Merge pull request #3602 from Infisical/general-oidc-group-mapping-docs

docs(oidc-group-membership-mapping): Add general OIDC group membership mapping documentation

docs/documentation/platform/sso/general-oidc/group-membership-mapping.mdx

@@ -0,0 +1,55 @@
+---
+title: "General OIDC Group Membership Mapping"
+sidebarTitle: "Group Membership Mapping"
+description: "Learn how to sync OIDC group members to matching groups in Infisical."
+---
+
+You can have Infisical automatically sync group
+memberships between your OIDC provider and Infisical by configuring a `groups` claim on your provider tokens.
+When a user logs in via OIDC, they will be added to Infisical groups that are present in their OIDC `groups` claim,
+and removed from any Infisical groups not present in the claim.
+
+<Info>
+    When enabled, manual
+    management of Infisical group memberships will be disabled.
+</Info>
+
+<Warning>
+    Group membership changes in your OIDC provider only sync with Infisical when a
+    user logs in via OIDC. For example, if you remove a user from a group in your OIDC provider,
+    this change will not be reflected in Infisical until their next OIDC login.
+    To ensure this behavior, Infisical recommends enabling Enforce OIDC SSO in the OIDC settings.
+</Warning>
+
+
+<Steps>
+    <Step title="Configure a groups claim in your OIDC provider">
+       To enable OIDC Group Membership Mapping, you must configure a `groups` claim in your OIDC provider.
+
+        Add a `groups` property with a list of the user's OIDC group names to your token.
+
+        Example of expected token payload:
+        ```json
+        {
+            // "email": "[email protected]",
+            // "given_name": "John",
+            // ...other claims
+            "groups": ["Billing Group", "Sales Group"]
+        }
+        ```
+
+        <Note>
+            Setup varies between OIDC providers. Please refer to your OIDC provider's documentation for more information.
+        </Note>
+    </Step>
+    <Step title="Setup groups in Infisical and enable OIDC Group Membership Mapping">
+        2.1. In Infisical, create any groups you would like to sync users to. Make sure the name of the Infisical group is an exact match of the OIDC group name.
+        ![OIDC general infisical group](/images/sso/keycloak-oidc/group-membership-mapping/create-infisical-group.png)
+
+        2.2. Next, enable **OIDC Group Membership Mapping** on the **Single Sign-On (SSO)** page under the **General** tab.
+        ![OIDC general enable group membership mapping](/images/sso/keycloak-oidc/group-membership-mapping/enable-group-membership-mapping.png)
+
+        2.3. The next time a user logs in they will be synced to their matching OIDC groups.
+        ![OIDC general synced users](/images/sso/keycloak-oidc/group-membership-mapping/synced-users.png)
+    </Step>
+</Steps>

docs/documentation/platform/sso/general-oidc/overview.mdx

@@ -1,5 +1,6 @@
 ---
 title: "General OIDC"
+sidebarTitle: "Overview"
 description: "Learn how to configure OIDC for Infisical SSO with any OIDC-compliant identity provider"
 ---
 
@@ -29,7 +30,7 @@ Prerequisites:
    </Step>
    <Step title="Finish configuring OIDC in Infisical">
       2.1. Back in Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Select **Connect** for **OIDC**.
-      ![OIDC SSO Connect](../../../images/sso/connect-oidc.png)
+      ![OIDC SSO Connect](../../../../images/sso/connect-oidc.png)
 
       2.2. You can configure OIDC either through the Discovery URL (Recommended) or by inputting custom endpoints.
 
@@ -39,10 +40,10 @@ Prerequisites:
       Note that the Discovery Document URL typically takes the form: `https://<idp-domain>/.well-known/openid-configuration`.
       </Note>
 
-      ![OIDC general discovery config](../../../images/sso/general-oidc/discovery-oidc-form.png)
+      ![OIDC general discovery config](../../../../images/sso/general-oidc/discovery-oidc-form.png)
 
       To configure OIDC via the custom endpoints, set the **Configuration Type** field to **Custom** and input the required endpoint fields.
-      ![OIDC general custom config](../../../images/sso/general-oidc/custom-oidc-form.png)
+      ![OIDC general custom config](../../../../images/sso/general-oidc/custom-oidc-form.png)
 
       2.3. Select the appropriate JWT signature algorithm for your IdP. Currently, the supported options are RS256, RS512, HS256, and EdDSA.
 
@@ -55,7 +56,7 @@ Prerequisites:
      <Step title="Enable OIDC SSO in Infisical">
       Enabling OIDC SSO allows members in your organization to log into Infisical via the configured Identity Provider
 
-      ![OIDC general enable OIDC](../../../images/sso/general-oidc/org-oidc-enable.png)
+      ![OIDC general enable OIDC](../../../../images/sso/general-oidc/org-oidc-enable.png)
     </Step>
 
     <Step title="Enforce OIDC SSO in Infisical">

docs/mint.json

@@ -266,14 +266,25 @@
                 "documentation/platform/sso/google-saml",
                 "documentation/platform/sso/auth0-saml",
                 {
-                  "group": "Keycloak OIDC",
+                  "group": "OIDC",
                   "pages": [
-                    "documentation/platform/sso/keycloak-oidc/overview",
+                    {
-                    "documentation/platform/sso/keycloak-oidc/group-membership-mapping"
+                      "group": "Keycloak OIDC",
+                      "pages": [
+                        "documentation/platform/sso/keycloak-oidc/overview",
+                        "documentation/platform/sso/keycloak-oidc/group-membership-mapping"
+                      ]
+                    },
+                    "documentation/platform/sso/auth0-oidc",
+                    {
+                      "group": "General OIDC",
+                      "pages": [
+                        "documentation/platform/sso/general-oidc/overview",
+                        "documentation/platform/sso/general-oidc/group-membership-mapping"
+                      ]
+                    }
                   ]
-                },
+                }
-                "documentation/platform/sso/auth0-oidc",
-                "documentation/platform/sso/general-oidc"
               ]
             },
             {