diff --git a/docs/documentation/platform/saml.mdx b/docs/documentation/platform/saml.mdx new file mode 100644 index 000000000..6f58f7900 --- /dev/null +++ b/docs/documentation/platform/saml.mdx @@ -0,0 +1,100 @@ +--- +title: "SSO" +description: "Log in to Infisical via SSO protocols" +--- + + + Infisical currently only supports SAML SSO authentication with [Okta as the + identity provider (IDP)](https://www.okta.com/). We're expanding support for + other IDPs in the coming months, so stay tuned with this issue + [here](https://github.com/Infisical/infisical/issues/442). + + +You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0). + +To note, configuring SSO retains the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps. In all login with SSO implementations, +your IDP cannot and will not have access to the decryption key needed to decrypt your secrets. + +## Configuration + +Head over to your organization Settings > Authentication > SAML SSO Configuration. + +Next, press "Set up SAML SSO" in the SAML SSO and follow the instructions +below to configure SSO for your identity provider: + + + Note that only members with the `owner` or `admin` roles in an organization + can configure SSO for it. + + + + + 1. In the Okta Admin Portal, select Applications > Applications from the + navigation. On the Applications screen, select the Create App Integration + button. + + ![SAML Okta create app integration](../../images/saml-okta-1.png) + + 2. In the Create a New Application Integration dialog, select the SAML 2.0 radio button: + + ![SAML Okta create SAML 2.0 integration](../../images/saml-okta-2.png) + + 3. On the General Settings screen, give the application a unique, Infisical-specific name and select Next. + + 4. On the Configure SAML screen, configure the following fields: + + - Single sign on URL: `https://app.infisical.com/api/v1/sso/saml2/:identifier`; we'll update the `:identifier` part later in step 6. + - Audience URI (SP Entity ID): `https://app.infisical.com` + + ![SAML Okta configure IDP fields](../../images/saml-okta-3.png) + + + If you're self-hosting Infisical, then you will want to replace `https://app.infisical.com` with your own domain. + + + 4. Also on the Configure SAML screen, configure the Attribute Statements to map: + + - `id -> user.id`, + - `email -> user.email`, + - `firstName -> user.firstName` + - `lastName -> user.lastName` + + ![SAML Okta attribute statements](../../images/saml-okta-4.png) + + Once configured, select the Next button to proceed to the Feedback screen and select Finish. + + 5. Get IDP values + + Once your application is created, select the Sign On tab for the app and select the View Setup Instructions button located on the right side of the screen: + + Copy the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate to be pasted into your Infisical SAML SSO configuration details with the following map: + + - `Audience -> Okta Audience URI (SP Entity ID)` + - `Entrypoint -> Okta Identity Provider Single Sign-On URL` + - `Issuer -> Identity Provider Issuer` + - `Certificate -> X.509 Certificate`. + + ![SAML Okta IDP values](../../images/saml-okta-5.png) + + ![SAML Okta paste values into Infisical](../../images/saml-okta-6.png) + + 6. Create the SSO configuration and copy your SSO identifier in Infisical; update `:identifier` from step 4 earlier to be this value. + + ![SAML Okta assignments](../../images/saml-okta-7.png) + + 7. Assignments + + Finally, Navigate to the Assignments tab and select the Assign button: + + You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option. + + ![SAML Okta assignment](../../images/saml-okta-8.png) + + At this point, you have configured everything you need within the context of the Okta Admin Portal. + + 8. Return to Infisical and enable SAML SSO. + + Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta. + + + diff --git a/docs/images/saml-okta-1.png b/docs/images/saml-okta-1.png new file mode 100644 index 000000000..8ffac381b Binary files /dev/null and b/docs/images/saml-okta-1.png differ diff --git a/docs/images/saml-okta-2.png b/docs/images/saml-okta-2.png new file mode 100644 index 000000000..717737af9 Binary files /dev/null and b/docs/images/saml-okta-2.png differ diff --git a/docs/images/saml-okta-3.png b/docs/images/saml-okta-3.png new file mode 100644 index 000000000..eccc8d277 Binary files /dev/null and b/docs/images/saml-okta-3.png differ diff --git a/docs/images/saml-okta-4.png b/docs/images/saml-okta-4.png new file mode 100644 index 000000000..e3c413a6f Binary files /dev/null and b/docs/images/saml-okta-4.png differ diff --git a/docs/images/saml-okta-5.png b/docs/images/saml-okta-5.png new file mode 100644 index 000000000..4acc846f9 Binary files /dev/null and b/docs/images/saml-okta-5.png differ diff --git a/docs/images/saml-okta-6.png b/docs/images/saml-okta-6.png new file mode 100644 index 000000000..0ba9841c8 Binary files /dev/null and b/docs/images/saml-okta-6.png differ diff --git a/docs/images/saml-okta-7.png b/docs/images/saml-okta-7.png new file mode 100644 index 000000000..85ca55a5b Binary files /dev/null and b/docs/images/saml-okta-7.png differ diff --git a/docs/images/saml-okta-8.png b/docs/images/saml-okta-8.png new file mode 100644 index 000000000..bf9f98301 Binary files /dev/null and b/docs/images/saml-okta-8.png differ diff --git a/docs/mint.json b/docs/mint.json index c0d8f9cbe..e93dc2c86 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -118,8 +118,9 @@ "documentation/platform/pit-recovery", "documentation/platform/secret-versioning", "documentation/platform/audit-logs", + "documentation/platform/token", "documentation/platform/mfa", - "documentation/platform/token" + "documentation/platform/saml" ] }, { diff --git a/docs/self-hosting/configuration/email.mdx b/docs/self-hosting/configuration/email.mdx index 15797d73b..160e4f205 100644 --- a/docs/self-hosting/configuration/email.mdx +++ b/docs/self-hosting/configuration/email.mdx @@ -10,7 +10,7 @@ However, the following functionality will be disabled. - Sending invite links via email for projects to teammates - Sending alerts such as suspicious login attempts -## General configuration +## Configuration If you choose to setup email service, you need to configure the following SMTP [environment variables](https://infisical.com/docs/self-hosting/configuration/envars):