Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitfaeab3a

Browse files
committed
Port SSO content
Ported content for SSOs fromClassic and streamlined content for all SAML SSOs
1 parent8f537e2 commitfaeab3a

File tree

14 files changed

+692
-182
lines changed

14 files changed

+692
-182
lines changed

‎_docs/administration/single-sign-on.md‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,20 +10,20 @@ toc: true
1010

1111
Customers in our**enterprise plan** can log in to Codefresh, using Federated Single Sign-On (SSO). To learn more, please[contact sales](https://codefresh.io/contact-sales/).
1212

13-
Federated identity management enables the cross organizational exchange of identity information across Internet domains, without migrating credential information or consolidating several security domains. With federation, customers can authenticate with their corporate credentials to gain access to Codefresh.This means that you can sign in to your Codefresh account using your corporate credentials.
14-
13+
Federated identity management enables the cross organizational exchange of identity information across Internet domains, without migrating credential information or consolidating several security domains. With federation, customers can authenticate with their corporate credentials to gain access to Codefresh.
14+
1515
To set up Federated SSO, your identity management organization must use either of the following:
1616

17-
-**A Security Assertion Markup Language 2.0 (SAML 2.0)** compliant Identity Provider (IdP), configured to communicate with Codefresh Service Provider (SP). For example, ADFS, Auth0, Okta and Ping Identity.
17+
-**A Security Assertion Markup Language 2.0 (SAML 2.0)** compliant Identity Provider (IdP), configured to communicate withtheCodefresh Service Provider (SP). For example, ADFS, Auth0, Okta and Ping Identity.
1818

1919
-**OpenID Connect (OAuth 2.0)** identity management. For example, Google, GitHub, Bitbucket and GitLab.
2020

2121
Asserting the identity of the user to Codefresh ensures seamless SSO from a browser.
2222

2323
A SAML2-based federated system comprises:
2424

25-
-**Identity Provider (IdP)**: The identity provider belongs to the corporation that manages accounts for a large number of users who need secure internet access to the services orWeb-based applications of another organization. In our case, it'sa customer's organization that requires access to Codefresh.
26-
- The IdP manages the corporate users, and integrates with Identity Management systems in the customer's organization responsible for authentication. The Identity Management systems integrate with authentication providers such as LDAP or AD.
25+
-**Identity Provider (IdP)**: The identity provider belongs to the corporation that manages accounts for a large number of users who need secure internet access to the services orweb-based applications of another organization. In our case, it'sthe customer's organization that requires access to Codefresh.
26+
- The IdP manages the corporate users, and integrates with Identity Management systems in the customer's organization responsible for authentication. The Identity Management systems integrate with authentication providers such as LDAP or AD(Active Directory).
2727
- All user authentication is carried out via Identity Management systems integrated with the IdP.
2828
- For successfully authenticated users, the IdP sends a SAML assertion to the Codefresh service provider that enables the user to access Codefresh.
2929

@@ -45,6 +45,4 @@ Using federated SSO significantly simplifies cross-domain user management as fol
4545

