Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit13f0a0e

Browse files
committed
Add documentation for licensing and group sync
- Improve directions and clarity for enabling group sync- Introduce new licensing guide for setting up premium featuresChanges:- Detailed steps and examples added for configuring OIDC claims- New `licensing.md` guide presents ways to add a license via UI and CLI- Introduced new enterprise SVG icon for better visual representationThese updates aim to enhance the user experience and provide clear, actionable instructions.
1 parent0d76ed0 commit13f0a0e

File tree

5 files changed

+95
-24
lines changed

5 files changed

+95
-24
lines changed

‎docs/admin/auth.md

Lines changed: 44 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
#Authentication
22

3-
![OIDC with Coder Sequence Diagram](../images/oidc-sequence-diagram.svg).
4-
53
By default, Coder is accessible via password authentication. Coder does not
64
recommend using password authentication in production, and recommends using an
75
authentication provider with properly configured multi-factor authentication
@@ -252,33 +250,47 @@ CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
252250
##Group Sync (enterprise) (premium)
253251

254252
If your OpenID Connect provider supports group claims, you can configure Coder
255-
to synchronize groups in your auth provider to groups within Coder.
253+
to synchronize groups in your auth provider to groups within Coder. To enable
254+
group sync, ensure that the`groups` claim is being sent by your OpenID
255+
provider. This may involve requesting an additional
256+
[scope](../reference/cli/server.md#--oidc-scopes) or additional configuration on
257+
the OpenID provider side.
256258

257-
To enable group sync, ensure that the`groups` claim is set by adding the
258-
correct scope to request. If group sync is enabled, the user's groups will be
259-
controlled by the OIDC provider. This means manual group additions/removals will
260-
be overwritten on the next login.
259+
If group sync is enabled, the user's groups will be controlled by the OIDC
260+
provider. This means manual group additions/removals will be overwritten on the
261+
next user login.
261262

262-
```env
263-
# as an environment variable
264-
CODER_OIDC_SCOPES=openid,profile,email,groups
265-
```
263+
There are two ways you can configure group sync:
266264

267-
```shell
268-
# as a flag
269-
--oidc-scopes openid,profile,email,groups
265+
<divclass="tabs">
266+
267+
##Server Flags
268+
269+
First, confirm that your OIDC provider is sending the`groups` claim by logging
270+
in with OIDC and visiting the following URL:
271+
272+
```text
273+
https://[coder.example.com]/api/v2/debug/[your-username]/debug-link
270274
```
271275

272-
With the`groups` scope requested, we also need to map the`groups` claim name.
273-
Coder recommends using`groups` for the claim name. This step is necessary if
274-
your**scope's name** is something other than`groups`.
276+
You should see a field, followed by a list of the user's OIDC groups in the
277+
response. This is the
278+
[claim](https://openid.net/specs/openid-connect-core-1_0.html#Claims) sent by
279+
the OIDC provider. See[Troubleshooting](#troubleshooting-grouprole-sync) to
280+
debug this.
275281

276-
```env
282+
>Depending on the OIDC provider, this claim may be named differently. Common
283+
>ones include`groups`,`memberOf`, and`roles`.
284+
285+
Next configure the Coder server to read groups from the claim name with the
286+
[OIDC group field](../reference/cli/server.md#--oidc-group-field) server flag:
287+
288+
```sh
277289
# as an environment variable
278290
CODER_OIDC_GROUP_FIELD=groups
279291
```
280292

281-
```shell
293+
```sh
282294
# as a flag
283295
--oidc-group-field groups
284296
```
@@ -288,14 +300,16 @@ names in Coder and removed from groups that the user no longer belongs to.
288300

289301
For cases when an OIDC provider only returns group IDs ([Azure AD][azure-gids])
290302
or you want to have different group names in Coder than in your OIDC provider,
291-
you can configure mapping between the two.
303+
you can configure mapping between the two with the
304+
[OIDC group mapping](../reference/cli/server.md#--oidc-group-mapping) server
305+
flag.
292306

293-
```env
307+
```sh
294308
# as an environment variable
295309
CODER_OIDC_GROUP_MAPPING='{"myOIDCGroupID": "myCoderGroupName"}'
296310
```
297311

298-
```shell
312+
```sh
299313
# as a flag
300314
--oidc-group-mapping'{"myOIDCGroupID": "myCoderGroupName"}'
301315
```
@@ -313,11 +327,17 @@ coder:
313327
From the example above, users that belong to the`myOIDCGroupID` group in your
314328
OIDC provider will be added to the `myCoderGroupName` group in Coder.
315329

316-
> **Note:** Groups are only updated on login.
317-
318330
[azure-gids]:
319331
https://github.com/MicrosoftDocs/azure-docs/issues/59766#issuecomment-664387195
320332

333+
## Runtime (Organizations)
334+
335+
For deployments with multiple [organizations](./organizations.md), you can must
336+
configure group sync at the organization level. In future Coder versions, you
337+
will be able to configure this in the UI. For now, you can use CLI commands.
338+
339+
</div>
340+
321341
### Group allowlist
322342

323343
You can limit which groups from your identity provider can log in to Coder with

‎docs/images/add-license-ui.png

151 KB
Loading

‎docs/images/icons/enterprise.svg

Lines changed: 3 additions & 0 deletions
Loading

‎docs/licensing.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#Licensing
2+
3+
Coder is free to use and includes some features that are only accessible with a
4+
paid license. See our[pricing page](https://coder.com/pricing) for a
5+
distinction.
6+
7+
To try Premium features, you can[request a trial](https://coder.com/trial) or
8+
[contact sales](https://coder.com/contact).
9+
10+
##Adding your license key
11+
12+
There are two ways to add an enterprise license to a Coder deployment:
13+
14+
<divclass="tabs">
15+
16+
###Coder UI
17+
18+
First, ensure you have a license key
19+
([request a trial](https://coder.com/trial)).
20+
21+
With an`Owner` account, navigate to`Deployment -> Licenses`,`Add a license`
22+
then drag or select the license file with the`jwt` extension.
23+
24+
![Add License UI](./images/add-license-ui.png)
25+
26+
###Coder CLI
27+
28+
First, ensure you have a license key
29+
([request a trial](https://coder.com/trial)) and the
30+
[Coder CLI](./install/index.md) installed.
31+
32+
1. Save your license key to disk and make note of the path
33+
2. Open a terminal
34+
3. Ensure you are logged into your Coder deployment
35+
36+
`coder login <access url>`
37+
38+
4. Run
39+
40+
`coder licenses add -f <path to your license key>`
41+
42+
</div>

‎docs/manifest.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -562,6 +562,12 @@
562562
}
563563
]
564564
},
565+
{
566+
"title":"Licensing",
567+
"description":"Learn how to enable Premium features",
568+
"path":"./licensing.md",
569+
"icon_path":"./images/icons/enterprise.svg"
570+
},
565571
{
566572
"title":"Contributing",
567573
"description":"Learn how to contribute to Coder",

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp