Merge pull request #1989 from Infisical/feature/oidc

feat: oidc

docs/documentation/getting-started/platform.mdx

@@ -12,14 +12,14 @@ From there, you can invite external members to the organization and start creati
 ### Projects
 
 The **Projects** page shows you all the projects that you have access to within your organization.
-Here, you can also create a new project. 
+Here, you can also create a new project.
 
 ![organization overview](../../images/organization-overview.png)
 
 ### Members
 
-The **Members** page lets you add or remove external members to your organization. 
-Note that you can configure your organization in Infisical to have members authenticate with the platform via protocols like SAML 2.0.
+The **Members** page lets you add or remove external members to your organization.
+Note that you can configure your organization in Infisical to have members authenticate with the platform via protocols like SAML 2.0 and OpenID Connect.
 
 ![organization members](../../images/organization/platform/organization-members.png)
 
@@ -35,13 +35,14 @@ The **Secrets Overview** screen provides a bird's-eye view of all the secrets in
 ![dashboard secrets overview](../../images/dashboard-secrets-overview.png)
 
 In the above image, you can already see that:
+
 - `STRIPE_API_KEY` is missing from the **Staging** environment.
 - `JWT_SECRET` is missing from the **Production** environment.
 - `BAR` is `EMPTY` in the **Production** environment.
 
 ### Dashboard
 
-The secrets dashboard lets you manage secrets for a specific environment in a project. 
+The secrets dashboard lets you manage secrets for a specific environment in a project.
 Here, developers can override secrets, version secrets, rollback projects to any point in time and much more.
 
 ![dashboard](../../images/dashboard.png)
@@ -61,4 +62,4 @@ which you can assign to members.
 
 That's it for the platform quickstart! — We encourage you to continue exploring the documentation to gain a deeper understanding of the extensive features and functionalities that Infisical has to offer.
 
-Next, head back to [Getting Started > Introduction](/documentation/getting-started/overview) to explore ways to fetch secrets from Infisical to your apps and infrastructure.
+Next, head back to [Getting Started > Introduction](/documentation/getting-started/overview) to explore ways to fetch secrets from Infisical to your apps and infrastructure.

docs/documentation/platform/organization.mdx

@@ -21,20 +21,19 @@ The **Settings** page lets you manage information about your organization includ
 
 ![organization settings general](../../images/platform/organization/organization-settings-general.png)
 
-
-- Security and Authentication: A set of setting to enforce or manage [SAML](/documentation/platform/sso/overview), [SCIM](/documentation/platform/scim/overview), [LDAP](/documentation/platform/ldap/overview), and other authentication configurations.
+- Security and Authentication: A set of setting to enforce or manage [SAML](/documentation/platform/sso/overview), [OIDC](/documentation/platform/sso/overview), [SCIM](/documentation/platform/scim/overview), [LDAP](/documentation/platform/ldap/overview), and other authentication configurations.
 
 ![organization settings auth](../../images/platform/organization/organization-settings-auth.png)
 
 ## Access Control
 
-The **Access Control** page is where you can manage identities (both people and machines) that are part of your organization. 
+The **Access Control** page is where you can manage identities (both people and machines) that are part of your organization.
 You can add or remove additional members as well as modify their permissions.
 
 ![organization members](../../images/platform/organization/organization-members.png)
 ![organization identities](../../images/platform/organization/organization-machine-identities.png)
 
-In the **Organization Roles** tab, you can edit current or create new custom roles for members within the organization. 
+In the **Organization Roles** tab, you can edit current or create new custom roles for members within the organization.
 
 <Info>
   Note that Role-Based Access Management (RBAC) is partly a paid feature.
@@ -42,13 +41,14 @@ In the **Organization Roles** tab, you can edit current or create new custom rol
   Infisical provides immutable roles like `admin`, `member`, etc.
   at the organization and project level for free.
 
-  If you're using Infisical Cloud, the ability to create custom roles is available under the **Pro Tier**. 
-  If you're self-hosting Infisical, then you should contact sales@infisical.com to purchase an enterprise license to use it.
+If you're using Infisical Cloud, the ability to create custom roles is available under the **Pro Tier**.
+If you're self-hosting Infisical, then you should contact sales@infisical.com to purchase an enterprise license to use it.
+
 </Info>
 
 ![organization roles](../../images/platform/organization/organization-members-roles.png)
 
-As you can see next, Infisical supports granular permissions that you can tailor to each role. 
+As you can see next, Infisical supports granular permissions that you can tailor to each role.
 If you need certain members to only be able to access billing details, for example, then you can
 assign them that permission only.
 
