awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3602 from Infisical/general-oidc-group-mapping-docs

Browse Source 
docs(oidc-group-membership-mapping): Add general OIDC group membership mapping documentation
This commit is contained in:
Maidul Islam
2025-05-14 16:25:26 -07:00
committed by GitHub
parent 6188de43e4 3b9a50d65d
commit 89a6a0ba13
3 changed files with 77 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx Normal file
View File

@@ -0,0 +1,55 @@
---
title: "General OIDC Group Membership Mapping"
sidebarTitle: "Group Membership Mapping"
description: "Learn how to sync OIDC group members to matching groups in Infisical."
---
You can have Infisical automatically sync group
memberships between your OIDC provider and Infisical by configuring a `groups` claim on your provider tokens.
When a user logs in via OIDC, they will be added to Infisical groups that are present in their OIDC `groups` claim,
and removed from any Infisical groups not present in the claim.
<Info>
When enabled, manual
management of Infisical group memberships will be disabled.
</Info>
<Warning>
Group membership changes in your OIDC provider only sync with Infisical when a
user logs in via OIDC. For example, if you remove a user from a group in your OIDC provider,
this change will not be reflected in Infisical until their next OIDC login.
To ensure this behavior, Infisical recommends enabling Enforce OIDC SSO in the OIDC settings.
</Warning>
<Steps>
<Step title="Configure a groups claim in your OIDC provider">
To enable OIDC Group Membership Mapping, you must configure a `groups` claim in your OIDC provider.
Add a `groups` property with a list of the user's OIDC group names to your token.
Example of expected token payload:
```json
{
// "email": "john@provider.com",
// "given_name": "John",
// ...other claims
"groups": ["Billing Group", "Sales Group"]
}
```
<Note>
Setup varies between OIDC providers. Please refer to your OIDC provider's documentation for more information.
</Note>
</Step>
<Step title="Setup groups in Infisical and enable OIDC Group Membership Mapping">
2.1. In Infisical, create any groups you would like to sync users to. Make sure the name of the Infisical group is an exact match of the OIDC group name.
![OIDC general infisical group](/images/sso/keycloak-oidc/group-membership-mapping/create-infisical-group.png)
2.2. Next, enable **OIDC Group Membership Mapping** on the **Single Sign-On (SSO)** page under the **General** tab.
![OIDC general enable group membership mapping](/images/sso/keycloak-oidc/group-membership-mapping/enable-group-membership-mapping.png)
2.3. The next time a user logs in they will be synced to their matching OIDC groups.
![OIDC general synced users](/images/sso/keycloak-oidc/group-membership-mapping/synced-users.png)
</Step>
</Steps>

9
docs/documentation/platform/sso/general-oidc.mdx → docs/documentation/platform/sso/general-oidc/overview.mdx
View File

@@ -1,5 +1,6 @@
---
title: "General OIDC"
sidebarTitle: "Overview"
description: "Learn how to configure OIDC for Infisical SSO with any OIDC-compliant identity provider"
---
@@ -29,7 +30,7 @@ Prerequisites:
</Step>
<Step title="Finish configuring OIDC in Infisical">
2.1. Back in Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Select **Connect** for **OIDC**.
![OIDC SSO Connect](../../../images/sso/connect-oidc.png)
![OIDC SSO Connect](../../../../images/sso/connect-oidc.png)
2.2. You can configure OIDC either through the Discovery URL (Recommended) or by inputting custom endpoints.
@@ -39,10 +40,10 @@ Prerequisites:
Note that the Discovery Document URL typically takes the form: `https://<idp-domain>/.well-known/openid-configuration`.
</Note>
![OIDC general discovery config](../../../images/sso/general-oidc/discovery-oidc-form.png)
![OIDC general discovery config](../../../../images/sso/general-oidc/discovery-oidc-form.png)
To configure OIDC via the custom endpoints, set the **Configuration Type** field to **Custom** and input the required endpoint fields.
![OIDC general custom config](../../../images/sso/general-oidc/custom-oidc-form.png)
![OIDC general custom config](../../../../images/sso/general-oidc/custom-oidc-form.png)
2.3. Select the appropriate JWT signature algorithm for your IdP. Currently, the supported options are RS256, RS512, HS256, and EdDSA.
@@ -55,7 +56,7 @@ Prerequisites:
<Step title="Enable OIDC SSO in Infisical">
Enabling OIDC SSO allows members in your organization to log into Infisical via the configured Identity Provider
![OIDC general enable OIDC](../../../images/sso/general-oidc/org-oidc-enable.png)
![OIDC general enable OIDC](../../../../images/sso/general-oidc/org-oidc-enable.png)
</Step>
<Step title="Enforce OIDC SSO in Infisical">

23
docs/mint.json
View File

@@ -266,14 +266,25 @@
"documentation/platform/sso/google-saml",
"documentation/platform/sso/auth0-saml",
{
"group": "Keycloak OIDC",
"group": "OIDC",
"pages": [
"documentation/platform/sso/keycloak-oidc/overview",
"documentation/platform/sso/keycloak-oidc/group-membership-mapping"
{
"group": "Keycloak OIDC",
"pages": [
"documentation/platform/sso/keycloak-oidc/overview",
"documentation/platform/sso/keycloak-oidc/group-membership-mapping"
]
},
"documentation/platform/sso/auth0-oidc",
{
"group": "General OIDC",
"pages": [
"documentation/platform/sso/general-oidc/overview",
"documentation/platform/sso/general-oidc/group-membership-mapping"
]
}
]
},
"documentation/platform/sso/auth0-oidc",
"documentation/platform/sso/general-oidc"
}
]
},
{