From 18e3d132a27026b8e0d97ddf593a6d3527ac6d39 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Wed, 14 May 2025 14:22:35 -0700 Subject: [PATCH 1/3] documentation: add general oidc group membership mapping documentation --- .../general-oidc/group-membership-mapping.mdx | 52 +++++++++++++++++++ .../overview.mdx} | 1 + docs/mint.json | 8 ++- 3 files changed, 60 insertions(+), 1 deletion(-) create mode 100644 docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx rename docs/documentation/platform/sso/{general-oidc.mdx => general-oidc/overview.mdx} (99%) diff --git a/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx b/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx new file mode 100644 index 000000000..48890dc24 --- /dev/null +++ b/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx @@ -0,0 +1,52 @@ +--- +title: "General OIDC Group Membership Mapping" +sidebarTitle: "Group Membership Mapping" +description: "Learn how to sync OIDC group members to matching groups in Infisical." +--- + +You can have Infisical automatically sync group +memberships between your OIDC provider and Infisical by configuring a `groups` claim on your provider tokens. +When a user logs in via OIDC, they will be added to Infisical groups that are present in their OIDC `groups` claim, +and removed from any Infisical groups not present in the claim. + + + When enabled, manual + management of Infisical group memberships will be disabled. + + + + Group membership changes in your OIDC provider only sync with Infisical when a + user logs in via OIDC. For example, if you remove a user from a group in your OIDC provider, + this change will not be reflected in Infisical until their next OIDC login. + To ensure this behavior, Infisical recommends enabling Enforce OIDC SSO in the OIDC settings. + + + + + + 1. To enable OIDC Group Membership Mapping, you must configure a `groups` claim in your OIDC provider with the following format. + + ```json + { + // "email": "john@provider.com", + // "given_name": "John", + // ...other claims + "groups": ["Billing Group", "Sales Group"] + } + ``` + + + Setup varies between OIDC providers. Please refer to your OIDC provider's documentation for more information. + + + + 2.1. In Infisical, create any groups you would like to sync users to. Make sure the name of the Infisical group is an exact match of the OIDC group name. + ![OIDC general infisical group](/images/sso/keycloak-oidc/group-membership-mapping/create-infisical-group.png) + + 2.2. Next, enable **OIDC Group Membership Mapping** on the **Single Sign-On (SSO)** page under the **General** tab. + ![OIDC general enable group membership mapping](/images/sso/keycloak-oidc/group-membership-mapping/enable-group-membership-mapping.png) + + 2.3. The next time a user logs in they will be synced to their matching OIDC groups. + ![OIDC general synced users](/images/sso/keycloak-oidc/group-membership-mapping/synced-users.png) + + \ No newline at end of file diff --git a/docs/documentation/platform/sso/general-oidc.mdx b/docs/documentation/platform/sso/general-oidc/overview.mdx similarity index 99% rename from docs/documentation/platform/sso/general-oidc.mdx rename to docs/documentation/platform/sso/general-oidc/overview.mdx index a10b05cfc..45592c180 100644 --- a/docs/documentation/platform/sso/general-oidc.mdx +++ b/docs/documentation/platform/sso/general-oidc/overview.mdx @@ -1,5 +1,6 @@ --- title: "General OIDC" +sidebarTitle: "Overview" description: "Learn how to configure OIDC for Infisical SSO with any OIDC-compliant identity provider" --- diff --git a/docs/mint.json b/docs/mint.json index 61b89c609..c22d5ecab 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -273,7 +273,13 @@ ] }, "documentation/platform/sso/auth0-oidc", - "documentation/platform/sso/general-oidc" + { + "group": "General OIDC", + "pages": [ + "documentation/platform/sso/general-oidc/overview", + "documentation/platform/sso/general-oidc/group-membership-mapping" + ] + } ] }, { From beb7200233f27c2bb8a05738acec54a5eb3588d9 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Wed, 14 May 2025 14:29:46 -0700 Subject: [PATCH 2/3] fix: correct overview image links --- docs/documentation/platform/sso/general-oidc/overview.