@@ -66,4 +66,4 @@ This includes the following items:
 - Receipts: The receipts of monthly/annual invoices.
 - Billing: The billing details of your organization including payment methods on file, tax IDs (if applicable), etc.
 
-![organization usage and billing](../../images/platform/organization/organization-usage-billing.png)
+![organization usage and billing](../../images/platform/organization/organization-usage-billing.png)

docs/documentation/platform/sso/auth0-oidc.mdx

@@ -0,0 +1,66 @@
+---
+title: "Auth0 OIDC"
+description: "Learn how to configure Auth0 OIDC for Infisical SSO."
+---
+
+<Info>
+  Auth0 OIDC SSO is a paid feature. If you're using Infisical Cloud, then it is
+  available under the **Pro Tier**. If you're self-hosting Infisical, then you
+  should contact sales@infisical.com to purchase an enterprise license to use
+  it.
+</Info>
+
+<Steps>
+   <Step title="Setup application in Auth0">
+      1.1. From the Application's Page, navigate to the settings tab of the Auth0 application you want to integrate with Infisical.
+      ![OIDC auth0 list of applications](../../../images/sso/auth0-oidc/application-settings.png)
+      
+      1.2. In the Application URIs section, set the **Application Login URI** and **Allowed Web Origins** fields to `https://app.infisical.com` and the **Allowed Callback URL** field to `https://app.infisical.com/api/v1/sso/oidc/callback`.
+      ![OIDC auth0 create application uris](../../../images/sso/auth0-oidc/application-uris.png)
+      ![OIDC auth0 create application origin](../../../images/sso/auth0-oidc/application-origin.png)
+      <Info>
+         If you’re self-hosting Infisical, then you will want to replace https://app.infisical.com with your own domain.
+      </Info>
+
+      Once done, click **Save Changes**.
+
+      1.3. Proceed to the Connections Tab and enable desired connections.
+      ![OIDC auth0 application connections](../../../images/sso/auth0-oidc/application-connections.png)
+
+   </Step>
+   <Step title="Retrieve Identity Provider (IdP) Information from Auth0">
+      2.1. From the application settings page, retrieve the **Client ID** and **Client Secret**
+      ![OIDC auth0 application credential](../../../images/sso/auth0-oidc/application-credential.png)
+
+      2.2. In the advanced settings (bottom-most section), retrieve the **OpenID Configuration URL** from the Endpoints tab.
+      ![OIDC auth0 application oidc url](../../../images/sso/auth0-oidc/application-urls.png)
+
+      Keep these values handy as we will need them in the next steps.
+
+   </Step>
+   <Step title="Finish configuring OIDC in Infisical">
+      3.1. Back in Infisical, in the Organization settings > Security > OIDC, click **Manage**.
+      ![OIDC auth0 manage org Infisical](../../../images/sso/auth0-oidc/org-oidc-overview.png)
+
+      3.2. For configuration type, select **Discovery URL**. Then, set **Discovery Document URL**, **Client ID**, and **Client Secret** from step 2.1 and 2.2.
+      ![OIDC auth0 paste values into Infisical](../../../images/sso/auth0-oidc/org-update-oidc.png)
+
+      Once you've done that, press **Update** to complete the required configuration.
+
+   </Step>
+   <Step title="Enable OIDC in Infisical">
+      Enabling OIDC allows members in your organization to log into Infisical via Auth0.
+
+      ![OIDC auth0 enable OIDC](../../../images/sso/auth0-oidc/enable-oidc.png)
+
+   </Step>
+</Steps>
+
+<Note>
+  If you're configuring OIDC SSO on a self-hosted instance of Infisical, make
+  sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
+  work: - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
+  can be a random 32-byte base64 string generated with `openssl rand -base64
+  32`. - `SITE_URL`: The URL of your self-hosted instance of Infisical - should
+  be an absolute URL including the protocol (e.g. https://app.infisical.com)
+</Note>

