From 14c8e3fa3bdab2311b7c08e82fba7dd4b7f91c87 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Fri, 15 Dec 2023 13:54:28 +0700 Subject: [PATCH] Update SSO docs to use Mintlify steps --- docs/documentation/platform/sso/azure.mdx | 126 +++++++++--------- docs/documentation/platform/sso/github.mdx | 53 ++++---- docs/documentation/platform/sso/gitlab.mdx | 53 ++++---- docs/documentation/platform/sso/google.mdx | 45 ++++--- docs/documentation/platform/sso/jumpcloud.mdx | 90 +++++++------ docs/documentation/platform/sso/okta.mdx | 114 ++++++++-------- 6 files changed, 245 insertions(+), 236 deletions(-) diff --git a/docs/documentation/platform/sso/azure.mdx b/docs/documentation/platform/sso/azure.mdx index b280feaa9..20137c19b 100644 --- a/docs/documentation/platform/sso/azure.mdx +++ b/docs/documentation/platform/sso/azure.mdx @@ -10,97 +10,97 @@ description: "Configure Azure SAML for Infisical SSO" then you should contact team@infisical.com to purchase an enterprise license to use it. -1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**. - Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application. + + + In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**. -![Azure SAML initial configuration](../../../images/sso/azure/init-config.png) + Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application. -2. In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select - **+ New application**. + ![Azure SAML initial configuration](../../../images/sso/azure/init-config.png) + + + In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select **+ New application**. -![Azure SAML enterprise applications](../../../images/sso/azure/enterprise-applications.png) + ![Azure SAML enterprise applications](../../../images/sso/azure/enterprise-applications.png) -![Azure SAML new application](../../../images/sso/azure/new-application.png) + ![Azure SAML new application](../../../images/sso/azure/new-application.png) + + On the next screen, press the **+ Create your own application** button. + Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)" + option and hit the **Create** button. -2. On the next screen, press the **+ Create your own application** button. - Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)" - option and hit the **Create** button. + ![Azure SAML create own application](../../../images/sso/azure/create-own-application.png) -![Azure SAML create own application](../../../images/sso/azure/create-own-application.png) + On the application overview screen, select **Single sign-on** from the left sidebar. From there, select the **SAML** single sign-on method. -3. On the application overview screen, select **Single sign-on** from the left sidebar. From there, - select the **SAML** single sign-on method. + ![Azure SAML sign on method](../../../images/sso/azure/sso-method.png) -![Azure SAML sign on method](../../../images/sso/azure/sso-method.png) + Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)** to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1. -4. Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)** - to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1. + ![Azure SAML edit basic configuration](../../../images/sso/azure/edit-basic-config.png) -![Azure SAML edit basic configuration](../../../images/sso/azure/edit-basic-config.png) + ![Azure SAML edit basic configuration 2](../../../images/sso/azure/edit-basic-config-2.png) -![Azure SAML edit basic configuration 2](../../../images/sso/azure/edit-basic-config-2.png) + + If you're self-hosting Infisical, then you will want to replace + `https://app.infisical.com` with your own domain. + - - If you're self-hosting Infisical, then you will want to replace - `https://app.infisical.com` with your own domain. - + Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map: -5. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map: + - `email -> user.userprinciplename` + - `firstName -> user.firstName` + - `lastName -> user.lastName` -- `email -> user.userprinciplename` -- `firstName -> user.firstName` -- `lastName -> user.lastName` + ![Azure SAML edit attributes and claims](../../../images/sso/azure/edit-attributes-claims.png) -![Azure SAML edit attributes and claims](../../../images/sso/azure/edit-attributes-claims.png) + ![Azure SAML edit attributes and claims 2](../../../images/sso/azure/edit-attributes-claims-2.png) -![Azure SAML edit attributes and claims 2](../../../images/sso/azure/edit-attributes-claims-2.png) + Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**. -6. Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**. + ![Azure SAML edit certificate](../../../images/sso/azure/edit-saml-certificate.png) -![Azure SAML edit certificate](../../../images/sso/azure/edit-saml-certificate.png) + ![Azure SAML edit certificate signing option](../../../images/sso/azure/edit-saml-certificate-2.png) + + + In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical. -![Azure SAML edit certificate signing option](../../../images/sso/azure/edit-saml-certificate-2.png) + ![Azure SAML identity provider values 1](../../../images/sso/azure/idp-values.png) -7. Get IdP values: + In the **Properties** screen, copy the **Application ID** to use when finishing configuring Azure SAML in Infisical. -In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical. + ![Azure SAML identity provider values 2](../../../images/sso/azure/idp-values-2.png) + + + Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration. -![Azure SAML identity provider values 1](../../../images/sso/azure/idp-values.png) + ![Azure SAML paste identity provider values](../../../images/sso/azure/idp-values-3.png) -In the **Properties** screen, copy the **Application ID** to use when finishing configuring Azure SAML in Infisical. + + When pasting the certificate into Infisical, you'll want to retain `-----BEGIN + CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line + of the text area respectively. -![Azure SAML identity provider values 2](../../../images/sso/azure/idp-values-2.png) + Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure. -Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from above. Once you've done that, press **Update** to complete the required configuration. + + + + Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level. + + ![Azure SAML assignment](../../../images/sso/azure/assignment.png) + + + Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure. -![Azure SAML paste identity provider values](../../../images/sso/azure/idp-values-3.png) - - -When pasting the certificate into Infisical, you'll want to retain `-----BEGIN - CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line - of the text area respectively. - -Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure. - - - -7. Assignments - -Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level. -![Azure SAML assignment](../../../images/sso/azure/assignment.png) - -8. Return to Infisical and enable SAML SSO. - -Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Azure. - -![Azure SAML assignment](../../../images/sso/azure/enable-saml.png) + ![Azure SAML assignment](../../../images/sso/azure/enable-saml.png) + + If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to - set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work: + set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work: - - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string. + - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`. - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) - - - + \ No newline at end of file diff --git a/docs/documentation/platform/sso/github.mdx b/docs/documentation/platform/sso/github.mdx index faab5a074..87d1b3cf7 100644 --- a/docs/documentation/platform/sso/github.mdx +++ b/docs/documentation/platform/sso/github.mdx @@ -5,38 +5,39 @@ description: "Configure GitHub SSO for Infisical" Using GitHub SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GitHub and registering your instance with it. -## Create an OAuth application in GitHub + + + Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application. -Navigate to your user Settings > Developer settings > OAuth Apps to create a new GitHub OAuth application. + ![GitHub settings](../../../images/sso/github/settings.png) + ![GitHub developer settings](../../../images/sso/github/dev-settings.png) + ![GitHub create new OAuth application](../../../images/sso/github/new-app.png) -![GitHub settings](../../../images/sso/github/settings.png) -![GitHub developer settings](../../../images/sso/github/dev-settings.png) -![GitHub create new OAuth application](../../../images/sso/github/new-app.png) + Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com` + and the **Authorization callback URL** to `https://your-domain.com/api/v1/sso/github`. -Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com` -and the **Authorization callback URL** to `https://your-domain.com/api/v1/sso/github`. + ![GitHub create new OAuth application form](../../../images/sso/github/new-app-form.png) -![GitHub create new OAuth application form](../../../images/sso/github/new-app-form.png) + + If you have a GitHub organization, you can create an OAuth application under it + in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App. + + + + Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application. - - If you have a GitHub organization, you can create an OAuth application under it - in your organization Settings > Developer settings > OAuth Apps > New Org OAuth App. - + ![GCP obtain OAuth2 credentials](../../../images/sso/github/credentials.png) -## Add your OAuth application credentials to Infisical + Back in your Infisical instance, make sure to set the following environment variables: -Obtain the **Client ID** and generate a new **Client Secret** for your GitHub OAuth application. - -![GCP obtain OAuth2 credentials](../../../images/sso/github/credentials.png) - -Back in your Infisical instance, make sure to set the following environment variables: - -- `CLIENT_ID_GITHUB_LOGIN`: The **Client ID** of your GitHub OAuth application. -- `CLIENT_SECRET_GITHUB_LOGIN`: The **Client Secret** of your GitHub OAuth