May 5, 2025 · May 5, 2025 · May 5, 2025 · May 5, 2025 · May 5, 2025
diff --git a/_docs/administration/account-user-management/add-users.md b/_docs/administration/account-user-management/add-users.md
 ## Related articles
 [Single sign-on]({{site.baseurl}}/docs/administration/single-sign-on/)
 [Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/)
 [Setting up OAuth authentication for Git providers]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup)
 {% if page.collection != site.gitops_collection %}
 [Setting up OAuth authentication for Git providers]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup)
 [Configuring access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/)
 {% endif %}
diff --git a/_docs/administration/account-user-management/hosted-authorize-orgs.md b/_docs/administration/account-user-management/hosted-authorize-orgs.md
 max-width="70%"
 %}

 {% if page.collection != site.gitops_collection %}
 ## Related articles
 [Setting up OAuth2 for GitOps]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup/)
 {% endif %}
diff --git a/_docs/administration/account-user-management/oauth-setup.md b/_docs/administration/account-user-management/oauth-setup.md
 ---

 ## OAuth2 authentication for GitOps
 Codefresh integrates with the Git provider defined for the GitOps Runtime to sync repositories to your clusters, implementing Git-based operations when creating resources such as applications, and enriching images with valuable information.
 Codefresh integrates withGitHub Cloud asthe Git provider defined for the GitOps Runtime to sync repositories to your clusters, implementing Git-based operations when creating resources such as applications, and enriching images with valuable information.

 As the account administrator, you can select the authentication method for the account associated with the Runtime.
 Users in the account can then authorize access to the Git provider through the defined mechanism.
 Users in the account can then authorize access toGitHub asthe Git provider through the defined mechanism.

 {% if page.collection != site.gitops_collection %}
 {% include
   image.html
   lightbox="true"
 Codefresh supports OAuth2 or personal access tokens (PATs) for authentication:

 * **OAuth2 with Codefresh OAuth Application or custom OAuth2 Application**
  OAuth2 is the preferred authentication mechanism, supported forpopular Git providers such asGitHub, GitHub Enterprise, GitLab Cloud and Server, and Bitbucket Cloud and Server.
  OAuth2 is the preferred authentication mechanism, supported for GitHub.
  You have the option to use the default predefined Codefresh OAuth Application, or a custom Oauth2 Application for Codefresh in your Git provider account.

  To use a custom Oauth2 Application for Codefresh, first create the application in yourGit provider account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>
  To use a custom Oauth2 Application for Codefresh, first create the application in yourGitHub account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>
  See [Create a custom OAuth2 Application for Git provider](#create-a-custom-oauth2-application-for-git-provider) in this article.

 * **Token-based authentication using PAT**
  With token-based authentication, users must generate personal access tokensfrom theirGit providers with the required scopes and enter their personal access tokens when prompted to authorize access.<br>
  With token-based authentication, users must generate personal access tokensfor theirGitHub  accounts with the required scopes and enter their personal access tokens when prompted to authorize access.<br>
  See [Authorize Git access in Codefresh]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#git-provider-private-access).
 {% endif %}

 {% if page.collection == site.gitops_collection %}
 Codefresh supports OAuth2 or personal access tokens (PATs) for authentication:

 * **OAuth2 with Codefresh OAuth Application or custom OAuth2 Application**
  OAuth2 is the preferred authentication mechanism for GitHub. You have the option to use the default predefined Codefresh OAuth Application, or a custom Oauth2 Application for Codefresh in your Git provider account.

  To use a custom Oauth2 Application for Codefresh, first create the application in your Git provider account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>
  See [Create a custom OAuth2 Application for Git provider](#create-a-custom-oauth2-application-for-git-provider) in this article.

 * **Token-based authentication using PAT**
  With token-based authentication, users must generate personal access tokens with the required scopes in their GitHub accounts, and enter their personal access tokens when prompted to authorize access.<br>
  See [Authorize Git access in Codefresh]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#git-provider-private-access).
 {% endif %}


 ## Authentication for Git providers and Runtime accounts


 ## Create a custom OAuth2 Application for Git provider
 Create a custom OAuth2 Application for Codefresh in your Git provider account with the correct scopes, and set up authentication for the same within Codefresh. Users can then authorize access to the Git provider using OAuth2, instead of a personal access token.