docs/documentation/platform/sso/general-oidc.mdx

@@ -0,0 +1,69 @@
+---
+title: "General OIDC"
+description: "Learn how to configure OIDC for Infisical SSO with any OIDC-compliant identity provider"
+---
+
+<Info>
+  OIDC SSO is a paid feature. If you're using Infisical Cloud, then it is
+  available under the **Pro Tier**. If you're self-hosting Infisical, then you
+  should contact sales@infisical.com to purchase an enterprise license to use
+  it.
+</Info>
+
+You can configure your organization in Infisical to have members authenticate with the platform through identity providers via [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html).
+
+Prerequisites:
+
+- The identity provider (Okta, Google, Azure AD, etc.) should support OIDC.
+- Users in the IdP should have a configured `email` and `given_name`.
+
+<Steps>
+   <Step title="Setup Identity Provider">
+      1.1. Register your application with the IdP to obtain a **Client ID** and **Client Secret**. These credentials are used by Infisical to authenticate with your IdP.
+      
+      1.2. Configure **Redirect URL** to be `https://app.infisical.com/api/v1/sso/oidc/callback`. If you're self-hosting Infisical, replace the domain with your own.
+      
+      1.3. Configure the scopes needed by Infisical (email, profile, openid) and ensure that they are mapped to the ID token claims.
+      
+      1.4. Access the IdP’s OIDC discovery document (usually located at `https://<idp-domain>/.well-known/openid-configuration`). This document contains important endpoints such as authorization, token, userinfo, and keys.
+   </Step>
+   <Step title="Finish configuring OIDC in Infisical">
+      2.1. Back in Infisical, in the Organization settings > Security > OIDC, click Manage
+      ![OIDC general manage org Infisical](../../../images/sso/general-oidc/org-oidc-manage.png)
+
+      2.2. You can configure OIDC either through the Discovery URL (Recommended) or by inputting custom endpoints.
+
+      To configure OIDC via Discovery URL, set the **Configuration Type** field to **Discovery URL** and fill out the **Discovery Document URL** field.
+
+      <Note>
+      Note that the Discovery Document URL typically takes the form: `https://<idp-domain>/.well-known/openid-configuration`.
+      </Note>
+
+      ![OIDC general discovery config](../../../images/sso/general-oidc/discovery-oidc-form.png)
+
+      To configure OIDC via the custom endpoints, set the **Configuration Type** field to **Custom** and input the required endpoint fields.
+      ![OIDC general custom config](../../../images/sso/general-oidc/custom-oidc-form.png)
+
+      2.3. Optionally, you can define a whitelist of allowed email domains.
+
+      Finally, fill out the **Client ID** and **Client Secret** fields and press **Update** to complete the required configuration.
+
+       </Step>
+
+     <Step title="Enable OIDC SSO in Infisical">
+      Enabling OIDC SSO allows members in your organization to log into Infisical via the configured Identity Provider
+
+          ![OIDC general enable OIDC](../../../images/sso/general-oidc/org-oidc-enable.png)
+
+       </Step>
+
+  </Steps>
+
+<Note>
+  If you're configuring OIDC SSO on a self-hosted instance of Infisical, make
+  sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
+  work: - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
+  can be a random 32-byte base64 string generated with `openssl rand -base64
+  32`. - `SITE_URL`: The URL of your self-hosted instance of Infisical - should
+  be an absolute URL including the protocol (e.g. https://app.infisical.com)
+</Note>