4646
###What to read next
4747
[Setting Up SAML2 Federated Single Sign-On (SSO)](sso-setup-saml2)
48-
[Setting Up OpenID Connect Federated Single Sign-On](sso-setup-oauth2)
49-
50-
48+
[Setting Up OpenID Connect Federated Single Sign-On](sso-setup-oauth2)
File renamed without changes.
Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
---
2+
title:"OpenID Connect"
3+
description:"Setting Up OpenID Connect Federated Single Sign-On (SSO)"
4+
group:single-sign-on
5+
toc:true
6+
---
7+
8+
Codefresh natively supports login using GitHub, Bitbucket and GitLab using the OpenID Connect (OAUTH 2.0) protocol. This guide will review how to add SSO integrations based on OAUTH 2.0 as part of Codefresh Enterprise plan.
9+
10+
##Prerequisites
11+
12+
In order to add successfully an identity Provider in Codefresh you need to do some preparatory work with both Codefresh and the provider.
13+
14+
1. You need to inform your Identify provider that it will provide SSO services to Codefresh
15+
1. You need to set up Codefresh and point it to your Identity Provider.
16+
17+
The first procedure differs according to you Identity Provider, but the second one is common for all providers.
18+
19+
Note that SSO is only available to Enterprise customers. Please[contact sales](https://codefresh.io/contact-sales/) in order to enable it for your Codefresh account.
20+
21+
##Identity Provider options
22+
23+
Codefresh currently supports
24+
25+
* Auth0
26+
* Azure
27+
* Google
28+
* Okta
29+
* OneLogin
30+
31+
To access the SSO configuration at the account level.
32+
33+
1. Click on your avatar at the top right of the GUI and select*Account settings*.
34+
1. In the new screen, select*Single Sign-on* from the left sidebar.
35+
36+
{% include image.html
37+
lightbox="true"
38+
file="/images/administration/sso/add-sso-dropdown.png"
39+
url="/images/administration/sso/add-sso-dropdown.png"
40+
alt="SSO provider settings"
41+
caption="SSO provider settings"
42+
max-width="70%"
43+
%}
44+
45+
{:start="3"}
46+
1. To connect an Identity Provider, click the*add single-sign-on* button and select your provider from the drop-down menu.
47+
48+
##Codefresh SSO setup
49+
50+
Regardless of the Identity Provider that you have chosen, the setup in Codefresh is similar for all of them. You need to provide several fields to Codefresh to activate SSO. The common ones are:
51+
52+
**Display Name* - A name for your Identity Provider
53+
**Client ID* - An ID that will be used for the connection
54+
**Client Secret* - A secret associated with the ID
55+
56+
Some providers also need additional fields which are specific to that provider.
57+
58+
The process to obtain the values for these fields depends on the individual Identity Provider. In the following
59+
sections we will outline the details for each one.
60+
61+
###Setting Auth0 as an Identity provider
62+
63+
See the[Auth0 instructions]({{site.baseurl}}/docs/single-sign-on/oidc/oidc-auth0/).
64+
65+
###Setting Azure as an Identity provider
66+
67+
See the[Azure instructions]({{site.baseurl}}/docs/single-sign-on/oidc/oidc-azure/).
68+
69+
###Setting Google as an Identity provider
70+
71+
See the[Google instructions]({{site.baseurl}}/docs/single-sign-on/oidc/oidc-google/).
72+
73+
###Setting Okta as an Identity Provider
74+
75+
See the[Okta instructions]({{site.baseurl}}/docs/single-sign-on/oidc/oidc-okta/).
76+
77+
###Setting OneLogin as an Identity Provider
78+
79+
See the[OneLogin instructions]({{site.baseurl}}/docs/single-sign-on/oidc/oidc-onelogin/).
80+
81+
##Testing your Identity provider
82+
83+
Once you set up the Identity Provider, do the following
84+
85+
1. Go to the collaborators screen by clicking on*People* on the left sidebar (under User Management).
86+
1. Add an active user that will be used for testing. We recommend you use your own user.
87+
1. Change Login method by selecting your Auth provider from the SSO drop-down.
88+
89+
{% include image.html
90+
lightbox="true"
91+
file="/images/administration/sso/collaborators.png"
92+
url="/images/administration/sso/collaborators.png"
93+
alt="Adding collaborators"
94+
caption="Adding collaborators"
95+
max-width="70%"
96+
%}
97+
98+
1. Keep the current browser session open, and log in via Corporate SSO in an incognito tab (or another browser).
99+
100+
{% include image.html
101+
lightbox="true"
102+
file="/images/administration/sso/sign-with-sso.png"
103+
