create SAML 2.0 integration](../../images/saml-okta-2.png) - - 3. On the General Settings screen, give the application a unique, Infisical-specific name and select Next. - - 4. On the Configure SAML screen, configure the following fields: - - - Single sign on URL: `https://app.infisical.com/api/v1/sso/saml2/:identifier`; we'll update the `:identifier` part later in step 6. - - Audience URI (SP Entity ID): `https://app.infisical.com` - - ![SAML Okta configure IdP fields](../../images/saml-okta-3.png) - - - If you're self-hosting Infisical, then you will want to replace `https://app.infisical.com` with your own domain. - - - 4. Also on the Configure SAML screen, configure the Attribute Statements to map: - - - `id -> user.id`, - - `email -> user.email`, - - `firstName -> user.firstName` - - `lastName -> user.lastName` - - ![SAML Okta attribute statements](../../images/saml-okta-4.png) - - Once configured, select the Next button to proceed to the Feedback screen and select Finish. - - 5. Get IdP values - - Once your application is created, select the Sign On tab for the app and select the View Setup Instructions button located on the right side of the screen: - - Copy the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate to be pasted into your Infisical SAML SSO configuration details with the following map: - - - `Audience -> Audience URI (SP Entity ID) from Okta` - - `Entrypoint -> Identity Provider Single Sign-On URL from Okta` - - `Issuer -> Identity Provider Issuer from Okta` - - `Certificate -> X.509 Certificate from Okta` - - ![SAML Okta IdP values](../../images/saml-okta-5.png) - - ![SAML Okta paste values into Infisical](../../images/saml-okta-6.png) - - 6. Create the SSO configuration and copy your SSO identifier in Infisical; update `:identifier` from step 4 earlier to be this value. - - ![SAML Okta assignments](../../images/saml-okta-7.png) - - 7. Assignments - - Finally, Navigate to the Assignments tab and select the Assign button: - - You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option. - - ![SAML Okta assignment](../../images/saml-okta-8.png) - - At this point, you have configured everything you need within the context of the Okta Admin Portal. - - 8. Return to Infisical and enable SAML SSO. - - Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta. - - - - - 1. In the Azure Portal, navigate to the Azure Active Directory and select Enterprise applications. On this screen, select - the **+ New application** button. - - TODO: insert image. - - 2. On the next screen, press the **+ Create your own application** button. - Give the application a unique, Infisical-specific name; choose the "Integrate any other application you don't find in the gallery (Non-gallery)" - option and hit the **Create** button. - - TODO: insert image - - 3. On the application overview screen, select **Single sign-on** from the left sidebar. From there, - select the **SAML** single sign-on method. - -4. Next, press the **Edit** button in the **Basic SAML Configuration** section and configure the following fields: - -- Identifier (Entity ID): https://app.infisical.com -- Reply URL (Assertion Consumer Service URL): `https://app.infisical.com/api/v1/sso/saml2/:identifier` - - - If you're self-hosting Infisical, then you will want to replace - `https://app.infisical.com` with your own domain. - - -5. Next, press the **Edit** button in the **Attributes & Claims** section. - -In the **Attributes && Claims** section, configure the following claims to map: - -- `email -> user.userprinciplename` -- `firstName -> user.firstName` -- `lastName -> user.lastName` - -Once you've done that, head back to the **Set up Single Sign-On with SAML** screen. - -6. Get IdP values: - -Back in Infisical > Organization settings > Authentication, select **Set up SAML SSO** and paste your Infisical SAML SSO configuration details -with the following map from the **Set up Single Sign-On with SAML** screen in Azure: - -- `Audience -> Azure ` -- `Entrypoint -> X` -- `Issuer -> X` -- `Certificate -> X.509 Certificate from Azure` - - - diff --git a/docs/documentation/platform/sso/azure.mdx b/docs/documentation/platform/sso/azure.mdx new file mode 100644 index 000000000..9d37f1a6b --- /dev/null +++ b/docs/documentation/platform/sso/azure.mdx @@ -0,0 +1,56 @@ +--- +title: "Azure SAML" +description: "Configure Azure SAML for Infisical SSO" +--- + +1. In the Azure Portal, navigate to the Azure Active Directory and select Enterprise applications. On this screen, select + the **+ New application** button. + +TODO: insert image. + +2. On the next screen, press the **+ Create your own application** button. + Give the application a unique, Infisical-specific name; choose the "Integrate any other application you don't find in the gallery (Non-gallery)" + option and hit the **Create** button. + +TODO: insert image + +3. On the application overview screen, select **Single sign-on** from the left sidebar. From there, + select the **SAML** single sign-on method. + +4. Next, press the **Edit** button in the **Basic SAML Configuration** section and configure the following fields: + +- Identifier (Entity ID): https://app.infisical.com +- Reply URL (Assertion Consumer Service URL): `https://app.infisical.com/api/v1/sso/saml2/:identifier` + + + If you're self-hosting Infisical, then you will want to replace + `https://app.infisical.com` with your own domain. + + +5. Next, press the **Edit** button in the **Attributes & Claims** section. + +In the **Attributes && Claims** section, configure the following claims to map: + +- `email -> user.userprinciplename` +- `firstName -> user.firstName` +- `lastName -> user.lastName` + +Once you've done that, head back to the **Set up Single Sign-On with SAML** screen. + +6. Get IdP values: + +Back in Infisical > Organization settings > Authentication, select **Set up SAML SSO** and paste your Infisical SAML SSO configuration details +with the following map from the **Set up Single Sign-On with SAML** screen in Azure: + +- `Audience -> Azure ` +- `Entrypoint -> X` +- `Issuer -> X` +- `Certificate -> X.509 Certificate from Azure` + +7. Assignments + +Finally, navigate to the **Users and groups** tab and select the + button to assign access to the login with SSO application on a user or group-level. + +8. Return to Infisical and enable SAML SSO. + +Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure. diff --git a/docs/documentation/platform/sso/jumpcloud.mdx b/docs/documentation/platform/sso/jumpcloud.mdx new file mode 100644 index 000000000..3fc03804e --- /dev/null +++ b/docs/documentation/platform/sso/jumpcloud.mdx @@ -0,0 +1,4 @@ +--- +title: "JumpCloud SAML" +description: "Configure JumpCloud SAML for Infisical SSO" +--- diff --git a/docs/documentation/platform/sso/okta.mdx b/docs/documentation/platform/sso/okta.mdx new file mode 100644 index 000000000..452473dfe --- /dev/null +++ b/docs/documentation/platform/sso/okta.mdx @@ -0,0 +1,72 @@ +--- +title: "Okta SAML" +description: "Configure Okta SAML for Infisical SSO" +--- + +1. In the Okta Admin Portal, select Applications > Applications from the + navigation. On the Applications screen, select the Create App Integration + button. + +![SAML Okta create app integration](../../../images/sso-okta-1.png) + +2. In the Create a New Application Integration dialog, select the SAML 2.0 radio button: + +![SAML Okta create SAML 2.0 integration](../../../images/sso-okta-2.png) + +3. On the General Settings screen, give the application a unique, Infisical-specific name and select Next. + +4. On the Configure SAML screen, configure the following fields: + +- Single sign on URL: `https://app.infisical.com/api/v1/sso/saml2/:identifier`; we'll update the `:identifier` part later in step 6. +- Audience URI (SP Entity ID): `https://app.infisical.com` + +![SAML Okta configure IdP fields](../../../images/sso-okta-3.png) + + + If you're self-hosting Infisical, then you will want to replace + `https://app.infisical.com` with your own domain. + + +4. Also on the Configure SAML screen, configure the Attribute Statements to map: + +- `id -> user.id`, +- `email -> user.email`, +- `firstName -> user.firstName` +- `lastName -> user.lastName` + +![SAML Okta attribute statements](../../../images/sso-okta-4.png) + +Once configured, select the Next button to proceed to the Feedback screen and select Finish. + +5. Get IdP values + +Once your application is created, select the Sign