docs/documentation/platform/sso/keycloak-oidc.mdx

@@ -0,0 +1,92 @@
+---
+title: "Keycloak OIDC"
+description: "Learn how to configure Keycloak OIDC for Infisical SSO."
+---
+
+<Info>
+  Keycloak OIDC SSO is a paid feature. If you're using Infisical Cloud, then it
+  is available under the **Pro Tier**. If you're self-hosting Infisical, then
+  you should contact sales@infisical.com to purchase an enterprise license to
+  use it.
+</Info>
+
+<Steps>
+   <Step title="Create an OIDC client application in Keycloak">
+      1.1. In your realm, navigate to the **Clients** tab and click **Create client** to create a new client application.
+      
+      ![OIDC keycloak list of clients](../../../images/sso/keycloak-oidc/clients-list.png)
+      
+      <Info>
+         You don’t typically need to make a realm dedicated to Infisical. We recommend adding Infisical as a client to your primary realm.
+      </Info>
+      
+      1.2. In the General Settings step, set **Client type** to **OpenID Connect**, the **Client ID** field to an appropriate identifier, and the **Name** field to a friendly name like **Infisical**.
+      
+      ![OIDC keycloak create client general settings](../../../images/sso/keycloak-oidc/create-client-general-settings.png)
+      
+      1.3. Next, in the Capability Config step, ensure that **Client Authentication** is set to On and that **Standard flow** is enabled in the Authentication flow section.
+      
+      ![OIDC keycloak create client capability config settings](../../../images/sso/keycloak-oidc/create-client-capability.png)
+      
+      1.4. In the Login Settings step, set the following values:
+      - Root URL: `https://app.infisical.com`.
+      - Home URL: `https://app.infisical.com`.
+      - Valid Redirect URIs: `https://app.infisical.com/api/v1/sso/oidc/callback`.
+      - Web origins: `https://app.infisical.com`.
+
+      ![OIDC keycloak create client login settings](../../../images/sso/keycloak-oidc/create-client-login-settings.png)
+      <Info>
+         If you’re self-hosting Infisical, then you will want to replace https://app.infisical.com (base URL) with your own domain.
+      </Info>
+
+      1.5. Next, navigate to the **Client scopes** tab and select the client's dedicated scope.
+
+      ![OIDC keycloak client scopes list](../../../images/sso/keycloak-oidc/client-scope-list.png)
+
+      1.6. Next, click **Add predefined mapper**.
+
+      ![OIDC keycloak client mappers empty](../../../images/sso/keycloak-oidc/client-scope-mapper-menu.png)
+
+      1.7. Select the **email**, **given name**, **family name** attributes and click **Add**.
+
+      ![OIDC keycloak client mappers predefined 1](../../../images/sso/keycloak-oidc/scope-predefined-mapper-1.png)
+      ![OIDC keycloak client mappers predefined 2](../../../images/sso/keycloak-oidc/scope-predefined-mapper-2.png)
+
+      Once you've completed the above steps, the list of mappers should look like the following:
+      ![OIDC keycloak client mappers completed](../../../images/sso/keycloak-oidc/client-scope-complete-overview.png)
+
+   </Step>
+   <Step title="Retrieve Identity Provider (IdP) Information from Keycloak">
+      2.1. Back in Keycloak, navigate to Configure > Realm settings > General tab > Endpoints > OpenID Endpoint Configuration and copy the opened URL. This is what is to referred to as the Discovery Document URL and it takes the form: `https://keycloak-mysite.com/realms/myrealm/.well-known/openid-configuration`.
+      ![OIDC keycloak realm OIDC metadata](../../../images/sso/keycloak-oidc/realm-setting-oidc-config.png)
+
+      2.2. From the Clients page, navigate to the Credential tab and copy the **Client Secret** to be used in the next steps.
+      ![OIDC keycloak realm OIDC secret](../../../images/sso/keycloak-oidc/client-secret.png)
+
+   </Step>
+   <Step title="Finish configuring OIDC in Infisical">
+      3.1. Back in Infisical, in the Organization settings > Security > OIDC, click Manage
+      ![OIDC keycloak manage org Infisical](../../../images/sso/keycloak-oidc/manage-org-oidc.png)
+
+      3.2. For configuration type, select Discovery URL. Then, set the appropriate values for **Discovery Document URL**, **Client ID**, and **Client Secret**.
+      ![OIDC keycloak paste values into Infisical](../../../images/sso/keycloak-oidc/create-oidc.png)
+
+      Once you've done that, press **Update** to complete the required configuration.
+
+   </Step>
+   <Step title="Enable OIDC SSO in Infisical">
+      Enabling OIDC SSO allows members in your organization to log into Infisical via Keycloak.
+
+      ![OIDC keycloak enable OIDC](../../../images/sso/keycloak-oidc/enable-oidc.png)
+
+   </Step>
+</Steps>
+
+<Note>
+  If you're configuring OIDC SSO on a self-hosted instance of Infisical, make
+  sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
+  work: - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
+  can be a random 32-byte base64 string generated with `openssl rand -base64
+  32`. - `SITE_URL`: The URL of your self-hosted instance of Infisical - should
+  be an absolute URL including the protocol (e.g. https://app.infisical.com)
+</Note>

