diff --git a/backend/src/ee/routes/v1/saml-router.ts b/backend/src/ee/routes/v1/saml-router.ts index b195d32b3..0b302c614 100644 --- a/backend/src/ee/routes/v1/saml-router.ts +++ b/backend/src/ee/routes/v1/saml-router.ts @@ -84,7 +84,7 @@ export const registerSamlRouter = async (server: FastifyZodProvider) => { samlConfig.audience = `spn:${ssoConfig.issuer}`; } } - if (ssoConfig.authProvider === SamlProviders.GOOGLE_SAML) { + if (ssoConfig.authProvider === SamlProviders.GOOGLE_SAML || ssoConfig.authProvider === SamlProviders.AUTH0_SAML) { samlConfig.wantAssertionsSigned = false; } diff --git a/backend/src/ee/services/saml-config/saml-config-types.ts b/backend/src/ee/services/saml-config/saml-config-types.ts index 96cb91035..03db4cfa1 100644 --- a/backend/src/ee/services/saml-config/saml-config-types.ts +++ b/backend/src/ee/services/saml-config/saml-config-types.ts @@ -6,7 +6,8 @@ export enum SamlProviders { AZURE_SAML = "azure-saml", JUMPCLOUD_SAML = "jumpcloud-saml", GOOGLE_SAML = "google-saml", - KEYCLOAK_SAML = "keycloak-saml" + KEYCLOAK_SAML = "keycloak-saml", + AUTH0_SAML = "auth0-saml" } export type TCreateSamlCfgDTO = { diff --git a/docs/documentation/platform/sso/auth0-saml.mdx b/docs/documentation/platform/sso/auth0-saml.mdx new file mode 100644 index 000000000..567419a22 --- /dev/null +++ b/docs/documentation/platform/sso/auth0-saml.mdx @@ -0,0 +1,93 @@ +--- +title: "Auth0 SAML" +description: "Learn how to configure Auth0 SAML for Infisical SSO." +--- + + + Auth0 SAML SSO feature is a paid feature. If you're using Infisical Cloud, + then it is available under the **Pro Tier**. If you're self-hosting Infisical, + then you should contact sales@infisical.com to purchase an enterprise license + to use it. + + + + + In Infisical, head to your Organization Settings > Authentication > SAML SSO Configuration and select **Set up SAML SSO**. + + Next, note the **Application Callback URL** and **Audience** to use when configuring the Auth0 SAML application. + + ![Auth0 SAML initial configuration](../../../images/sso/auth0-saml/init-config.png) + + + + 2.1. In your Auth0, head to Applications and create an application. + + ![Auth0 SAML app creation](../../../images/sso/auth0-saml/create-application.png) + + Select **Regular Web Application** and press **Create**. + + ![Auth0 SAML app creation](../../../images/sso/auth0-saml/create-application-2.png) + + 2.2. In the Application head to Settings > Application URIs and add the **Application Callback URL** from step 1 into the **Allowed Callback URLs** field. + + ![Auth0 SAML allowed callback URLs](../../../images/sso/auth0-saml/auth0-config.png) + + 2.3. In the Application head to Addons > SAML2 Web App and copy the **Issuer**, **Identity Provider Login URL**, and **Identity Provider Certificate** from the **Usage** tab. + + ![Auth0 SAML config](../../../images/sso/auth0-saml/auth0-config-2.png) + + 2.4. Back in Infisical, set **Issuer**, **Identity Provider Login URL**, and **Certificate** to the corresponding items from step 2.3. + + ![Auth0 SAML Infisical config](../../../images/sso/auth0-saml/infisical-config.png) + + 2.5. Back in Auth0, in the **Settings** tab, set the **Application Callback URL** to the **Application Callback URL** from step 1 + and update the **Settings** field with the JSON under the picture below (replacing `` with the **Audience** from step 1). + + ![Auth0 SAML config](../../../images/sso/auth0-saml/auth0-config-3.png) + + ```json + { + "audience": "", + "mappings": { + "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email", + "given_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstName", + "family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/lastName" + }, + "signatureAlgorithm": "rsa-sha256", + "digestAlgorithm": "sha256", + "signResponse": true + } + ``` + + Click **Save**. + + + Enabling SAML SSO allows members in your organization to log into Infisical via Auth0. + + ![Auth0 SAML enable](../../../images/sso/auth0-saml/enable-saml.png) + + + Enforcing SAML SSO ensures that members in your organization can only access Infisical + by logging into the organization via Auth0. + + To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one Auth0 user with Infisical; + Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO. + + + + + + If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite SAML login. + + + + If you're configuring SAML SSO on a self-hosted instance of Infisical, make + sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to + work: +
+ - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This + can be a random 32-byte base64 string generated with `openssl rand -base64 + 32`. +