 {% if page.collection != site.gitops_collection %}
 Supported Git providers:
 * GitHub and GitHub Enterprise
 * GitLab Cloud and GitLab Server
 * Bitbucket Cloud (hosted) and Bitbucket Data Center (hybrid)
 {% endif %}

 <br>
 Create a custom OAuth2 Application for Codefresh in your GitHub account with the correct scopes, and set up authentication for the same within Codefresh. Users can then authorize access using OAuth2, instead of a personal access token.


 To set up OAuth2 authorization in Codefresh, you must:
 ### Step 1: Create a custom OAuth2 Application in Git
 Create and register an OAuth App under your organization to authorize Codefresh.

 1. Follow the step-by-step instructions for your Git provider:

    * [GitHub](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app){:target="\_blank"}:
      * For **Authorization callback URL**, enter this value:
       `<ingressHost>/app-proxy/api/git-auth/github/callback`
       where:
       `<ingressHost>` is the IP address or URL of the ingress host in the Runtime cluster as defined in your `values.yaml`. <br>For
       tunnel-based access modes, run the command `codefresh runtime list` to retrieve the correct host.
      * Make sure **Enable Device Flow** is _not_ selected.
      * Select **Register application**.
       The client ID is automatically generated, and you are prompted to generate the client secret.
      * Select **Generate a new client secret**, and copy the generated secret.

    {% if page.collection != site.gitops_collection %}
    * [GitLab Cloud and Server](https://docs.gitlab.com/ee/integration/oauth_provider.html#user-owned-applications){:target="\_blank"}:
      * For **Redirect URI**, enter this value:
      `<ingressHost>/app-proxy/api/git-auth/gitlab/callback`
        where:
        `<ingressHost>` is the IP address or URL of the ingress host in the runtime cluster.

    * [Bitbucket Data Center](https://confluence.atlassian.com/adminjiraserver0902/configure-an-outgoing-link-1168853925.html){:target="\_blank"}:
      * For **Callback URL**, enter this value:
      `<ingressHost>/app-proxy/api/git-auth/bitbucket-server/callback`
        where:
        `<ingressHost>` is the IP address or URL of the ingress host in the runtime cluster.

    >**NOTE**
      OAuth2 is not supported for hybrid runtimes with Bitbucket Cloud as the Git provider. Users can authorize access with their [Git personal access tokens]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#authorize-git-access-in-codefresh) in such cases.
    {% endif %}
 {:start="1"}
 1. For [GitHub](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app){:target="\_blank"}, do the following:
    * For **Authorization callback URL**, enter this value:
      `<ingressHost>/app-proxy/api/git-auth/github/callback`
      where:
      `<ingressHost>` is the IP address or URL of the ingress host in the Runtime cluster as defined in your `values.yaml`. <br>
      For tunnel-based access modes, run the command `codefresh runtime list` to retrieve the correct host.
    * Make sure **Enable Device Flow** is _not_ selected.
    * Select **Register application**.<br>
      The client ID is automatically generated, and you are prompted to generate the client secret.
    * Select **Generate a new client secret**, and copy the generated secret.

 {:start="2"}
 1. Note down the following, as you will need them to create the K8s secret for the Git OAuth2 application:
  * GitHub: Application ID from the URL, Client ID, and the client secret
  * GitLab Cloud and Server: Application ID and Secret
  * Bitbucket Data Center: Key and Secret

 1. Note down the following, as you will need them to create the K8s secret for the Git OAuth2 application:<br>
  * Application ID from the URL, Client ID, and the client secret

 <br>


 ### Step 2: Create a K8s secret resource in the runtime cluster
 Create a K8s secret in theruntime cluster, using the example below as a guideline. You must define the application ID (`appId`), client ID (`clientId`) and the client secret (`clientSecret`) from the OAuth2 Application you created in yourGit provider, and the Git URL (`url`).
 Create a K8s secret in theRuntime cluster, using the example below as a guideline. You must define the application ID (`appId`), client ID (`clientId`) and the client secret (`clientSecret`) from the OAuth2 Application you created in yourGitHub account, and the Git URL (`url`).

 >**NOTE**
  All fields in the secret _must be_ encoded in `base64`.
 ##### Before you begin

 Make sure you have the following handy:
 * GitHub: Application ID from the URL, Client ID, and the client secret
 {% if page.collection != site.gitops_collection %}
 * GitLab Cloud and Server: Application ID and Secret
 * Bitbucket Data Center: Key and Secret
 {% endif %}
 * Application ID from the URL, Client ID, and the client secret


 ##### How to

     If you have managed clusters registered to the selected Runtime, the authentication account is available to all the clusters.
    {{site.data.callout.end}}

  The settings pageis opened in **Form** mode.
  The settings pageopens in **Form** mode.