docs/documentation/platform/sso/overview.mdx

@@ -7,13 +7,14 @@ description: "Learn how to log in to Infisical via SSO protocols."
 <Info>
   Infisical offers Google SSO and GitHub SSO for free across both Infisical
   Cloud and Infisical Self-hosted. Infisical also offers SAML SSO authentication
-  but as paid features that can be unlocked on Infisical Cloud's **Pro** tier or
-  via enterprise license on self-hosted instances of Infisical. On this front,
-  we support industry-leading providers including Okta, Azure AD, and JumpCloud;
-  with any questions, please reach out to team@infisical.com.
+  and OpenID Connect (OIDC) but as paid features that can be unlocked on
+  Infisical Cloud's **Pro** tier or via enterprise license on self-hosted
+  instances of Infisical. On this front, we support industry-leading providers
+  including Okta, Azure AD, and JumpCloud; with any questions, please reach out
+  to team@infisical.com.
 </Info>
 
-You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0).
+You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0) or [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html).
 
 ## Identity providers
 
@@ -27,6 +28,9 @@ Infisical supports these and many other identity providers:
 - [JumpCloud SAML](/documentation/platform/sso/jumpcloud)
 - [Keycloak SAML](/documentation/platform/sso/keycloak-saml)
 - [Google SAML](/documentation/platform/sso/google-saml)
+- [Keycloak OIDC](/documentation/platform/sso/keycloak-oidc)
+- [Auth0 OIDC](/documentation/platform/sso/auth0-oidc)
+- [General OIDC](/documentation/platform/sso/general-oidc)
 
 If your required identity provider is not shown in the list above, please reach out to [team@infisical.com](mailto:team@infisical.com) for assistance.
 

docs/internals/security.mdx

@@ -79,10 +79,9 @@ Infisical uses AES-256-GCM for symmetric encryption and x25519-xsalsa20-poly1305
 By default, Infisical employs a zero-knowledge-first approach to securely storing and sharing secrets.
 
 - Each secret belongs to a project and is symmetrically encrypted by that project's unique key. Each member of a project is shared a copy of the project key, encrypted under their public key, when they are first invited to join the project.
-Since these encryption operations occur on the client-side, the Infisical API is not able to view the value of any secret and the default zero-knowledge property of Infisical is retained; as you'd expect, it follows that decryption operations also occur on the client-side.
+  Since these encryption operations occur on the client-side, the Infisical API is not able to view the value of any secret and the default zero-knowledge property of Infisical is retained; as you'd expect, it follows that decryption operations also occur on the client-side.
 - An exception to the zero-knowledge property occurs when a member of a project explicitly shares that project's unique key with Infisical. It is often necessary to share the project key with Infisical in order to use features like native integrations and secret rotation that wouldn't be possible to offer otherwise.
 
-
 ## Infrastructure
 
 ### High availability
@@ -90,19 +89,22 @@ Since these encryption operations occur on the client-side, the Infisical API is
 Infisical Cloud utilizes several strategies to ensure high availability, leveraging AWS services to maintain continuous operation and data integrity.
 
 #### Multi-AZ AWS RDS
-Infisical Cloud uses AWS Relational Database Service (RDS) with Multi-AZ deployments. 
-This configuration ensures that the database service is highly available and durable. 
-AWS RDS automatically provisions and maintains a synchronous standby replica of the database in a different Availability Zone (AZ). 
-This setup facilitates immediate failover to the standby in the event of an AZ failure, thereby ensuring that database operations can continue with minimal interruption. 
+
+Infisical Cloud uses AWS Relational Database Service (RDS) with Multi-AZ deployments.
+This configuration ensures that the database service is highly available and durable.
+AWS RDS automatically provisions and maintains a synchronous standby replica of the database in a different Availability Zone (AZ).
+This setup facilitates immediate failover to the standby in the event of an AZ failure, thereby ensuring that database operations can continue with minimal interruption.
 The continuous backup and replication to the standby instance safeguard data against loss and ensure its availability even during system failures.
 