application. -- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string. -- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) - -Once added, restart your Infisical instance and log in with GitHub. + - `CLIENT_ID_GITHUB_LOGIN`: The **Client ID** of your GitHub OAuth application. + - `CLIENT_SECRET_GITHUB_LOGIN`: The **Client Secret** of your GitHub OAuth application. + - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`. + - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) + + Once added, restart your Infisical instance and log in with GitHub. + + ## FAQ @@ -45,7 +46,7 @@ Once added, restart your Infisical instance and log in with GitHub. It is likely that you have misconfigured your self-hosted instance of Infisical. You should: - Check that you have set the `CLIENT_ID_GITHUB_LOGIN`, `CLIENT_SECRET_GITHUB_LOGIN`, - `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables. + `AUTH_SECRET`, and `SITE_URL` environment variables. - Check that the **Authorization callback URL** specified in GitHub matches the `SITE_URL` environment variable. For example, if the former is `https://app.infisical.com/api/v1/sso/github` then the latter should be `https://app.infisical.com`. diff --git a/docs/documentation/platform/sso/gitlab.mdx b/docs/documentation/platform/sso/gitlab.mdx index 7ae6e4a95..446758ae0 100644 --- a/docs/documentation/platform/sso/gitlab.mdx +++ b/docs/documentation/platform/sso/gitlab.mdx @@ -5,38 +5,39 @@ description: "Configure GitLab SSO for Infisical" Using GitLab SSO on a self-hosted instance of Infisical requires configuring an OAuth application in GitLab and registering your instance with it. -## Create an OAuth application in GitLab + + + Navigate to your user Settings > Applications to create a new GitLab application. -Navigate to your user Settings > Applications to create a new GitLab application. + ![sso gitlab config](/images/sso/gitlab/edit-profile.png) + ![sso gitlab config](/images/sso/gitlab/new-app.png) -![sso gitlab config](/images/sso/gitlab/edit-profile.png) -![sso gitlab config](/images/sso/gitlab/new-app.png) + Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/api/v1/sso/gitlab`. + Note that only `read_user` is required as part of the **Scopes** configuration. -Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/api/v1/sso/gitlab`. -Note that only `read_user` is required as part of the **Scopes** configuration. + ![sso gitlab config](/images/sso/gitlab/new-app-form.png) -![sso gitlab config](/images/sso/gitlab/new-app-form.png) + + If you have a GitLab group, you can create an OAuth application under it + in your group Settings > Applications. + + + + Obtain the **Application ID** and **Secret** for your GitLab application. - - If you have a GitLab group, you can create an OAuth application under it - in your group Settings > Applications. - + ![sso gitlab config](/images/sso/gitlab/credentials.png) -## Add your OAuth application credentials to Infisical + Back in your Infisical instance, make sure to set the following environment variables: -Obtain the **Application ID** and **Secret** for your GitLab application. - -![sso gitlab config](/images/sso/gitlab/credentials.png) - -Back in your Infisical instance, make sure to set the following environment variables: - -- `CLIENT_ID_GITLAB_LOGIN`: The **Client ID** of your GitLab application. -- `CLIENT_SECRET_GITLAB_LOGIN`: The **Secret** of your GitLab application. -- (optional) `URL_GITLAB_LOGIN`: The URL of your self-hosted instance of GitLab where the OAuth application is registered. If no URL is passed in, this will default to `https://gitlab.com`. -- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string. -- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) - -Once added, restart your Infisical instance and log in with GitLab. + - `CLIENT_ID_GITLAB_LOGIN`: The **Client ID** of your GitLab application. + - `CLIENT_SECRET_GITLAB_LOGIN`: The **Secret** of your GitLab application. + - (optional) `URL_GITLAB_LOGIN`: The URL of your self-hosted instance of GitLab where the OAuth application is registered. If no URL is passed in, this will default to `https://gitlab.com`. + - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`. + - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) + + Once added, restart your Infisical instance and log in with GitLab. + + ## FAQ @@ -45,7 +46,7 @@ Once added, restart your Infisical instance and log in with GitLab. It is likely that you have misconfigured your self-hosted instance of Infisical. You should: - Check that you have set the `CLIENT_ID_GITLAB_LOGIN`, `CLIENT_SECRET_GITLAB_LOGIN`, - `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables. + `AUTH_SECRET`, and `SITE_URL` environment variables. - Check that the **Redirect URI** specified in GitLab matches the `SITE_URL` environment variable. For example, if the former is `https://app.infisical.com/api/v1/sso/gitlab` then the latter should be `https://app.infisical.com`. diff --git a/docs/documentation/platform/sso/google.mdx b/docs/documentation/platform/sso/google.mdx index 2546a5be8..cf35dcb68 100644 --- a/docs/documentation/platform/sso/google.mdx +++ b/docs/documentation/platform/sso/google.mdx @@ -5,31 +5,32 @@ description: "Configure Google SSO for Infisical" Using Google SSO on a self-hosted instance of Infisical requires configuring an OAuth2 application in GCP and registering your instance with it. -## Create an OAuth2 application in GCP + + + Navigate to your project API & Services > Credentials to create a new OAuth2 application. + + ![GCP API services](../../../images/sso/google/api-services.png) + ![GCP create new OAuth2 application](../../../images/sso/google/new-app.png) -Navigate to your project API & Services > Credentials to create a new OAuth2 application. - -![GCP API services](../../../images/sso/google/api-services.png) -![GCP create new OAuth2 application](../../../images/sso/google/new-app.png) + Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/api/v1/sso/google`. -Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/api/v1/sso/google`. + ![GCP create new OAuth2 application form](../../../images/sso/google/new-app-form.png) + + + Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application. -![GCP create new OAuth2 application form](../../../images/sso/google/new-app-form.png) + ![GCP obtain OAuth2 credentials](../../../images/sso/google/credentials.png) + + Back in your Infisical instance, make sure to set the following environment variables: -## Add your OAuth2 application credentials to Infisical - -Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application. - -![GCP obtain OAuth2 credentials](../../../images/sso/google/credentials.png) - -Back in your Infisical instance, make sure to set the following environment variables: - -- `CLIENT_ID_GOOGLE_LOGIN`: The **Client ID** of your GCP OAuth2 application. -- `CLIENT_SECRET_GOOGLE_LOGIN`: The **Client Secret** of your GCP OAuth2 application. -- `JWT_PROVIDER_AUTH_SECRET`: A secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string. -- `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) - -Once added, restart your Infisical instance and log in with Google + - `CLIENT_ID_GOOGLE_LOGIN`: The **Client ID** of your GCP OAuth2 application. + - `CLIENT_SECRET_GOOGLE_LOGIN`: The **Client Secret** of your GCP OAuth2 application. + - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`. + - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) + + Once added, restart your Infisical instance and log in with Google + + ## FAQ @@ -38,7 +39,7 @@ Once added, restart your Infisical instance and log in with Google It is likely that you have misconfigured your self-hosted instance of Infisical. You should: - Check that you have set the `CLIENT_ID_GOOGLE_LOGIN`, `CLIENT_SECRET_GOOGLE_LOGIN`, - `JWT_PROVIDER_AUTH_SECRET`, and `SITE_URL` environment variables. + `AUTH_SECRET`, and `SITE_URL` environment variables. - Check that the **Authorized redirect URI** specified in GCP matches the `SITE_URL` environment variable. For example, if the former is `https://app.infisical.com/api/v1/sso/google` then the latter should be `https://app.infisical.com`. diff --git a/docs/documentation/platform/sso/jumpcloud.mdx b/docs/documentation/platform/sso/jumpcloud.mdx index 4c2908416..e9ffb4f5e 100644 --- a/docs/documentation/platform/sso/jumpcloud.mdx +++ b/docs/documentation/platform/sso/jumpcloud.mdx @@ -10,73 +10,77 @@ description: "Configure JumpCloud SAML for Infisical SSO" then you should contact team@infisical.com to purchase an enterprise license to use it. -1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**. - Next, copy the **ACS URL** and **SP Entity ID** to use when configuring the JumpCloud SAML application. + + + In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**. -![JumpCloud SAML initial configuration](../../../images/sso/jumpcloud/init-config.png) + Next, copy the **ACS URL** and **SP Entity ID** to use when configuring the JumpCloud SAML application. -2. In the JumpCloud Admin Portal, navigate to User Authentication > SSO and create an application. If this is your first application, select **Get Started**; - if not, select **+Add New Application** + ![JumpCloud SAML initial configuration](../../../images/sso/jumpcloud/init-config.png) + + + 2.1. In the JumpCloud Admin Portal, navigate to User Authentication > SSO and create an application. If this is your first application, select **Get Started**; if not, select **+Add New Application** -![JumpCloud SAML new application](../../../images/sso/jumpcloud/new-application.png) + ![JumpCloud SAML new application](../../../images/sso/jumpcloud/new-application.png) -3. Next, select **Custom SAML App** to open up the **New SSO** dialog. + 2.2. Next, select **Custom SAML App** to open up the **New SSO** dialog. -![JumpCloud custom SAML app](../../../images/sso/jumpcloud/custom-saml-app.png) + ![JumpCloud custom SAML app](../../../images/sso/jumpcloud/custom-saml-app.png) -4. In the **General Info** tab, give the application a unique name like Infisical. + 2.3. In the **General Info** tab, give the application a unique name like Infisical. -![JumpCloud general info](../../../images/sso/jumpcloud/general-info.png) + ![JumpCloud