 {% include
   image.html
   max-width="50%"
   %}

 {:start="4"}
 {:start="5"}
 1. Configure the settings for the **Git OAuth2 Application**, either in **Form** or in **YAML** modes:
  * **Secret Name**: The name of the K8s secret file you created in the runtime cluster.
  * **Secret Namespace**: The namespace in the runtime cluster where you created the K8s secret.
  * **Client Secret**: The `key` representing the client secret in the K8s secret. For example, `clientSecret`.
  * **URL**: The `key` representing the Git provider URL in the K8s secret. For example, `url`.

 {:start="5"}
 {:start="6"}
 1. Click **Commit**.
  The Commit Changes panel shows a summary of the settings and the final version of the YAML manifest in read-only mode.

   max-width="50%"
   %}

 {:start="6"}
 {:start="7"}
 1. From the **Select Git Source** list, select the Git Source in which to store the manifest for the `ConfigMap` you are creating.
  The list displays all the Git Sources created for the selected runtime.
 1. Optional. Enter a commit message.
diff --git a/_docs/administration/user-self-management/manage-pats.md b/_docs/administration/user-self-management/manage-pats.md
 1. Copy the user access token generated as you will need it to authorize access.


 <!--- commenting this out as these providers are not currently supported in Enterprise

 {% if page.collection != site.gitops_collection %}
 ## Generate GitLab user access tokens
 1. Log in to your GitLab Cloud or Server account.
 1. Copy the user access token generated as you will need it to authorize access.
 {% endif %}

 -->

 ## Related articles
 [Git tokens in Codefresh]({{site.baseurl}}/docs/security/git-tokens/)
diff --git a/images/authentication/authentication-list.png b/images/authentication/authentication-list.png
Original file line number	Diff line number	Diff line change
Expand Up		@@ -136,7 +136,7 @@ As an administrator, you can optionally define session timeouts to automatically
		## Related articles
		[Single sign-on]({{site.baseurl}}/docs/administration/single-sign-on/)
		[Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/)
		[Setting up OAuth authentication for Git providers]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup)
		{% if page.collection != site.gitops_collection %}
		[Setting up OAuth authentication for Git providers]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup)
		[Configuring access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/)
		{% endif %}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -28,5 +28,7 @@ caption="Authorize Codefresh organizations in GitHub"
		max-width="70%"
		%}

		{% if page.collection != site.gitops_collection %}
		## Related articles
		[Setting up OAuth2 for GitOps]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup/)
		{% endif %}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -7,12 +7,11 @@ toc: true
		---

		## OAuth2 authentication for GitOps
		Codefresh integrates with the Git provider defined for the GitOps Runtime to sync repositories to your clusters, implementing Git-based operations when creating resources such as applications, and enriching images with valuable information.
		Codefresh integrates withGitHub Cloud asthe Git provider defined for the GitOps Runtime to sync repositories to your clusters, implementing Git-based operations when creating resources such as applications, and enriching images with valuable information.

		As the account administrator, you can select the authentication method for the account associated with the Runtime.
		Users in the account can then authorize access to the Git provider through the defined mechanism.
		Users in the account can then authorize access toGitHub asthe Git provider through the defined mechanism.

		{% if page.collection != site.gitops_collection %}
		{% include
		image.html
		lightbox="true"
Expand All		@@ -26,30 +25,15 @@ Users in the account can then authorize access to the Git provider through the d
		Codefresh supports OAuth2 or personal access tokens (PATs) for authentication:

		* OAuth2 with Codefresh OAuth Application or custom OAuth2 Application
		OAuth2 is the preferred authentication mechanism, supported forpopular Git providers such asGitHub, GitHub Enterprise, GitLab Cloud and Server, and Bitbucket Cloud and Server.
		OAuth2 is the preferred authentication mechanism, supported for GitHub.
		You have the option to use the default predefined Codefresh OAuth Application, or a custom Oauth2 Application for Codefresh in your Git provider account.

		To use a custom Oauth2 Application for Codefresh, first create the application in yourGit provider account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>
		To use a custom Oauth2 Application for Codefresh, first create the application in yourGitHub account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>
		See [Create a custom OAuth2 Application for Git provider](#create-a-custom-oauth2-application-for-git-provider) in this article.