 #### Multi-AZ ECS for Container Orchestration
-Infisical Cloud leverages Amazon Elastic Container Service (ECS) in a Multi-AZ configuration for container orchestration. 
-This arrangement enables the management and operation of containers across multiple availability zones, increasing the application's fault tolerance. 
-Should there be an AZ failure, load is seamlessly sent to an operational AZ, thus minimizing downtime and preserving service availability. 
+
+Infisical Cloud leverages Amazon Elastic Container Service (ECS) in a Multi-AZ configuration for container orchestration.
+This arrangement enables the management and operation of containers across multiple availability zones, increasing the application's fault tolerance.
+Should there be an AZ failure, load is seamlessly sent to an operational AZ, thus minimizing downtime and preserving service availability.
 
 #### Standby Regions for Regional Failover
-To fight regional outages, secondary regions are always in standby mode and maintained with up-to-date configurations and data, ready to take over in case the primary region fails. 
+
+To fight regional outages, secondary regions are always in standby mode and maintained with up-to-date configurations and data, ready to take over in case the primary region fails.
 The standby regions enable a rapid transition and service continuity with minimal disruption in the event of a complete regional failure, ensuring that Infisical Cloud services remain accessible.
 
 ### Snapshots
@@ -127,7 +129,7 @@ JWT tokens are stored in browser memory and appended to outbound requests requir
 
 ### User authentication
 
-Infisical supports several authentication methods including email/password, Google SSO, GitHub SSO, and SAML 2.0 (Okta, Azure, JumpCloud); Infisical also currently offers email-based 2FA with authenticator app methods coming in Q1 2024.
+Infisical supports several authentication methods including email/password, Google SSO, GitHub SSO, SAML 2.0 (Okta, Azure, JumpCloud), and OpenID Connect; Infisical also currently offers email-based 2FA with authenticator app methods coming in Q1 2024.
 
 Infisical uses the [secure remote password protocol](https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol#:~:text=The%20SRP%20protocol%20has%20a,the%20user%20to%20the%20server), commonly found in other zero-knowledge platform architectures, for authentication.
 Put simply, the protocol enables Infisical to validate a user's knowledge of their password without ever seeing it by constructing a mutual secret; we use this protocol because each user's password is used to seed the generation of a master encryption/decryption key via KDF for that user which the platform
@@ -141,6 +143,7 @@ Lastly, Infisical enforces strong password requirements according to the guidanc
     to access the platform.
 
     We strongly encourage users to generate and store their passwords / master decryption key in a password manager, such as 1Password, Bitwarden, or Dashlane.
+
 </Note>
 
 ## Role-based access control (RBAC)
@@ -172,7 +175,7 @@ Please email security@infisical.com to request any reports including a letter of
 Whether or not Infisical or your employees can access data in the Infisical instance and/or storage backend depends on many factors how you use Infisical:
 
 - Infisical Self-Hosted: Self-hosting Infisical is common amongst organizations that prefer to keep data on their own infrastructure usually to adhere to strict regulatory and compliance requirements. In this option, organizations retain full control over their data and therefore govern the data access policy of their Infisical instance and storage backend.
-- Infisical Cloud: Using Infisical's managed service, [Infisical Cloud](https://app.infisical.com) means delegating data oversight and management to Infisical.  Under our policy controls, employees are only granted access to parts of infrastructure according to principle of least privilege; this is especially relevant to customer data can only be accessed currently by executive management of Infisical. Moreover, any changes to sensitive customer data is prohibited without explicit customer approval.
+- Infisical Cloud: Using Infisical's managed service, [Infisical Cloud](https://app.infisical.com) means delegating data oversight and management to Infisical. Under our policy controls, employees are only granted access to parts of infrastructure according to principle of least privilege; this is especially relevant to customer data can only be accessed currently by executive management of Infisical. Moreover, any changes to sensitive customer data is prohibited without explicit customer approval.
 
 It should be noted that, even on Infisical Cloud, it is physically impossible for employees of Infisical to view the values of secrets if users have not explicitly granted Infisical access to their project (i.e. opted out of zero-knowledge).
 

docs/mint.json

@@ -178,7 +178,10 @@
             "documentation/platform/sso/azure",
             "documentation/platform/sso/jumpcloud",
             "documentation/platform/sso/keycloak-saml",
-            "documentation/platform/sso/google-saml"
+            "documentation/platform/sso/google-saml",
+            "documentation/platform/sso/keycloak-oidc",
+            "documentation/platform/sso/auth0-oidc",
+            "documentation/platform/sso/general-oidc"
           ]
         },
         {