awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revise SAML flow, update Okta SAML docs

Browse Source
This commit is contained in:
Tuan Dang
2023-07-29 01:57:07 +07:00
parent ed2cf68935
commit cc4b749ce8
22 changed files with 131 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/documentation/platform/sso/azure.mdx
View File

@@ -3,7 +3,10 @@ title: "Azure SAML"
description: "Configure Azure SAML for Infisical SSO"
---
1. In the Azure Portal, navigate to the Azure Active Directory and select Enterprise applications. On this screen, select
1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
Next, copy the **ACS URL** and **Entity ID** to use when configuring the Okta SAML 2.0 application.
2. In the Azure Portal, navigate to the Azure Active Directory and select Enterprise applications. On this screen, select
the **+ New application** button.
TODO: insert image.

63
docs/documentation/platform/sso/okta.mdx
View File

@@ -1,72 +1,77 @@
---
title: "Okta SAML"
description: "Configure Okta SAML for Infisical SSO"
description: "Configure Okta SAML 2.0 for Infisical SSO"
---
1. In the Okta Admin Portal, select Applications > Applications from the
navigation. On the Applications screen, select the Create App Integration
Prerequisites:
- Okta Developer Account with access to create custom application integrations.
1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**.
Next, copy the **ACS URL** and **Entity ID** to use when configuring the Okta SAML 2.0 application.
![SAML Okta Infisical initial configuration](../../../images/sso-okta-0.png)
2. In the Okta Admin Portal, select Applications > Applications from the
navigation. On the Applications screen, select the **Create App Integration**
button.
![SAML Okta create app integration](../../../images/sso-okta-1.png)
2. In the Create a New Application Integration dialog, select the SAML 2.0 radio button:
3. In the Create a New Application Integration dialog, select the **SAML 2.0** radio button:
![SAML Okta create SAML 2.0 integration](../../../images/sso-okta-2.png)
3. On the General Settings screen, give the application a unique, Infisical-specific name and select Next.
4. On the General Settings screen, give the application a unique name like Infisical and select **Next**.
4. On the Configure SAML screen, configure the following fields:
![SAML Okta create SAML 2.0 integration](../../../images/sso-okta-3.png)
- Single sign on URL: `https://app.infisical.com/api/v1/sso/saml2/:identifier`; we'll update the `:identifier` part later in step 6.
- Audience URI (SP Entity ID): `https://app.infisical.com`
5. On the Configure SAML screen, set the **Single sign-on URL** to **ACS URL** and **Audience URI (SP Entity ID)** to
**Entity ID** from step 1.
![SAML Okta configure IdP fields](../../../images/sso-okta-3.png)
![SAML Okta configure IdP fields](../../../images/sso-okta-4.png)
<Note>
If you're self-hosting Infisical, then you will want to replace
`https://app.infisical.com` with your own domain.
</Note>
4. Also on the Configure SAML screen, configure the Attribute Statements to map:
6. Also on the Configure SAML screen, configure the **Attribute Statements** to map:
- `id -> user.id`,
- `email -> user.email`,
- `firstName -> user.firstName`
- `lastName -> user.lastName`
![SAML Okta attribute statements](../../../images/sso-okta-4.png)
![SAML Okta attribute statements](../../../images/sso-okta-5.png)
Once configured, select the Next button to proceed to the Feedback screen and select Finish.
Once configured, select the **Next** button to proceed to the Feedback screen and select **Finish**.
5. Get IdP values
7. Get IdP values
Once your application is created, select the Sign On tab for the app and select the View Setup Instructions button located on the right side of the screen:
Once your application is created, select the **Sign On** tab for the app and select the **View Setup Instructions** button located on the right side of the screen:
Copy the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate to be pasted into your Infisical SAML SSO configuration details with the following map:
![SAML Okta view setup instructions](../../../images/sso-okta-6.png)
- `Audience -> Audience URI (SP Entity ID) from Okta`
- `Entrypoint -> Identity Provider Single Sign-On URL from Okta`
- `Issuer -> Identity Provider Issuer from Okta`
- `Certificate -> X.509 Certificate from Okta`
Copy the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate** to use when finishing configuring the Okta SAML in Infisical.
![SAML Okta IdP values](../../../images/saml-okta-5.png)
![SAML Okta IdP values](../../../images/sso-okta-7.png)
![SAML Okta paste values into Infisical](../../../images/sso-okta-6.png)
Back in Infisical, set **Entrypoint** to **Identity Provider Single Sign-On URL**, **Issuer** to **Identity Provider Issuer**,
and **Certificate** to **X.509 Certificate** from above. Once you've done that, press **Add** to complete the required configuration.
6. Create the SSO configuration and copy your SSO identifier in Infisical; update `:identifier` from step 4 earlier to be this value.
![SAML Okta paste values into Infisical](../../../images/sso-okta-8.png)
![SAML Okta assignments](../../../images/sso-okta-7.png)
7. Assignments
Finally, navigate to the Assignments tab and select the Assign button:
8. Finally, navigate to the **Assignments** tab and select **Assign**
You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.
![SAML Okta assignment](../../../images/sso-okta-8.png)
![SAML Okta assignment](../../../images/sso-okta-9.png)
At this point, you have configured everything you need within the context of the Okta Admin Portal.
8. Return to Infisical and enable SAML SSO.
9. Return to Infisical and enable SAML SSO.
Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.
![SAML Okta assignment](../../../images/sso-okta-10.png)

9
docs/documentation/platform/sso/overview.mdx
View File

@@ -13,11 +13,4 @@ description: "Log in to Infisical via SSO protocols"
You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0).
To note, configuring SSO retains the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps. In all login with SSO implementations,
your IdP cannot and will not have access to the decryption key needed to decrypt your secrets.
## Configuration
Head over to your organization Settings > Authentication > SAML SSO Configuration.
Next, press "Set up SAML SSO" in the SAML SSO and follow the instructions
below to configure SSO for your identity provider.
your IdP cannot and will not have access to the decryption key needed to decrypt your secrets.