		* Token-based authentication using PAT
		With token-based authentication, users must generate personal access tokensfrom theirGit providers with the required scopes and enter their personal access tokens when prompted to authorize access.<br>
		With token-based authentication, users must generate personal access tokensfor theirGitHub accounts with the required scopes and enter their personal access tokens when prompted to authorize access.<br>
		See [Authorize Git access in Codefresh]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#git-provider-private-access).
		{% endif %}

		{% if page.collection == site.gitops_collection %}
		Codefresh supports OAuth2 or personal access tokens (PATs) for authentication:

		* OAuth2 with Codefresh OAuth Application or custom OAuth2 Application
		OAuth2 is the preferred authentication mechanism for GitHub. You have the option to use the default predefined Codefresh OAuth Application, or a custom Oauth2 Application for Codefresh in your Git provider account.

		To use a custom Oauth2 Application for Codefresh, first create the application in your Git provider account, then create a secret on your K8s cluster, and finally configure OAuth2 access for the custom application in Authentication > Settings. <br>
		See [Create a custom OAuth2 Application for Git provider](#create-a-custom-oauth2-application-for-git-provider) in this article.

		* Token-based authentication using PAT
		With token-based authentication, users must generate personal access tokens with the required scopes in their GitHub accounts, and enter their personal access tokens when prompted to authorize access.<br>
		See [Authorize Git access in Codefresh]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#git-provider-private-access).
		{% endif %}


		## Authentication for Git providers and Runtime accounts
Expand All		@@ -72,16 +56,7 @@ As the account administrator, you can change the authentication method for a Git


		## Create a custom OAuth2 Application for Git provider
		Create a custom OAuth2 Application for Codefresh in your Git provider account with the correct scopes, and set up authentication for the same within Codefresh. Users can then authorize access to the Git provider using OAuth2, instead of a personal access token.

		{% if page.collection != site.gitops_collection %}
		Supported Git providers:
		* GitHub and GitHub Enterprise
		* GitLab Cloud and GitLab Server
		* Bitbucket Cloud (hosted) and Bitbucket Data Center (hybrid)
		{% endif %}

		<br>
		Create a custom OAuth2 Application for Codefresh in your GitHub account with the correct scopes, and set up authentication for the same within Codefresh. Users can then authorize access using OAuth2, instead of a personal access token.


		To set up OAuth2 authorization in Codefresh, you must:
Expand All		@@ -94,48 +69,27 @@ To set up OAuth2 authorization in Codefresh, you must:
		### Step 1: Create a custom OAuth2 Application in Git
		Create and register an OAuth App under your organization to authorize Codefresh.

		1. Follow the step-by-step instructions for your Git provider:

		* [GitHub](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app){:target="\_blank"}:
		* For Authorization callback URL, enter this value:
		`<ingressHost>/app-proxy/api/git-auth/github/callback`
		where:
		`<ingressHost>` is the IP address or URL of the ingress host in the Runtime cluster as defined in your `values.yaml`. <br>For
		tunnel-based access modes, run the command `codefresh runtime list` to retrieve the correct host.
		* Make sure Enable Device Flow is _not_ selected.
		* Select Register application.
		The client ID is automatically generated, and you are prompted to generate the client secret.
		* Select Generate a new client secret, and copy the generated secret.

		{% if page.collection != site.gitops_collection %}
		* [GitLab Cloud and Server](https://docs.gitlab.com/ee/integration/oauth_provider.html#user-owned-applications){:target="\_blank"}:
		* For Redirect URI, enter this value:
		`<ingressHost>/app-proxy/api/git-auth/gitlab/callback`
		where:
		`<ingressHost>` is the IP address or URL of the ingress host in the runtime cluster.

		* [Bitbucket Data Center](https://confluence.atlassian.com/adminjiraserver0902/configure-an-outgoing-link-1168853925.html){:target="\_blank"}:
		* For Callback URL, enter this value:
		`<ingressHost>/app-proxy/api/git-auth/bitbucket-server/callback`
		where:
		`<ingressHost>` is the IP address or URL of the ingress host in the runtime cluster.