On tab for the app and select the View Setup Instructions button located on the right side of the screen: + +Copy the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate to be pasted into your Infisical SAML SSO configuration details with the following map: + +- `Audience -> Audience URI (SP Entity ID) from Okta` +- `Entrypoint -> Identity Provider Single Sign-On URL from Okta` +- `Issuer -> Identity Provider Issuer from Okta` +- `Certificate -> X.509 Certificate from Okta` + +![SAML Okta IdP values](../../../images/saml-okta-5.png) + +![SAML Okta paste values into Infisical](../../../images/sso-okta-6.png) + +6. Create the SSO configuration and copy your SSO identifier in Infisical; update `:identifier` from step 4 earlier to be this value. + +![SAML Okta assignments](../../../images/sso-okta-7.png) + +7. Assignments + +Finally, navigate to the Assignments tab and select the Assign button: + +You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option. + +![SAML Okta assignment](../../../images/sso-okta-8.png) + +At this point, you have configured everything you need within the context of the Okta Admin Portal. + +8. Return to Infisical and enable SAML SSO. + +Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta. diff --git a/docs/documentation/platform/sso/overview.mdx b/docs/documentation/platform/sso/overview.mdx new file mode 100644 index 000000000..67a53007d --- /dev/null +++ b/docs/documentation/platform/sso/overview.mdx @@ -0,0 +1,23 @@ +--- +title: "SSO Overview" +description: "Log in to Infisical via SSO protocols" +--- + + + Infisical currently only supports SAML SSO authentication with [Okta as the + identity provider (IdP)](https://www.okta.com/). We're expanding support for + other IdPs in the coming months, so stay tuned with this issue + [here](https://github.com/Infisical/infisical/issues/442). + + +You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0). + +To note, configuring SSO retains the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps. In all login with SSO implementations, +your IdP cannot and will not have access to the decryption key needed to decrypt your secrets. + +## Configuration + +Head over to your organization Settings > Authentication > SAML SSO Configuration. + +Next, press "Set up SAML SSO" in the SAML SSO and follow the instructions +below to configure SSO for your identity provider. diff --git a/docs/images/saml-okta-1.png b/docs/images/sso-okta-1.png similarity index 100% rename from docs/images/saml-okta-1.png rename to docs/images/sso-okta-1.png diff --git a/docs/images/saml-okta-2.png b/docs/images/sso-okta-2.png similarity index 100% rename from docs/images/saml-okta-2.png rename to docs/images/sso-okta-2.png diff --git a/docs/images/saml-okta-3.png b/docs/images/sso-okta-3.png similarity index 100% rename from docs/images/saml-okta-3.png rename to docs/images/sso-okta-3.png diff --git a/docs/images/saml-okta-4.png b/docs/images/sso-okta-4.png similarity index 100% rename from docs/images/saml-okta-4.png rename to docs/images/sso-okta-4.png diff --git a/docs/images/saml-okta-5.png b/docs/images/sso-okta-5.png similarity index 100% rename from docs/images/saml-okta-5.png rename to docs/images/sso-okta-5.png diff --git a/docs/images/saml-okta-6.png b/docs/images/sso-okta-6.png similarity index 100% rename from docs/images/saml-okta-6.png rename to docs/images/sso-okta-6.png diff --git a/docs/images/saml-okta-7.png b/docs/images/sso-okta-7.png similarity index 100% rename from docs/images/saml-okta-7.png rename to docs/images/sso-okta-7.png diff --git a/docs/images/saml-okta-8.png b/docs/images/sso-okta-8.png similarity index 100% rename from docs/images/saml-okta-8.png rename to docs/images/sso-okta-8.png diff --git a/docs/mint.json b/docs/mint.json index 65a500fea..ebe0e7786 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -121,7 +121,15 @@ "documentation/platform/token", "documentation/platform/ip-allowlisting", "documentation/platform/mfa", - "documentation/platform/saml" + { + "group": "SSO", + "pages": [ + "documentation/platform/sso/overview", + "documentation/platform/sso/okta", + "documentation/platform/sso/azure", + "documentation/platform/sso/jumpcloud" + ] + } ] }, {