url="/images/administration/sso/sign-with-sso.png"
104+
alt="Sign-in with SSO"
105+
caption="Sign-in with SSO"
106+
max-width="50%"
107+
%}
108+
109+
1. If everything works, add more users.
110+
111+
>Before enabling SSO for all users, you**MUST** make sure that it is working for the test user, because if SSO is enabled for a user, Codefresh blocks logins through other IDPs for this user and only the enabled SSO is allowed. If the selected SSO method does not work for some reason, users will be locked out of Codefresh.
112+
113+
##Selecting SSO method for collaborators
114+
115+
To add users and select their SSO method, go to*Collaborators* from the left sidebar. Then add the email or Codefresh username of a user.
116+
117+
In addition to their role you can now select the SSO method they will use
118+
119+
{% include image.html
120+
lightbox="true"
121+
file="/images/administration/sso/select-user-sso.png"
122+
url="/images/administration/sso/select-user-sso.png"
123+
alt="Selecting SSO method"
124+
caption="Selecting SSO method"
125+
max-width="50%"
126+
%}
127+
128+
**SSO login for new and existing users**
129+
If you have multiple SSO providers configured, you can select a different provider for each user if so required.
130+
131+
* New users
132+
If you have an SSO provider selected as the default, that provider is automatically assigned to new users, added either manually or via team synchronization.
133+
134+
* Existing users
135+
SSO login is not configured by default for existing users. You must_explicitly select_ the SSO provider for existing users.
136+
If SSO login is already configured for an existing user, and you add a new identity provider, to change the SSO login to the new provider, you must_select_ the new provider for the user.
137+
138+
139+
##Setting a default provider
140+
141+
If you have multiple SSO providers set you can hover your mouse on the top right of the SSO screen
142+
and setup one of them as the default provider.
143+
144+
{% include image.html
145+
lightbox="true"
146+
file="/images/administration/sso/default-sso.png"
147+
url="/images/administration/sso/default-sso.png"
148+
alt="Default SSO provider"
149+
caption="Default SSO provider"
150+
max-width="90%"
151+
%}
152+
153+
If a default sso provider is set then:
154+
155+
1. This SSO method will be automatically assigned to all new invited users
156+
1. All new users will receive an email with an invite link that points them directly to the login page of that SSO provider
157+
158+
##Syncing of teams after initial SSO setup
159+
160+
Once the initial setup is done, you can also sync your teams between Codefresh and the Identity provider.
161+
You can do this via the[Codefresh Cli](https://codefresh-io.github.io/cli/) and specifically the[sync command](https://codefresh-io.github.io/cli/teams/synchronize-teams/).
162+
163+
For example, to sync you azure teams you can execute
164+
165+
```bash
166+
codefresh synchronize teams my-client-name -t azure
167+
```
168+
169+
You can find the client-name from the SSO UI.
170+
171+
{% include image.html
172+
lightbox="true"
173+
file="/images/administration/sso/azure/client-name.png"
174+
url="/images/administration/sso/azure/client-name.png"
175+
alt="SSO Client Name"
176+
caption="SSO Client Name"
177+
max-width="40%"
178+
%}
179+
180+
Even though you can run this command manually it makes more sense to run it periodically as a job. And the obvious
181+
way to perform this, is with a Codefresh pipeline. The CLI can be used as a[freestyle step]({{site.baseurl}}/docs/codefresh-yaml/steps/freestyle/).
182+
183+
You can create a git repository with a[codefresh.yml]({{site.baseurl}}/docs/codefresh-yaml/what-is-the-codefresh-yaml/) file with the following contents:
184+
185+
`YAML`
186+
{% highlight yaml %}
187+
{% raw %}
188+
version: '1.0'
189+
steps:
190+
syncMyTeams:
191+
title: syncTeams
192+
image: codefresh/cli
193+
commands:
194+
- 'codefresh synchronize teams my-client-name -t azure'
195+
{% endraw %}
196+
{% endhighlight %}
197+
198+
To fully automate this pipeline you should set a[cron trigger]({{site.baseurl}}/docs/configure-ci-cd-pipeline/triggers/cron-triggers/) for this pipeline. The cron-trigger will be responsible for running this pipeline (and therefore synchronizing the teams) in a fully automated manner.
199+
200+
This way you can synchronize your teams every day/week/hour depending on you cron trigger setup.