		>NOTE
		OAuth2 is not supported for hybrid runtimes with Bitbucket Cloud as the Git provider. Users can authorize access with their [Git personal access tokens]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#authorize-git-access-in-codefresh) in such cases.
		{% endif %}
		{:start="1"}
		1. For [GitHub](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app){:target="\_blank"}, do the following:
		* For Authorization callback URL, enter this value:
		`<ingressHost>/app-proxy/api/git-auth/github/callback`
		where:
		`<ingressHost>` is the IP address or URL of the ingress host in the Runtime cluster as defined in your `values.yaml`. <br>
		For tunnel-based access modes, run the command `codefresh runtime list` to retrieve the correct host.
		* Make sure Enable Device Flow is _not_ selected.
		* Select Register application.<br>
		The client ID is automatically generated, and you are prompted to generate the client secret.
		* Select Generate a new client secret, and copy the generated secret.

		{:start="2"}
		1. Note down the following, as you will need them to create the K8s secret for the Git OAuth2 application:
		* GitHub: Application ID from the URL, Client ID, and the client secret
		* GitLab Cloud and Server: Application ID and Secret
		* Bitbucket Data Center: Key and Secret

		1. Note down the following, as you will need them to create the K8s secret for the Git OAuth2 application:<br>
		* Application ID from the URL, Client ID, and the client secret

		<br>


		### Step 2: Create a K8s secret resource in the runtime cluster
		Create a K8s secret in theruntime cluster, using the example below as a guideline. You must define the application ID (`appId`), client ID (`clientId`) and the client secret (`clientSecret`) from the OAuth2 Application you created in yourGit provider, and the Git URL (`url`).
		Create a K8s secret in theRuntime cluster, using the example below as a guideline. You must define the application ID (`appId`), client ID (`clientId`) and the client secret (`clientSecret`) from the OAuth2 Application you created in yourGitHub account, and the Git URL (`url`).

		>NOTE
		All fields in the secret _must be_ encoded in `base64`.
Expand All		@@ -145,11 +99,8 @@ Create a K8s secret in the runtime cluster, using the example below as a guideli
		##### Before you begin

		Make sure you have the following handy:
		* GitHub: Application ID from the URL, Client ID, and the client secret
		{% if page.collection != site.gitops_collection %}
		* GitLab Cloud and Server: Application ID and Secret
		* Bitbucket Data Center: Key and Secret
		{% endif %}
		* Application ID from the URL, Client ID, and the client secret


		##### How to

Expand DownExpand Up		@@ -199,7 +150,7 @@ The values for all the settings in the ConfigMap are the `keys` in the secret fi
		If you have managed clusters registered to the selected Runtime, the authentication account is available to all the clusters.
		{{site.data.callout.end}}

		The settings pageis opened in Form mode.
		The settings pageopens in Form mode.

		{% include
		image.html
Expand All		@@ -211,7 +162,7 @@ The values for all the settings in the ConfigMap are the `keys` in the secret fi
		max-width="50%"
		%}

		{:start="4"}
		{:start="5"}
		1. Configure the settings for the Git OAuth2 Application, either in Form or in YAML modes:
		* Secret Name: The name of the K8s secret file you created in the runtime cluster.
		* Secret Namespace: The namespace in the runtime cluster where you created the K8s secret.
Expand All		@@ -220,7 +171,7 @@ The values for all the settings in the ConfigMap are the `keys` in the secret fi
		* Client Secret: The `key` representing the client secret in the K8s secret. For example, `clientSecret`.
		* URL: The `key` representing the Git provider URL in the K8s secret. For example, `url`.

		{:start="5"}
		{:start="6"}
		1. Click Commit.
		The Commit Changes panel shows a summary of the settings and the final version of the YAML manifest in read-only mode.

Expand All		@@ -234,7 +185,7 @@ The values for all the settings in the ConfigMap are the `keys` in the secret fi
		max-width="50%"
		%}

		{:start="6"}
		{:start="7"}
		1. From the Select Git Source list, select the Git Source in which to store the manifest for the `ConfigMap` you are creating.
		The list displays all the Git Sources created for the selected runtime.
		1. Optional. Enter a commit message.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -171,6 +171,8 @@ max-width="70%"
		1. Copy the user access token generated as you will need it to authorize access.


		<!--- commenting this out as these providers are not currently supported in Enterprise

		{% if page.collection != site.gitops_collection %}
		## Generate GitLab user access tokens
		1. Log in to your GitLab Cloud or Server account.
Expand DownExpand Up		@@ -216,5 +218,7 @@ max-width="70%"
		1. Copy the user access token generated as you will need it to authorize access.
		{% endif %}

		-->

		## Related articles
		[Git tokens in Codefresh]({{site.baseurl}}/docs/security/git-tokens/)