mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
merge main
This commit is contained in:
x032205
@@ -95,7 +95,7 @@ To successfully deploy an Infisical Gateway for use, follow these steps in order
|
||||
<Step title="Set Up a Relay Server">
|
||||
Ensure a relay server is running and accessible before you deploy any gateways. You have two options:
|
||||
- **Managed relay (Infisical Cloud, US/EU only):** Managed relays are only available for Infisical Cloud instances in the US and EU regions. If you are using Infisical Cloud in these regions, you can use the provided managed relay.
|
||||
- **Self-hosted relay:** For all other cases, including all self-hosted and dedicated enterprise instances of Infisical, you must deploy your own relay server. You can also choose to deploy your own relay server when using Infisical Cloud if you require reduced geographic proximity to your target resources for lower latency or to reduce network congestion. For setup instructions, see the <a href="/documentation/platform/gateways/relay-deployment">Relay Deployment Guide</a>.
|
||||
- **Self-hosted relay:** For all other cases, including all self-hosted and dedicated enterprise instances of Infisical, you must deploy your own relay server. You can also choose to deploy your own relay server when using Infisical Cloud if you require reduced geographic proximity to your target resources for lower latency or to reduce network congestion. For setup instructions, see the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).
|
||||
</Step>
|
||||
<Step title="Install the Infisical CLI">
|
||||
Make sure the Infisical CLI is installed on the machine or environment where you plan to deploy the gateway. The CLI is required for gateway installation and management.
|
||||
|
||||
@@ -6,8 +6,8 @@ description: "How to access private network resources from Infisical"
|
||||
|
||||
|
||||
|
||||
The Infisical Gateway provides secure access to private resources within your network without needing direct inbound connections to your environment.
|
||||
This is particularly useful when Infisical isn't hosted within the same network as the resources it needs to reach.
|
||||
The Infisical Gateway provides secure access to private resources within your network without needing direct inbound connections to your environment.
|
||||
This is particularly useful when Infisical isn't hosted within the same network as the resources it needs to reach.
|
||||
This method keeps your resources fully protected from external access while enabling Infisical to securely interact with resources like databases.
|
||||
|
||||
<Info>
|
||||
@@ -25,7 +25,7 @@ The Gateway system consists of two primary components working together to enable
|
||||
<Tab title="Gateway" icon="server">
|
||||
A Gateway is a lightweight service that you deploy within your own network infrastructure to provide secure access to your private resources. Think of it as a secure bridge between Infisical and your internal systems.
|
||||
|
||||
Gateways must be deployed within the same network where your target resources are located, with direct network connectivity to the private resources you want Infisical to access.
|
||||
Gateways must be deployed within the same network where your target resources are located, with direct network connectivity to the private resources you want Infisical to access.
|
||||
For different networks, regions, or isolated environments, you'll need to deploy separate gateways.
|
||||
|
||||
**Core Functions:**
|
||||
@@ -40,7 +40,7 @@ The Gateway system consists of two primary components working together to enable
|
||||
|
||||
**Core Functions:**
|
||||
- **Traffic Routing**: Routes encrypted traffic between the Infisical platform and your gateways without storing or inspecting the data
|
||||
- **Network Isolation**: Enables secure communication without requiring direct network connections between Infisical and your private infrastructure
|
||||
- **Network Isolation**: Enables secure communication without requiring direct network connections between Infisical and your private infrastructure
|
||||
- **Authentication Management**: Validates SSH certificates and manages secure routing between authenticated gateways
|
||||
|
||||
**Deployment Options:**
|
||||
@@ -59,6 +59,12 @@ The Gateway system uses SSH reverse tunnels for secure, firewall-friendly connec
|
||||
3. **Request Routing**: When Infisical needs to access your resources, requests are routed through the relay server to the already-established gateway connection
|
||||
4. **Resource Access**: The gateway receives the routed requests and connects to your private resources on behalf of Infisical
|
||||
|
||||
## Health Check
|
||||
|
||||
To monitor their operational status, both gateways and relays transmit hourly heartbeats. A component is considered unhealthy if a heartbeat is not received for over an hour.
|
||||
|
||||
Infisical automatically notifies all organization admins of unhealthy gateway or relay statuses through email and in-app notifications.
|
||||
|
||||
## Getting Started
|
||||
|
||||
Ready to set up your gateway? Follow the guides below.
