This repository has been archived by the owner on Jan 29, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 51
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #2450 from aiven/staceys-saml-doc-544
Update SAML IdP articles
- Loading branch information
Showing
24 changed files
with
753 additions
and
980 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -122,6 +122,7 @@ inodes | |
| Instana | ||
| IdP | ||
| IdPs | ||
| IdP's | ||
| io | ||
| iops | ||
| IPsec | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| Identity providers | ||
| =================== | ||
|
|
||
| Give your organization users access to Aiven through SAML-based single sign-on with your preferred identity provider. | ||
|
|
||
| .. tableofcontents:: |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| Add Auth0 as an identity provider | ||
| ================================= | ||
|
|
||
| Use `Auth0 <https://auth0.com/>`_ to give your organization users single sign-on (SSO) access to Aiven. | ||
|
|
||
|
|
||
| Prerequisite steps in Aiven Console | ||
| ------------------------------------ | ||
|
|
||
| Add Auth0 as an :ref:`identity provider <add-idp-aiven-console>` in the Console. | ||
|
|
||
|
|
||
| .. _configure-saml-auth0: | ||
|
|
||
| Configure SAML on Auth0 | ||
| ------------------------ | ||
|
|
||
| 1. Log in to `your Auth0 account <https://manage.auth0.com>`_. | ||
|
|
||
| 2. Select **Applications**. | ||
|
|
||
| 3. Click **Create Application**. | ||
|
|
||
| 4. Enter an application name. | ||
|
|
||
| 5. Choose **Regular Web Applications** and click **Create**. | ||
|
|
||
| 6. After your application is created, go to the **Addons** tab. | ||
|
|
||
| 7. Enable the **SAML 2 WEB APP** option. | ||
|
|
||
| 8. Click on the **SAML 2 WEB APP** option. The **Settings** tab opens. | ||
|
|
||
| 9. Set the ``Application Callback URL`` to the ``ACS URL`` from the Aiven Console. | ||
|
|
||
| 10. In the **Settings** section for the Application Callback URL, remove the existing configuration and add the following field mapping configuration: | ||
|
|
||
| .. code-block:: shell | ||
| { | ||
| "email": "email", | ||
| "first_name": "first_name", | ||
| "identity": "email", | ||
| "last_name": "last_name", | ||
| "mapUnknownClaimsAsIs": true | ||
| } | ||
| 11. Click **Enable** and **Save**. | ||
|
|
||
| 12. On the **Usage** tab, make a note of the ``Identity Provider Login URL``, ``Issuer URN``, and ``Identity Provider Certificate``. These are needed for the SAML configuration in Aiven Console. | ||
|
|
||
|
|
||
| Finish the configuration in Aiven | ||
| ---------------------------------- | ||
|
|
||
| Go back to the Aiven Console to :ref:`configure the IdP <configure-idp-aiven-console>` and complete the setup. | ||
|
|
||
|
|
||
| Troubleshooting | ||
| --------------- | ||
|
|
||
| If you have issues, you can use the `SAML Tracer browser extension <https://addons.mozilla.org/firefox/addon/saml-tracer/>`_ to check the process step by step. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| Add Microsoft Azure Active Directory as an identity provider | ||
| ============================================================= | ||
|
|
||
| Use `Microsoft Azure Active Directory (AD) <https://azure.microsoft.com/en-us/products/active-directory/>`_ to give your organization users single sign-on (SSO) access to Aiven. | ||
|
|
||
|
|
||
| Prerequisite steps in Aiven Console | ||
| ------------------------------------ | ||
|
|
||
| Add Azure as an :ref:`identity provider <add-idp-aiven-console>` in the Console. | ||
|
|
||
|
|
||
| .. _configure-saml-azure: | ||
|
|
||
| Configure SAML on Microsoft Azure | ||
| ---------------------------------- | ||
|
|
||
| First, you set up the application on Azure. Then, you add a claim and users. | ||
|
|
||
|
|
||
| Set up an Azure application | ||
| """""""""""""""""""""""""""" | ||
|
|
||
| 1. Log in to `Microsoft Azure <https://portal.azure.com/>`_. | ||
|
|
||
| 2. Got to **Enterprise applications**. | ||
|
|
||
| 3. Select **All applications**. | ||
|
|
||
| 4. Click **New application**. | ||
|
|
||
| 5. Select the **Add from the gallery** search bar and use the **Azure AD SAML Toolkit**. | ||
|
|
||
| 6. Click **Add**. | ||
|
|
||
| 7. Go back to the **Enterprise applications** list. | ||
|
|
||
| .. note:: | ||
|
|
||
| The newly created application might not be visible yet. You can use the **All applications** filter to see the new application. | ||
|
|
||
| 8. Click on the name of the new application. The configuration opens. | ||
|
|
||
| 9. Select **Single sign-on** configuration. | ||
|
|
||
| 10. Select **SAML** as the single sign-on method. | ||
|
|
||
| 11. Add the following parameters to the **Basic SAML Configuration**: | ||
|
|
||
| .. list-table:: | ||
| :header-rows: 1 | ||
| :align: left | ||
|
|
||
| * - Parameter | ||
| - Value | ||
| * - ``Identifier (Entity ID)`` | ||
| - ``https://api.aiven.io/v1/sso/saml/account/{account_id}/method/{account_authentication_method_id}/metadata`` | ||
| * - ``Reply URL (Assertion Consumer Service URL)`` | ||
| - ``https://api.aiven.io/v1/sso/saml/account/{account_id}/method/{account_authentication_method_id}/acs`` | ||
| * - ``Sign on URL`` | ||
| - ``https://console.aiven.io`` | ||
|
|
||
|
|
||
| 12. Click **Save**. | ||
|
|
||
| Create a claim and add users | ||
| """""""""""""""""""""""""""" | ||
|
|
||
| 1. In the **User Attributes & Claims**, click **Add a new claim**. | ||
|
|
||
| 2. Create an attribute with the following data: | ||
|
|
||
| .. list-table:: | ||
| :header-rows: 1 | ||
| :align: left | ||
|
|
||
| * - Parameter | ||
| - Value | ||
| * - ``Name`` | ||
| - ``email`` | ||
| * - ``Source`` | ||
| - ``Attribute`` | ||
| * - ``Source Attribute`` | ||
| - ``user.mail`` | ||
|
|
||
| 3. Download the **Certificate (Base64)** from the **SAML Signing Certificate** section. | ||
|
|
||
| 4. Go to **Users and groups** and click **Add user**. | ||
|
|
||
| 5. Select the users that you want to use Azure AD to log in to Aiven. | ||
|
|
||
| 6. Click **Assign**. | ||
|
|
||
|
|
||
| Finish the configuration in Aiven | ||
| ---------------------------------- | ||
|
|
||
| Go back to the Aiven Console to :ref:`configure the IdP <configure-idp-aiven-console>` and complete the setup. | ||
|
|
||
|
|
||
| Troubleshooting | ||
| --------------- | ||
|
|
||
| If you get an error message suggesting you contact your administrator, try these steps: | ||
|
|
||
| #. Go to the Microsoft Azure AD user profile for the users. | ||
|
|
||
| #. In **Contact Info**, check whether the **Email** field is blank. | ||
|
|
||
| If it is blank, there are two possible solutions: | ||
|
|
||
| * In **User Principal Name**, if the **Identity** field is an email address, try changing the **User Attributes & Claims** to ``email = user.userprincipalname``. | ||
|
|
||
| * In **Contact Info**, if none of the **Alternate email** fields are blank, try changing the **User Attributes & Claims** to ``email = user.othermail``. | ||
|
|
||
| If you still have login issues, you can use the `SAML Tracer browser extension <https://addons.mozilla.org/firefox/addon/saml-tracer/>`_ to check the process step by step. If this doesn't work, get in touch with our support team at [email protected]. |
Oops, something went wrong.