general info](../../../images/sso/jumpcloud/general-info.png) -5. In the **SSO** tab, set the **SP Entity ID** and **ACS URL** from step 1; set the **IdP Entity ID** to the same value as the **SP Entity ID**. + 2.4. In the **SSO** tab, set the **SP Entity ID** and **ACS URL** from step 1; set the **IdP Entity ID** to the same value as the **SP Entity ID**. -![JumpCloud edit basic config](../../../images/sso/jumpcloud/edit-basic-config.png) + ![JumpCloud edit basic config](../../../images/sso/jumpcloud/edit-basic-config.png) -6. On the same tab, check the **Sign Assertion** checkbox and fill the **IDP URL** to something unique. - Copy the **IDP URL** to use when finishing configuring the JumpCloud SAML in Infisical. + 2.5. On the same tab, check the **Sign Assertion** checkbox and fill the **IDP URL** to something unique. + Copy the **IDP URL** to use when finishing configuring the JumpCloud SAML in Infisical. -![JumpCloud edit basic config 2](../../../images/sso/jumpcloud/edit-basic-config-2.png) + ![JumpCloud edit basic config 2](../../../images/sso/jumpcloud/edit-basic-config-2.png) -7. On the same tab, in the **Attributes** section, configure the following map: + 2.6. On the same tab, in the **Attributes** section, configure the following map: -- `email -> email` -- `firstName -> firstname` -- `lastName -> lastname` + - `email -> email` + - `firstName -> firstname` + - `lastName -> lastname` -![JumpCloud attribute statements](../../../images/sso/jumpcloud/attribute-statements.png) + ![JumpCloud attribute statements](../../../images/sso/jumpcloud/attribute-statements.png) -Finally press activate to create the SAML application. + Finally press activate to create the SAML application. -8. Next, select the newly created SAML application and select **Download certificate** under the **IDP Certificate Valid** dropdown + 2.7. Next, select the newly created SAML application and select **Download certificate** under the **IDP Certificate Valid** dropdown -![JumpCloud download certificate](../../../images/sso/jumpcloud/download-saml-certificate.png) + ![JumpCloud download certificate](../../../images/sso/jumpcloud/download-saml-certificate.png) + + + Back in Infisical, set the **IDP URL** from step 2.5 and the **IdP Entity ID** from step 2.4. Also, paste the certificate from the previous step. -9. Back in Infisical, set the **IDP URL** from step 6 and the **IdP Entity ID** from step 5. Also, paste the certificate from the previous step. + ![JumpCloud IdP values](../../../images/sso/jumpcloud/idp-values.png) -![JumpCloud IdP values](../../../images/sso/jumpcloud/idp-values.png) + + When pasting the certificate into Infisical, you'll want to retain `-----BEGIN + CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line + of the text area respectively. + + + + Back in JumpCloud, navigate to the **User Groups** tab and assign users to the newly created application. - - When pasting the certificate into Infisical, you'll want to retain `-----BEGIN - CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line - of the text area respectively. - + ![JumpCloud SAML assignment](../../../images/sso/jumpcloud/assignment.png) + + + Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via JumpCloud. -10. Assignments - -Back in JumpCloud, navigate to the **User Groups** tab and assign users to the newly created application. - -![JumpCloud SAML assignment](../../../images/sso/jumpcloud/assignment.png) - -11. Return to Infisical and enable SAML SSO. - -Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via JumpCloud. - -![JumpCloud SAML assignment](../../../images/sso/jumpcloud/enable-saml.png) + ![JumpCloud SAML assignment](../../../images/sso/jumpcloud/enable-saml.png) + + If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to - set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work: + set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work: - - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string. + - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`. - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) diff --git a/docs/documentation/platform/sso/okta.mdx b/docs/documentation/platform/sso/okta.mdx index f5db2529c..c07aca9ac 100644 --- a/docs/documentation/platform/sso/okta.mdx +++ b/docs/documentation/platform/sso/okta.mdx @@ -10,78 +10,80 @@ description: "Configure Okta SAML 2.0 for Infisical SSO" then you should contact team@infisical.com to purchase an enterprise license to use it. -1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**. - Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application. + + + In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**. + + Next, copy the **Single sign-on URL** and **Audience URI (SP Entity ID)** to use when configuring the Okta SAML 2.0 application. + ![Okta SAML initial configuration](../../../images/sso/okta/init-config.png) + + + In the Okta Admin Portal, select Applications > Applications from the navigation. On the Applications screen, select the **Create App Integration** + button. -![Okta SAML initial configuration](../../../images/sso/okta/init-config.png) + ![SAML Okta create app integration](../../../images/sso/okta/create-app-integration.png) + + In the Create a New Application Integration dialog, select the **SAML 2.0** radio button: -2. In the Okta Admin Portal, select Applications > Applications from the - navigation. On the Applications screen, select the **Create App Integration** - button. + ![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/create-saml-app.png) + + On the General Settings screen, give the application a unique name like Infisical and select **Next**. + + ![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/general-settings.png) + + On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1. -![SAML Okta create app integration](../../../images/sso/okta/create-app-integration.png) + ![SAML Okta configure IdP fields](../../../images/sso/okta/configure-saml.png) + + + If you're self-hosting Infisical, then you will want to replace + `https://app.infisical.com` with your own domain. + + + Also on the Configure SAML screen, configure the **Attribute Statements** to map: -3. In the Create a New Application Integration dialog, select the **SAML 2.0** radio button: + - `id -> user.id`, + - `email -> user.email`, + - `firstName -> user.firstName` + - `lastName -> user.lastName` -![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/create-saml-app.png) + ![SAML Okta attribute statements](../../../images/sso/okta/attribute-statements.png) -4. On the General Settings screen, give the application a unique name like Infisical and select **Next**. + Once configured, select **Next** to proceed to the Feedback screen and select **Finish**. + + + Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen: -![SAML Okta create SAML 2.0 integration](../../../images/sso/okta/general-settings.png) + ![SAML Okta view setup instructions](../../../images/sso/okta/view-setup-instructions.png) -5. On the Configure SAML screen, set the **Single sign-on URL** and **Audience URI (SP Entity ID)** from step 1. + Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical. -![SAML Okta configure IdP fields](../../../images/sso/okta/configure-saml.png) + ![SAML Okta IdP values](../../../images/sso/okta/idp-values.png) + + + Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**, + and **Certificate** to **X.509 Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration. - - If you're self-hosting Infisical, then you will want to replace - `https://app.infisical.com` with your own domain. - + ![SAML Okta paste values into Infisical](../../../images/sso/okta/idp-values-2.png) + + + Back in Okta, navigate to the **Assignments** tab and select **Assign**. You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option. -6. Also on the Configure SAML screen, configure the **Attribute Statements** to map: + ![SAML Okta assignment](../../../images/sso/okta/assignment.png) -- `id -> user.id`, -- `email -> user.email`, -- `firstName -> user.firstName` -- `lastName -> user.lastName` + At this point, you have configured everything you need within the context of the Okta Admin Portal. + + + Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta. -![SAML Okta attribute statements](../../../images/sso/okta/attribute-statements.png) - -Once configured, select **Next** to proceed to the Feedback screen and select **Finish**. - -7. Get IdP values - -Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen: - -![SAML Okta view setup instructions](../../../images/sso/okta/view-setup-instructions.png) - -Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring Okta SAML in Infisical. - -![SAML Okta IdP values](../../../images/sso/okta/idp-values.png) - -Back in Infisical, set **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**, -and **Certificate** to **X.509 Certificate** from above. Once you've done that, press **Update** to complete the required configuration. - -![SAML Okta paste values into Infisical](../../../images/sso/okta/idp-values-2.png) - -8. Finally, navigate to the **Assignments** tab and select **Assign** - -You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option. - -![SAML Okta assignment](../../../images/sso/okta/assignment.png) - -At this point, you have configured everything you need within the context of the Okta Admin Portal. - -9. Return to Infisical and enable SAML SSO. - -Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta. - -![SAML Okta assignment](../../../images/sso/okta/enable-saml.png) + ![SAML Okta assignment](../../../images/sso/okta/enable-saml.png) + + If you're configuring SAML SSO on a self-hosted instance of Infisical, make sure to - set the `JWT_PROVIDER_AUTH_SECRET` and `SITE_URL` environment variable for it to work: + set the `AUTH_SECRET` and `SITE_URL` environment variable for it to work: - - `JWT_PROVIDER_AUTH_SECRET`: This is secret key used for signing and verifying JWT. This could be a randomly-generated 256-bit hex string. + - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`. - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com) \ No newline at end of file