|
||||
@@ -75,4 +81,4 @@ Ready to set up your gateway? Follow the guides below.
|
||||
<Card title="Security Architecture" href="/documentation/platform/gateways/security">
|
||||
Learn about the security model and implementation best practices.
|
||||
</Card>
|
||||
</Columns>
|
||||
</Columns>
|
||||
|
||||
@@ -0,0 +1,146 @@
|
||||
---
|
||||
title: "AWS Certificate Manager"
|
||||
description: "Learn how to configure an AWS Certificate Manager Certificate Sync for Infisical PKI."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and configure a [Certificate Authority](/documentation/platform/pki/overview)
|
||||
- Create an [AWS Connection](/integrations/app-connections/aws)
|
||||
|
||||
<Note>
|
||||
The AWS Certificate Manager Certificate Sync requires the following ACM permissions to be set on the IAM user/role
|
||||
for Infisical to sync certificates to AWS Certificate Manager: `acm:ListCertificates`, `acm:DescribeCertificate`, `acm:ImportCertificate`, `acm:DeleteCertificate`, and `acm:ListTagsForCertificate`.
|
||||
|
||||
These permissions allow Infisical to list, import, tag, and manage certificates in your AWS Certificate Manager service.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Certificates synced to AWS Certificate Manager will be stored as imported certificates, preserving both the certificate and private key components.
|
||||
</Note>
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Certificate Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **AWS Certificate Manager** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where certificates should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **PKI Subscriber**: The PKI subscriber to retrieve certificates from.
|
||||
|
||||
4. Configure the **Destination** to where certificates should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **AWS Connection**: The AWS Connection to authenticate with.
|
||||
- **AWS Region**: The AWS region where certificates should be stored.
|
||||
|
||||
5. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
|
||||
- **Enable Certificate Removal**: If enabled, Infisical will remove expired certificates from the destination during sync operations. Disable this option if you intend to manage certificate cleanup manually.
|
||||
- **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
|
||||
|
||||
<Tip>
|
||||
**AWS Certificate Manager Certificate Limits**: AWS Certificate Manager has limits on the number of certificates per account and region. Refer to AWS documentation for current limits. Deleted certificates count toward your quota until they are permanently purged by AWS (typically after 30 days).
|
||||
</Tip>
|
||||
|
||||
6. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your AWS Certificate Manager Certificate Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your AWS Certificate Manager Certificate Sync will begin syncing your certificates to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **AWS Certificate Manager Certificate Sync**, make an API request to the [Create AWS Certificate Manager Certificate Sync](/api-reference/endpoints/pki/syncs/aws-certificate-manager/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/pki/syncs/aws-certificate-manager \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-acm-cert-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example certificate sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"destination": "aws-certificate-manager",
|
||||
"isAutoSyncEnabled": true,
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"region": "us-east-1"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```json Response
|
||||
{
|
||||
"pkiSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-acm-cert-sync",
|
||||
"description": "an example certificate sync",
|
||||
"destination": "aws-certificate-manager",
|
||||
"isAutoSyncEnabled": true,
|
||||
"destinationConfig": {
|
||||
"region": "us-east-1"
|
||||
},
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-01-01T00:00:00.000Z",
|
||||
"updatedAt": "2023-01-01T00:00:00.000Z"
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## Certificate Management
|
||||
|
||||
Your AWS Certificate Manager Certificate Sync will:
|
||||
|
||||
- **Automatic Deployment**: Deploy new certificates issued by your PKI subscriber to AWS Certificate Manager
|
||||
- **Certificate Updates**: Update certificates in AWS Certificate Manager when renewals occur
|
||||
- **Expiration Handling**: Optionally remove expired certificates from AWS Certificate Manager (if enabled)
|
||||
- **Tagging**: Automatically tag certificates with an InfisicalCertificate tag for easy identification and management
|
||||
|
||||
<Note>
|
||||
AWS Certificate Manager Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.
|
||||
</Note>
|
||||
|
||||
## Manual Certificate Sync
|
||||
|
||||
You can manually trigger certificate synchronization from your PKI subscriber to AWS Certificate Manager using the sync certificates functionality. This is useful for:
|
||||
|
||||
- Initial setup when you have existing certificates to deploy
|
||||
- One-time sync of specific certificates
|
||||
- Testing certificate sync configurations
|
||||
- Force sync after making changes
|
||||
|
||||
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/aws-certificate-manager/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
|
||||
|
||||
<Note>
|
||||
AWS Certificate Manager does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from AWS Certificate Manager. Only certificates imported into ACM (not AWS-issued certificates) can be managed by the sync.
|
||||
</Note>
|
||||
@@ -24,3 +24,4 @@ SCIM providers:
|
||||
- [Okta SCIM](/documentation/platform/scim/okta)
|
||||
- [Azure SCIM](/documentation/platform/scim/azure)
|
||||
- [JumpCloud SCIM](/documentation/platform/scim/jumpcloud)
|
||||
- [PingOne SCIM](/documentation/platform/scim/pingone)
|
||||
|
||||
149
docs/documentation/platform/scim/pingone.mdx
Normal file
149
docs/documentation/platform/scim/pingone.mdx
Normal file
@@ -0,0 +1,149 @@
|
||||
---
|
||||
title: "PingOne SCIM"
|
||||
description: "Learn how to configure SCIM provisioning with PingOne for Infisical."
|
||||
---
|
||||
|
||||
<Info>
|
||||
PingOne SCIM provisioning is a paid feature.
|
||||
|
||||
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
||||
then you should contact sales@infisical.com to purchase a self-hosted license to use it.
|
||||
</Info>
|
||||
|
||||
Prerequisites:
|
||||
- [Configure PingOne OIDC for Infisical](/documentation/platform/sso/pingone-oidc)
|
||||
|
||||
<Steps>
|
||||
<Step title="Create a SCIM token in Infisical">
|
||||
In Infisical, head to the **Single Sign-On (SSO)** page and select the **Provisioning** tab. Under SCIM Configuration,
|
||||
press the **Enable SCIM provisioning** toggle to allow PingOne to provision/deprovision users for your organization.
|
||||
|
||||
|
||||
|
||||
Next, press **Manage SCIM Tokens** and then **Create** to generate a SCIM token for PingOne.
|
||||
|
||||
|
||||
|
||||
Next, copy the **SCIM URL** and **New SCIM Token** to use when configuring SCIM in PingOne.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add Users and Groups in PingOne">
|
||||
Inside your PingOne environment, navigate to Directory > Users. Add any users and/or groups to your application that you would like
|
||||
to be provisioned over to Infisical.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Configure SCIM Connection in PingOne">
|
||||
|
||||
**1. Create a new connection**
|
||||
|
||||
In PingOne, head to Integrations > Provisioning, and inside provisioning, press the **Connections** tab. Here you'll see a plus icon to add a new connection.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Select the "Identity Store" option.
|
||||
|
||||
|
||||
|
||||
|
||||
Search for the "SCIM Outbound" option to start the configuration process for SCIM. Finally, press the **Next** button. Give the connection a name and optionally add a description.
|
||||
|
||||
**2. Configure the connection**
|
||||
|
||||
Once you have selected the SCIM Outbound option, you'll be prompted to enter the authentication details that PingOne will use to authenticate with Infisical SCIM. This is the **SCIM URL** and **New SCIM Token** from the previous step.
|
||||
|
||||
|
||||
|
||||
Set the following fields:
|
||||
- `SCIM BASE URL`: Input the **SCIM URL** from the previous step.
|
||||
- `Users Resource`: Leave as default, `/Users`.
|
||||
- `Groups Resource`: Leave as default, `/Groups`.
|
||||
- `SCIM Version`: Leave as default, `2.0`.
|
||||
- `Authentication Method`: Select `OAuth 2 Bearer Token`.
|
||||
- `Oauth Access Token`: Input the **New SCIM Token** from step 1.
|
||||
- `Auth Type Header`: Select `Bearer`.
|
||||
|
||||
Once this is done, you can press the **Test Connection** button to check that SCIM is configured properly. You should see a success message saying "Connection Successful".
|
||||
If the connection is successful, press the "Next" button.
|
||||
|
||||
In the final step, you'll be prompted to configure the mappings for the connection.
|
||||
|
||||
Set the following fields:
|
||||
- `User Filter Expression`: `email.value Eq "%s"`.
|
||||
- `User Identifier`: `workEmail`.
|
||||
- `Deprovision on Rule Deletion:` Enabled.