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/documentation/platform/sso/general-oidc/overview.mdx b/docs/documentation/platform/sso/general-oidc/overview.mdx index 45592c180..76ac982f8 100644 --- a/docs/documentation/platform/sso/general-oidc/overview.mdx +++ b/docs/documentation/platform/sso/general-oidc/overview.mdx @@ -30,7 +30,7 @@ Prerequisites: 2.1. Back in Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Select **Connect** for **OIDC**. - ![OIDC SSO Connect](../../../images/sso/connect-oidc.png) + ![OIDC SSO Connect](../../../../images/sso/connect-oidc.png) 2.2. You can configure OIDC either through the Discovery URL (Recommended) or by inputting custom endpoints. @@ -40,10 +40,10 @@ Prerequisites: Note that the Discovery Document URL typically takes the form: `https:///.well-known/openid-configuration`. - ![OIDC general discovery config](../../../images/sso/general-oidc/discovery-oidc-form.png) + ![OIDC general discovery config](../../../../images/sso/general-oidc/discovery-oidc-form.png) To configure OIDC via the custom endpoints, set the **Configuration Type** field to **Custom** and input the required endpoint fields. - ![OIDC general custom config](../../../images/sso/general-oidc/custom-oidc-form.png) + ![OIDC general custom config](../../../../images/sso/general-oidc/custom-oidc-form.png) 2.3. Select the appropriate JWT signature algorithm for your IdP. Currently, the supported options are RS256, RS512, HS256, and EdDSA. @@ -56,7 +56,7 @@ Prerequisites: Enabling OIDC SSO allows members in your organization to log into Infisical via the configured Identity Provider - ![OIDC general enable OIDC](../../../images/sso/general-oidc/org-oidc-enable.png) + ![OIDC general enable OIDC](../../../../images/sso/general-oidc/org-oidc-enable.png) From 3b9a50d65d6ea6f372d1c129cf1fbd0357491b12 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Wed, 14 May 2025 16:20:50 -0700 Subject: [PATCH 3/3] improvements: address feedback --- .../general-oidc/group-membership-mapping.mdx | 5 +++- docs/mint.json | 27 +++++++++++-------- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx b/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx index 48890dc24..fd405fdfc 100644 --- a/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx +++ b/docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx @@ -24,8 +24,11 @@ and removed from any Infisical groups not present in the claim. - 1. To enable OIDC Group Membership Mapping, you must configure a `groups` claim in your OIDC provider with the following format. + To enable OIDC Group Membership Mapping, you must configure a `groups` claim in your OIDC provider. + Add a `groups` property with a list of the user's OIDC group names to your token. + + Example of expected token payload: ```json { // "email": "john@provider.com", diff --git a/docs/mint.json b/docs/mint.json index c22d5ecab..5335c7423 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -266,18 +266,23 @@ "documentation/platform/sso/google-saml", "documentation/platform/sso/auth0-saml", { - "group": "Keycloak OIDC", + "group": "OIDC", "pages": [ - "documentation/platform/sso/keycloak-oidc/overview", - "documentation/platform/sso/keycloak-oidc/group-membership-mapping" - ] - }, - "documentation/platform/sso/auth0-oidc", - { - "group": "General OIDC", - "pages": [ - "documentation/platform/sso/general-oidc/overview", - "documentation/platform/sso/general-oidc/group-membership-mapping" + { + "group": "Keycloak OIDC", + "pages": [ + "documentation/platform/sso/keycloak-oidc/overview", + "documentation/platform/sso/keycloak-oidc/group-membership-mapping" + ] + }, + "documentation/platform/sso/auth0-oidc", + { + "group": "General OIDC", + "pages": [ + "documentation/platform/sso/general-oidc/overview", + "documentation/platform/sso/general-oidc/group-membership-mapping" + ] + } ] } ]