mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-11 12:29:26 +00:00
51 lines
2.4 KiB
Plaintext
51 lines
2.4 KiB
Plaintext
---
|
||
title: "SSO Overview"
|
||
sidebarTitle: "Overview"
|
||
description: "Learn how to log in to Infisical via SSO protocols."
|
||
---
|
||
|
||
<Info>
|
||
Infisical offers Google SSO and GitHub SSO for free across both Infisical
|
||
Cloud and Infisical Self-hosted. Infisical also offers SAML SSO authentication
|
||
but as paid features that can be unlocked on Infisical Cloud's **Pro** tier or
|
||
via enterprise license on self-hosted instances of Infisical. On this front,
|
||
we support industry-leading providers including Okta, Azure AD, and JumpCloud;
|
||
with any questions, please reach out to [email protected].
|
||
</Info>
|
||
|
||
You can configure your organization in Infisical to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0).
|
||
|
||
To note, Infisical's SSO implementation decouples the **authentication** and **decryption** steps – which implies that no
|
||
Identity Provider can have access to the decryption key needed to decrypt your secrets (this also implies that Infisical requires entering the user's Master Password on top of authenticating with SSO).
|
||
|
||
## Identity providers
|
||
|
||
Infisical supports these and many other identity providers:
|
||
|
||
- [Google SSO](/documentation/platform/sso/google)
|
||
- [GitHub SSO](/documentation/platform/sso/github)
|
||
- [GitLab SSO](/documentation/platform/sso/gitlab)
|
||
- [Okta SAML](/documentation/platform/sso/okta)
|
||
- [Azure SAML](/documentation/platform/sso/azure)
|
||
- [JumpCloud SAML](/documentation/platform/sso/jumpcloud)
|
||
- [Keycloak SAML](/documentation/platform/sso/keycloak-saml)
|
||
- [Google SAML](/documentation/platform/sso/google-saml)
|
||
|
||
If your required identity provider is not shown in the list above, please reach out to [[email protected]](mailto:[email protected]) for assistance.
|
||
|
||
## FAQ
|
||
|
||
<AccordionGroup>
|
||
<Accordion title="Why does Infisical require additional email verification for users connected via SAML?">
|
||
By default, Infisical Cloud is configured to not trust emails from external
|
||
identity providers to prevent any malicious account takeover attempts via
|
||
email spoofing. Accordingly, Infisical creates a new user for anyone provisioned
|
||
through an external identity provider and requires an additional email
|
||
verification step upon their first login.
|
||
|
||
If you're running a self-hosted instance of Infisical and would like it to trust emails from external identity providers,
|
||
you can configure this behavior in the admin panel.
|
||
|
||
</Accordion>
|
||
</AccordionGroup>
|