|
||||
|
||||
|
||||
|
||||
Once this is configured, press the "Save" button.
|
||||
|
||||
**3. Enable the connection**
|
||||
|
||||
Finally, remember to enable the connection by pressing the enable toggle.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Configure SCIM Provisioning in PingOne">
|
||||
|
||||
**1. Create a new rule**
|
||||
|
||||
After creating a connection, you can now access the "Rules" tab under the Provisioning section. Here you can configure the rules for the connection.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Select the "New Rule" button and choose a name for the rule, then press the "Create Rule" button.
|
||||
|
||||
**2. Configure the rule connection**
|
||||
|
||||
Once you have created a rule, you now need to configure the connection to use for the rule.
|
||||
|
||||
|
||||
|
||||
Select the connection you created in the previous step and press the "Save" button.
|
||||
|
||||
**3. Configure the rule user filter**
|
||||
|
||||
|
||||
|
||||
Select the Edit pencil icon to open the user filter configuration. This step dictates which users will be provisioned to Infisical.
|
||||
|
||||
|
||||
|
||||
In this case, we are provisioning all users that are enabled in PingOne. Configure your user filter to match your desired users, and then press the "Save" button.
|
||||
|
||||
**4. Configure Groups**
|
||||
|
||||
This step is optional and only relevant if you want to provision PingOne groups to Infisical.
|
||||
|
||||
|
||||
|
||||
Open the "Group Provisioning" tab and press the "Add Groups" button to select which groups will be provisioned to Infisical.
|
||||
|
||||
|
||||
|
||||
Select the groups you want to provision to Infisical and press the "Save" button.
|
||||
|
||||
**5. Enable the rule**
|
||||
|
||||
Once you have configured the rule, you can enable it by pressing the "Enable" toggle.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
**FAQ**
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Why do SCIM-provisioned users have to finish setting up their account?">
|
||||
Infisical's SCIM implementation accounts for retaining the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps in the platform.
|
||||
|
||||
For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
@@ -6,7 +6,7 @@ description: "Learn how to configure Auth0 OIDC for Infisical SSO."
|
||||
<Info>
|
||||
Auth0 OIDC SSO is a paid feature. If you're using Infisical Cloud, then it is
|
||||
available under the **Pro Tier**. If you're self-hosting Infisical, then you
|
||||
should contact sales@infisical.com to purchase an enterprise license to use
|
||||
should contact sales@infisical.com to purchase a self-hosted license to use
|
||||
it.
|
||||
</Info>
|
||||
|
||||
@@ -55,7 +55,7 @@ description: "Learn how to configure Auth0 OIDC for Infisical SSO."
|
||||
<Step title="Enable OIDC in Infisical">
|
||||
Enabling OIDC allows members in your organization to log into Infisical via Auth0.
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Enforce OIDC SSO in Infisical">
|
||||
|
||||
@@ -7,7 +7,7 @@ description: "Learn how to configure OIDC for Infisical SSO with any OIDC-compli
|
||||
<Info>
|
||||
OIDC SSO is a paid feature. If you're using Infisical Cloud, then it is
|
||||
available under the **Pro Tier**. If you're self-hosting Infisical, then you
|
||||
should contact sales@infisical.com to purchase an enterprise license to use
|
||||
should contact sales@infisical.com to purchase a self-hosted license to use
|
||||
it.
|
||||
</Info>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@ description: "Learn how to configure Keycloak OIDC for Infisical SSO."
|
||||
<Info>
|
||||
Keycloak OIDC SSO is a paid feature. If you're using Infisical Cloud, then it
|
||||
is available under the **Pro Tier**. If you're self-hosting Infisical, then
|
||||
you should contact sales@infisical.com to purchase an enterprise license to
|
||||
you should contact sales@infisical.com to purchase a self-hosted license to
|
||||
use it.
|
||||
</Info>
|
||||
|
||||
@@ -82,7 +82,7 @@ description: "Learn how to configure Keycloak OIDC for Infisical SSO."
|
||||
<Step title="Enable OIDC SSO in Infisical">
|
||||
Enabling OIDC SSO allows members in your organization to log into Infisical via Keycloak.
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Enforce OIDC SSO in Infisical">
|
||||
|
||||
108
docs/documentation/platform/sso/pingone-oidc.mdx
Normal file
108
docs/documentation/platform/sso/pingone-oidc.mdx
Normal file
@@ -0,0 +1,108 @@
|
||||
---
|
||||
title: "PingOne OIDC"
|
||||
description: "Learn how to configure PingOne OIDC for Infisical SSO."
|
||||
---
|
||||
|
||||
<Info>
|
||||
PingOne OIDC SSO is a paid feature. If you're using Infisical Cloud, then it is
|
||||
available under the **Pro Tier**. If you're self-hosting Infisical, then you
|
||||
should contact sales@infisical.com to purchase a self-hosted license to use
|
||||
it.
|
||||
</Info>
|
||||
|
||||
<Steps>
|
||||
<Step title="Setup application in PingOne">
|
||||
1.1. From the Application's Page, create a new OIDC Web App application.
|
||||
|
||||
|
||||
1.2. Enable the application by pressing the "Enable" toggle.
|
||||
|
||||
|
||||
|
||||
1.3. In the Application "Configuration" tab, press the "Edit" pencil icon to configure the application callback URI.
|
||||
|
||||
|
||||
|
||||
1.4 Set the Redirect URL to `https://app.infisical.com/api/v1/sso/oidc/callback` and press the "Save" button.
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
If you're self-hosting Infisical, then you will want to replace https://app.infisical.com with your own domain.
|
||||
</Info>
|
||||
|
||||
|
||||
1.5 After configuring the redirect URL, go to the "Attribute Mappings" tab and press the "Edit" pencil icon to configure the attribute mappings.
|
||||
|
||||
|
||||
1.6 Map the following attributes:
|
||||
- `email` -> `Email Address`
|
||||
- `name` -> `Username`
|
||||
|
||||
|
||||
Once done, press the "Save" button.
|
||||
|
||||
</Step>
|
||||
<Step title="Retrieve Identity Provider (IdP) Information from PingOne">
|
||||
2.1. Open the "Overview" tab and copy the **Client ID** and **Client Secret**.
|
||||
|
||||
|
||||
2.2. Still in the "Overview" tab, scroll down to the Connection Details section and retrieve the **OIDC Discovery Endpoint**.
|
||||
|
||||
|
||||
Keep these values handy as we will need them in the next steps.
|
||||
|
||||
</Step>
|
||||
<Step title="Finish configuring OIDC in Infisical">
|
||||
3.1. Back in Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Click **Connect** for **OIDC**.
|
||||
|
||||
|
||||
3.2. For configuration type, select **Discovery URL**. Then, set **Discovery Document URL**, **Client ID**, and **Client Secret** from step 2.1 and 2.2.
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
Currently, the following JWT signature algorithms are supported: RS256, RS512, HS256, and EdDSA
|
||||
</Info>
|
||||
|
||||
Once you've done that, press **Update** to complete the required configuration.
|
||||
|
||||
</Step>
|
||||
<Step title="Enable OIDC in Infisical">
|
||||
Enabling OIDC allows members in your organization to log into Infisical via PingOne
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Enforce OIDC SSO in Infisical">
|
||||
Enforcing OIDC SSO ensures that members in your organization can only access Infisical
|
||||
by logging into the organization via PingOne.
|
||||
|
||||
To enforce OIDC SSO, you're required to test out the OpenID connection by successfully authenticating at least one PingOne user with Infisical.
|
||||
Once you've completed this requirement, you can toggle the **Enforce OIDC SSO** button to enforce OIDC SSO.
|
||||
|
||||
<Warning>
|
||||
We recommend ensuring that your account is provisioned using the application in PingOne
|
||||
prior to enforcing OIDC SSO to prevent any unintended issues.
|
||||
</Warning>
|
||||
<Info>
|
||||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
<Tip>
|
||||
If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite OIDC login.
|
||||
</Tip>
|
||||
|
||||
<Note>
|
||||
If you're configuring OIDC SSO on a self-hosted instance of Infisical, make
|
||||
sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
|
||||
work:
|
||||
<div class="height:1px;"/>
|
||||
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
|
||||
can be a random 32-byte base64 string generated with `openssl rand -base64
|
||||
32`.
|
||||
<div class="height:1px;"/>
|
||||
- `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. https://app.infisical.com)
|
||||
</Note>
|
||||
Reference in New Issue
Block a user