‎_docs/administration/single-sign-on/sso-auth0.md‎renamed to ‎_docs/administration/single-sign-on/oidc/oidc-auth0.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title:"Auth0"
3-
description:"SetUp Auth0 Single Sign-On (SSO)"
3+
description:"Setup Auth0 Single Sign-On (SSO)"
44
group:administration
55
sub_group:single-sign-on
66
redirect_from:
@@ -10,7 +10,10 @@ toc: true
1010
---
1111

1212
Auth0 is one of the SSO providers that Codefresh supports for authentication and authorization.
13-
Create an SSO account for Auth0 in Codefresh. Start by creating an Auth0 application, then create the SSO account for Auth0 in Codefresh, and finally define the SSO settings for the application you created in Auth0.
13+
Create an SSO account for Auth0 in Codefresh by:
14+
* Creating an Auth0 application in Auth0
15+
* Creating the SSO account for Auth0 in Codefresh
16+
* Definng the SSO settings for the application you created in Auth0
1417

1518
###1. Create an Auth0 application
1619
First create a new application in Auth0.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
---
2+
title:"Setting up SAML2 Federated Single Sign-On (SSO)"
3+
description:""
4+
group:administration
5+
sub_group:single-sign-on
6+
redirect_from:
7+
-/docs/sso/sso-setup-saml2/
8+
-/docs/enterprise/single-sign-on/sso-setup-saml2/
9+
toc:true
10+
---
11+
12+
As Identity Providers (IdPs) come in all shapes and sizes, this topic discusses in general what you must do to configure Federated SSO.
13+
As you will see in the description below, the person in your organization responsible for managing your IdP will need to interact with Codefresh support to successfully set up a trust between your IdP and Codefresh as an SP.
14+
15+
{:.text-secondary}
16+
##Before you set up Federated SSO
17+
1. Have your account set up with Codefresh enterprise plan.
18+
2. Ensure you have a working SAML 2.0 compliant identity provider (IdP).
19+
3. Identify someone in your organization who is familiar with configuring and managing your organization's IdP.
20+
4. Ensure that your IdP's system clock is synchronized with a reliable time source. If it's not, tokens generated will be unusable and SSO will fail.
21+
22+
{:.text-secondary}
23+
###Summary of Federated SSO setup
24+
25+
{% include image.html
26+
lightbox="true"
27+
file="/images/sso-flow.png"
28+
url="/images/sso-flow.png"
29+
alt="sso-flow.png"
30+
max-width="100%"
31+
%}
32+
33+
{:.text-secondary}
34+
###SAML attributes
35+
36+
Codefresh expects the following user attributes to be passed through SAML between your IdP and Codefresh SP:
37+
- User email address
38+
- User first name
39+
- User last name
40+
- User full name
41+
- User unique ID that isn't subject to change in your identity management environment
42+
43+
{:.text-secondary}
44+
###How does the connection process work?
45+
46+
{% include image.html
47+
lightbox="true"
48+
file="/images/sso-diagram.png"
49+
url="/images/sso-diagram.png"
50+
alt="sso-diagram.png"
51+
max-width="100%"
52+
%}
53+
54+
Once Federated SSO has been configured, the process works as follows:
55+
56+
<divclass="bd-callout bd-callout-info"markdown="1">
57+
58+
Steps 2 to 7 occur in the background and are transparent to the user.
59+
</div>
60+
61+
1. A user logs in to Codefresh and enters the email address.
62+
2. The user is redirected to the Codefresh Service Provider (SP) to initiate SSO.
63+
3. The user’s browser is then redirected to the customer IdP.
64+
4. Once authenticated by the corporate side, a SAML token is sent to the user’s browser.
65+
5. The SAML assertion is then forwarded to Codefresh SP.
66+
6. If you are a valid Codefresh user for this SSO connection, an SSO token is returned to the user’s browser.
67+
7. The user’s browser then returns a token to Codefresh and access is granted for your account.
68+
69+
##SAML SSO configuration in Codefresh