+ - `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. https://app.infisical.com) + \ No newline at end of file diff --git a/docs/documentation/platform/sso/overview.mdx b/docs/documentation/platform/sso/overview.mdx index 227a7502f..0d4b8da89 100644 --- a/docs/documentation/platform/sso/overview.mdx +++ b/docs/documentation/platform/sso/overview.mdx @@ -28,6 +28,7 @@ Infisical supports these and many other identity providers: - [JumpCloud SAML](/documentation/platform/sso/jumpcloud) - [Keycloak SAML](/documentation/platform/sso/keycloak-saml) - [Google SAML](/documentation/platform/sso/google-saml) +- [Auth0 SAML](/documentation/platform/sso/auth0-saml) - [Keycloak OIDC](/documentation/platform/sso/keycloak-oidc) - [Auth0 OIDC](/documentation/platform/sso/auth0-oidc) - [General OIDC](/documentation/platform/sso/general-oidc) diff --git a/docs/images/sso/auth0-saml/auth0-config-2.png b/docs/images/sso/auth0-saml/auth0-config-2.png new file mode 100644 index 000000000..1fbc68363 Binary files /dev/null and b/docs/images/sso/auth0-saml/auth0-config-2.png differ diff --git a/docs/images/sso/auth0-saml/auth0-config-3.png b/docs/images/sso/auth0-saml/auth0-config-3.png new file mode 100644 index 000000000..f4287e51a Binary files /dev/null and b/docs/images/sso/auth0-saml/auth0-config-3.png differ diff --git a/docs/images/sso/auth0-saml/auth0-config.png b/docs/images/sso/auth0-saml/auth0-config.png new file mode 100644 index 000000000..6fca6247d Binary files /dev/null and b/docs/images/sso/auth0-saml/auth0-config.png differ diff --git a/docs/images/sso/auth0-saml/create-application-2.png b/docs/images/sso/auth0-saml/create-application-2.png new file mode 100644 index 000000000..71990fbef Binary files /dev/null and b/docs/images/sso/auth0-saml/create-application-2.png differ diff --git a/docs/images/sso/auth0-saml/create-application.png b/docs/images/sso/auth0-saml/create-application.png new file mode 100644 index 000000000..c113d2dda Binary files /dev/null and b/docs/images/sso/auth0-saml/create-application.png differ diff --git a/docs/images/sso/auth0-saml/enable-saml.png b/docs/images/sso/auth0-saml/enable-saml.png new file mode 100644 index 000000000..bb084ebac Binary files /dev/null and b/docs/images/sso/auth0-saml/enable-saml.png differ diff --git a/docs/images/sso/auth0-saml/infisical-config.png b/docs/images/sso/auth0-saml/infisical-config.png new file mode 100644 index 000000000..07a7cdc74 Binary files /dev/null and b/docs/images/sso/auth0-saml/infisical-config.png differ diff --git a/docs/images/sso/auth0-saml/init-config.png b/docs/images/sso/auth0-saml/init-config.png new file mode 100644 index 000000000..5ab5a01e5 Binary files /dev/null and b/docs/images/sso/auth0-saml/init-config.png differ diff --git a/docs/mint.json b/docs/mint.json index 69ad84f11..5d06a10f9 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -248,6 +248,7 @@ "documentation/platform/sso/jumpcloud", "documentation/platform/sso/keycloak-saml", "documentation/platform/sso/google-saml", + "documentation/platform/sso/auth0-saml", "documentation/platform/sso/keycloak-oidc", "documentation/platform/sso/auth0-oidc", "documentation/platform/sso/general-oidc" diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/SSOModal.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/SSOModal.tsx index eab111c15..9bb793c80 100644 --- a/frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/SSOModal.tsx +++ b/frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/SSOModal.tsx @@ -25,7 +25,8 @@ enum AuthProvider { AZURE_SAML = "azure-saml", JUMPCLOUD_SAML = "jumpcloud-saml", KEYCLOAK_SAML = "keycloak-saml", - GOOGLE_SAML = "google-saml" + GOOGLE_SAML = "google-saml", + AUTH0_SAML = "auth0-saml" } const ssoAuthProviders = [ @@ -33,7 +34,8 @@ const ssoAuthProviders = [ { label: "Azure / Entra SAML", value: AuthProvider.AZURE_SAML }, { label: "JumpCloud SAML", value: AuthProvider.JUMPCLOUD_SAML }, { label: "Keycloak SAML", value: AuthProvider.KEYCLOAK_SAML }, - { label: "Google SAML", value: AuthProvider.GOOGLE_SAML } + { label: "Google SAML", value: AuthProvider.GOOGLE_SAML }, + { label: "Auth0 SAML", value: AuthProvider.AUTH0_SAML } ]; const schema = z @@ -191,6 +193,15 @@ export const SSOModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDelet issuer: "Issuer", issuerPlaceholder: window.origin }; + case AuthProvider.AUTH0_SAML: + return { + acsUrl: "Application Callback URL", + entityId: "Audience", + entryPoint: "Identity Provider Login URL", + entryPointPlaceholder: "https://xxx.auth0.com/samlp/xxx", + issuer: "Issuer", + issuerPlaceholder: "urn:xxx-xxx.us.auth0.com" + }; default: return { acsUrl: "ACS URL",