diff --git a/docs/docs.json b/docs/docs.json index eb69cd2b8..b342bf09e 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -221,6 +221,7 @@ ] }, "documentation/platform/sso/auth0-oidc", + "documentation/platform/sso/pingone-oidc", { "group": "General OIDC", "pages": [ diff --git a/docs/documentation/platform/sso/auth0-oidc.mdx b/docs/documentation/platform/sso/auth0-oidc.mdx index 4b54c053d..f33ad39ea 100644 --- a/docs/documentation/platform/sso/auth0-oidc.mdx +++ b/docs/documentation/platform/sso/auth0-oidc.mdx @@ -55,7 +55,7 @@ description: "Learn how to configure Auth0 OIDC for Infisical SSO." Enabling OIDC allows members in your organization to log into Infisical via Auth0. - ![OIDC auth0 enable OIDC](../../../images/sso/auth0-oidc/enable-oidc.png) + ![OIDC auth0 enable OIDC](../../../images/sso/enable-oidc.png) diff --git a/docs/documentation/platform/sso/keycloak-oidc/overview.mdx b/docs/documentation/platform/sso/keycloak-oidc/overview.mdx index 2c75fc6fe..52617afc2 100644 --- a/docs/documentation/platform/sso/keycloak-oidc/overview.mdx +++ b/docs/documentation/platform/sso/keycloak-oidc/overview.mdx @@ -82,7 +82,7 @@ description: "Learn how to configure Keycloak OIDC for Infisical SSO." Enabling OIDC SSO allows members in your organization to log into Infisical via Keycloak. - ![OIDC keycloak enable OIDC](/images/sso/keycloak-oidc/enable-oidc.png) + ![OIDC keycloak enable OIDC](/images/sso/enable-oidc.png) diff --git a/docs/documentation/platform/sso/pingone-oidc.mdx b/docs/documentation/platform/sso/pingone-oidc.mdx new file mode 100644 index 000000000..46c20f2aa --- /dev/null +++ b/docs/documentation/platform/sso/pingone-oidc.mdx @@ -0,0 +1,108 @@ +--- +title: "PingOne OIDC" +description: "Learn how to configure PingOne OIDC for Infisical SSO." +--- + + + PingOne OIDC SSO is a paid feature. If you're using Infisical Cloud, then it is + available under the **Pro Tier**. If you're self-hosting Infisical, then you + should contact sales@infisical.com to purchase an enterprise license to use + it. + + + + + 1.1. From the Application's Page, create a new OIDC Web App application. + ![OIDC pingone create application](../../../images/sso/pingone-oidc/pingone-create-application.png) + + 1.2. Enable the application by pressing the "Enable" toggle. + ![OIDC PingOne Enable Application](../../../images/sso/pingone-oidc/pingone-enable-application.png) + + + 1.3. In the Application "Configuration" tab, press the "Edit" pencil icon to configure the application callback URI. + ![OIDC PingOne Edit Application Configuration](../../../images/sso/pingone-oidc/pingone-edit-application-configuration.png) + + + 1.4 Set the Redirect URL to `https://app.infisical.com/api/v1/sso/oidc/callback` and press the "Save" button. + ![OIDC PingOne Edit Redirect URI](../../../images/sso/pingone-oidc/pingone-edit-application-redirect-uri.png) + + + + If you're self-hosting Infisical, then you will want to replace https://app.infisical.com with your own domain. + + + + 1.5 After configuring the redirect URL, go to the "Attribute Mappings" tab and press the "Edit" pencil icon to configure the attribute mappings. + ![OIDC PingOne Edit Attribute Mappings](../../../images/sso/pingone-oidc/pingone-edit-application-attribute-mappings.png) + + 1.6 Map the following attributes: + - `email` -> `Email Address` + - `name` -> `Username` + ![OIDC PingOne Edit Attribute Mappings](../../../images/sso/pingone-oidc/pingone-edit-application-attribute-mappings-2.png) + + Once done, press the "Save" button. + + + + 2.1. Open the "Overview" tab and copy the **Client ID** and **Client Secret**. + ![OIDC PingOne Application Credential](../../../images/sso/pingone-oidc/pingone-overview-credentials.png) + + 2.2. Still in the "Overview" tab, scroll down to the Connection Details section and retrieve the **OIDC Discovery Endpoint**. + ![OIDC PingOne OIDC Discovery Endpoint](../../../images/sso/pingone-oidc/pingone-overview-oidc-discovery-endpoint.png) + + Keep these values handy as we will need them in the next steps. + + + + 3.1. Back in Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Click **Connect** for **OIDC**. + ![OIDC SSO Connect](../../../images/sso/connect-oidc.png) + + 3.2. For configuration type, select **Discovery URL**. Then, set **Discovery Document URL**, **Client ID**, and **Client Secret** from step 2.1 and 2.2. + + ![OIDC PingOne paste values into Infisical](../../../images/sso/pingone-oidc/infisical-configure-oidc.png) + + + Currently, the following JWT signature algorithms are supported: RS256, RS512, HS256, and EdDSA + + + Once you've done that, press **Update** to complete the required configuration. + + + + Enabling OIDC allows members in your organization to log into Infisical via PingOne + + ![OIDC PingOne enable OIDC](../../../images/sso/enable-oidc.png) + + + + Enforcing OIDC SSO ensures that members in your organization can only access Infisical + by logging into the organization via PingOne. + + To enforce OIDC SSO, you're required to test out the OpenID connection by successfully authenticating at least one PingOne user with Infisical. + Once you've completed this requirement, you can toggle the **Enforce OIDC SSO** button to enforce OIDC SSO. + + + We recommend ensuring that your account is provisioned using the application in PingOne + prior to enforcing OIDC SSO to prevent any unintended issues. + + + In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin. + + + + + + If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite OIDC login. + + + + If you're configuring OIDC SSO on a self-hosted instance of Infisical, make + sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to + work: +
+ - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This + can be a random 32-byte base64 string generated with `openssl rand -base64 + 32`. +
+ - `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. https://app.infisical.com) + diff --git a/docs/images/sso/auth0-oidc/enable-oidc.png b/docs/images/sso/enable-oidc.png similarity index 100% rename from docs/images/sso/auth0-oidc/enable-oidc.png rename to docs/images/sso/enable-oidc.png diff --git a/docs/images/sso/keycloak-oidc/enable-oidc.png b/docs/images/sso/keycloak-oidc/enable-oidc.png deleted file mode 100644 index 0a43f22ed..000000000 Binary files a/docs/images/sso/keycloak-oidc/enable-oidc.png and /dev/null differ diff --git a/docs/images/sso/pingone-oidc/infisical-configure-oidc.png b/docs/images/sso/pingone-oidc/infisical-configure-oidc.png new file mode 100644 index 000000000..b60ff0f27 Binary files /dev/null and b/docs/images/sso/pingone-oidc/infisical-configure-oidc.png differ diff --git a/docs/images/sso/pingone-oidc/pingone-create-application.png b/docs/images/sso/pingone-oidc/pingone-create-application.png new file mode 100644 index 000000000..7f188da7d Binary files /dev/null and b/docs/images/sso/pingone-oidc/pingone-create-application.png differ diff --git a/docs/images/sso/pingone-oidc/pingone-edit-application-attribute-mappings-2.png b/docs/images/sso/pingone-oidc/pingone-edit-application-attribute-mappings-2.png new file mode 100644 index 000000000..05f212b73 Binary files /dev/null and b/docs/images/sso/pingone-oidc/pingone-edit-application-attribute-mappings-2.png differ diff --git a/docs/images/sso/pingone-oidc/pingone-edit-application-attribute-mappings.png b/docs/images/sso/pingone-oidc/pingone-edit-application-attribute-mappings.png new file mode 100644 index 000000000..1beba0117 Binary files /dev/null and b/docs/images/sso/pingone-oidc/pingone-edit-application-attribute-mappings.png differ diff --git a/docs/images/sso/pingone-oidc/pingone-edit-application-configuration.png b/docs/images/sso/pingone-oidc/pingone-edit-application-configuration.png new file mode 100644 index 000000000..9be619298 Binary files /dev/null and b/docs/images/sso/pingone-oidc/pingone-edit-application-configuration.png differ diff --git a/docs/images/sso/pingone-oidc/pingone-edit-application-redirect-uri.png b/docs/images/sso/pingone-oidc/pingone-edit-application-redirect-uri.png new file mode 100644 index 000000000..e5292a85f Binary files /dev/null and b/docs/images/sso/pingone-oidc/pingone-edit-application-redirect-uri.png differ diff --git a/docs/images/sso/pingone-oidc/pingone-enable-application.png b/docs/images/sso/pingone-oidc/pingone-enable-application.png new file mode 100644 index 000000000..51219b9fd Binary files /dev/null and b/docs/images/sso/pingone-oidc/pingone-enable-application.png differ diff --git a/docs/images/sso/pingone-oidc/pingone-overview-credentials.png b/docs/images/sso/pingone-oidc/pingone-overview-credentials.png new file mode 100644 index 000000000..af609ff0b Binary files /dev/null and b/docs/images/sso/pingone-oidc/pingone-overview-credentials.png differ diff --git a/docs/images/sso/pingone-oidc/pingone-overview-oidc-discovery-endpoint.png b/docs/images/sso/pingone-oidc/pingone-overview-oidc-discovery-endpoint.png new file mode 100644 index 000000000..da7e981b6 Binary files /dev/null and b/docs/images/sso/pingone-oidc/pingone-overview-oidc-discovery-endpoint.png differ