70+
71+
Codefresh supports SAML SSO for the following:
72+
JumpCloud
73+
OneLogin
74+
PingID
75+
76+
Currentl
77+
78+
1. In the Codefresh UI, on the toolbar, click the**Settings** icon and then select**Account Settings**.
79+
1. From the sidebar, below Access & Collaboration, select[**Single Sign-On**](https://g.codefresh.io/2.0/account-settings/single-sign-on){:target="\_blank"}.
80+
81+
<!--change screenshot
82+
{% include image.html
83+
lightbox="true"
84+
file="/images/administration/sso/add-sso-dropdown.png"
85+
url="/images/administration/sso/add-sso-dropdown.png"
86+
alt="SSO provider settings"
87+
caption="SSO provider settings"
88+
max-width="70%"
89+
%}
90+
-->
91+
{:start="3"}
92+
1. Click**Add single-sign-on**, select**SAML**, and then click**Next**.
93+
1. Enter the connection details:
94+
95+
<!--Not in UI* **Client Name**: For auto-generation, leave empty. Codefresh generates the client name once you save the settings.-->
96+
***Display Name**: The name you want to give to this SAML integration.
97+
***IDP Entry**: The SSO endpoint of your Identity Provider. For Azure SAML, for example, this is the Login URL.
98+
***Application Certificate**: The security certificate of your Identity Provider. Paste the value directly in the field. For Azure SAML for example, this is the Base64 Certificate, and you must copy the value between the -----BEGIN and -----END from the downloaded certificate.
99+
>Do not convert to base64 or any other encoding by hand.
100+
<!--Not in UI* **Assertion URL**: `https://g.codefresh.io/api/auth/<your_codefresh_client_name>/callback​`
101+
where ​<your_codefresh_client_name>​ is he client name that is automatically generated when saving the SSO settings.-->
102+
***Auto Sync users and teams to Codefresh**: Supported for Google/GSuite SAML integration. Select to automatically sync user accounts in to your Codefresh account. Optionally, define the time interval at which to sync, in hours, from 1 to 24. If you don't specify an interval, the sync interval is every 12 hours.
103+
1. Select**+Add**, and note down the`Client Name` that is generated.
104+
105+
106+
###Configure Codefresh Service Provider settings in IdP
107+
In your Identity Provider, create a new Service Provider and provide the following:
108+
109+
***Service Provider SSO Endpoint**: Assertion consumer service URL -`https://g.codefresh.io/api/auth/<your_codefresh_client_name>/callback`
110+
***Service Provider Entity ID**:`g.codefresh.io`
111+
112+
The mandatory fields needed for SAML assertions are:
113+
1. firstName: User's first name
114+
1. lastName: User's last name
115+
1. email: User's email
116+
117+
To configure users sync for SAML IDP, do the following:
118+
119+
1. Select a G Suite provider
120+
1. Enable Auto Sync users and teams to Codefresh
121+
1. Set JSON Keyfile, Admin Email and Sync interval
122+
123+
The instructions for getting the JSON Keyfile, and Admin Email are the same as for[Google SSO]({{site.baseurl}}/docs/administration/single-sign-on/sso-google/#synchronize-teams-with-the-codefresh-cli).
124+
125+
>Note
126+
These settings are for the SaaS version of Codefresh. For an on-premises setup, use the URLs that match your installation.
127+
128+
Once everything is finished, you[should test the integration]({{site.baseurl}}/docs/administration/single-sign-on/sso-setup-oauth2/#testing-your-identity-provider). Once it's working, proceed to the next steps that are:
129+
130+
*[Selecting SSO method for collaborators]({{site.baseurl}}/docs/administration/single-sign-on/sso-setup-oauth2/#selecting-sso-method-for-collaborators)
131+
132+
>Notice that Codefresh has an internal cache for SSO configurations and it might take up to five minutes for your changes to take effect.
133+
134+
135+
136+
137+
138+
139+
140+

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp