mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-09 23:55:12 +00:00
docs: introduce versioned docs and migrate to fuma (#11166)
## Todos for release - [x] Configure Env in docs project on vercel - [x] Configure Root Path in the docs project on vercel - [ ] Remove old CSP https://github.com/zitadel/website/pull/1592 ## What we did This pull request migrates the project documentation from the old `docs/` directory to the new `apps/docs/` directory, introduces a new documentation system built with Next.js and Fumadocs, and updates all relevant references, configuration files, and documentation to reflect this change. It also adds new configuration and ignore files for the new documentation app, updates CI and linting to exclude the new docs from certain checks, and revises the contributing guidelines accordingly. **Documentation System Migration and New Docs App** * Migrated all documentation from `docs/` to `apps/docs/`, and updated all references in `README.md`, `CONTRIBUTING.md`, and other files to point to the new location. [[1]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L585-L640) [[2]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L660-R607) [[3]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L740-R687) [[4]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L2-R3) [[5]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L30-R30) * Added a new Next.js/Fumadocs-based documentation app under `apps/docs/`, including core app files, layouts, routing, search API, and a comprehensive `README.md` with development and contribution instructions. [[1]](diffhunk://#diff-5a1b07344a2c1b4d3f37b23ff1388b62cd9f57dea3c1cd23d8a0412b7602b132R1-R74) [[2]](diffhunk://#diff-462b9ad1eabbb7d1c29bb9c36e4931eb180fd7190900e6d2babf8f4d66ad1c28R1-R39) [[3]](diffhunk://#diff-e16ae25660ded787b10ac35dea96d5ecaacf895dae0afc8a9bd4382dc79a8c87R1-R7) [apps/docs/app/[[...slug]]/layout.tsxR1-R81](diffhunk://#diff-59e08acde4e805b7aeccef1dcf98f1d71dfc550777e6b9402085cee0e9fa4e0aR1-R81), [apps/docs/app/[[...slug]]/page.tsxR1-R79](diffhunk://#diff-e5df3f80d0fa01e12d63d81f29c57a9d14e846c78fd3beabb2ef768e38fd9580R1-R79), [[4]](diffhunk://#diff-389b34918e040cacaa87cd7201ffa462cc2b0b716736f537e3d3c660ac69353bR1-R7) [[5]](diffhunk://#diff-d3b03416d1c457b19f1c27b26f2db741412df841b875c26ccadc36e4522247f4R1-R29) [[6]](diffhunk://#diff-c8fb8339570a5305809be7c618e14705fd86390dc278e6ce8ba224a7bc8b0c3cR1-R25) **Configuration and Tooling Updates** * Updated `.github/workflows/codeql.yml`, `.golangci.yaml`, and `.github/dependabot.yml` to properly handle the new docs app: excluded `apps/docs` from certain checks, added npm dependency updates for the docs app, and excluded generated content. [[1]](diffhunk://#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27L8-R14) [[2]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R5-R6) [[3]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R126-R129) [[4]](diffhunk://#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28R89-R106) * Updated `.devcontainer/devcontainer.json` to use the latest Go 1.25.3 version for consistency. **Licensing and Miscellaneous** * Added `apps/docs/` to the list of licensed directories in `LICENSING.md`. These changes ensure the documentation is now maintained in a modern, scalable system and all project tooling is updated to support the new structure. --------- Co-authored-by: Federico Coppede <[email protected]>
This commit is contained in:
Florian Forster
co-authored by
Federico Coppede
Federico Coppede
parent
7b6395c348
commit
d8ea041c56
@@ -0,0 +1,97 @@
|
||||
---
|
||||
title: Log in with ZITADEL on Atlassian through SAML 2.0
|
||||
sidebar_label: Atlassian
|
||||
---
|
||||
|
||||
This guide shows how to enable login with ZITADEL on Atlassian.
|
||||
|
||||
It covers how to:
|
||||
|
||||
- create and configure the application in your project
|
||||
- create and configure the connection in Atlassian Access
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- existing ZITADEL Instance, if not present follow [this guide](/guides/start/quickstart)
|
||||
- existing ZITADEL Organization, if not present follow [this guide](/guides/manage/console/organizations-overview)
|
||||
- existing ZITADEL project, if not present follow the first 3 steps [here](/guides/manage/console/projects-overview)
|
||||
- existing Atlassian Access setup, including verified domain
|
||||
|
||||
> We have to switch between ZITADEL and Atlassian. If the headings begin with "ZITADEL" switch to the ZITADEL
|
||||
> Management Console and
|
||||
> if the headings start with "Atlassian" please switch to the Atlassian Admin GUI.
|
||||
|
||||
## **Atlassian**: Create a new external identity provider
|
||||
|
||||
Please follow the instructions on [Atlassian's support page](https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/) to configure a SAML identity provider for SSO.
|
||||
The following instructions give you a quick overview of the most important steps.
|
||||
|
||||
Login to Atlassian's security center and select Identity providers.
|
||||
Select the option to Set up SAML single sign-on.
|
||||
|
||||
|
||||
For Identity Provider select "Other provider" and enter a Directory Name.
|
||||
|
||||
|
||||
Follow the wizard.
|
||||
Fill in the following information:
|
||||
|
||||
- `Identity provider Entity ID`: \{your_instance_domain}/saml/v2/metadata
|
||||
- `Identity provider SSO URL`: \{your_instance_domain}/saml/v2/SSO
|
||||
- `Public x509 certificate`: You need to download and paste the value of the certificate from \{your_instance_domain}/saml/v2/certificate
|
||||
|
||||
|
||||
|
||||
Create a new .xml file with the following minimal SAML metadata contents:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0"?>
|
||||
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${ENTITYID}">
|
||||
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol">
|
||||
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${ACSURL}" index="0"/>
|
||||
</md:SPSSODescriptor>
|
||||
</md:EntityDescriptor>
|
||||
```
|
||||
|
||||
Set or replace the variables with the values from the next screen as follows:
|
||||
|
||||
- `${ENTITYID}`: Copy the value from "Service provider entity URL"
|
||||
- `${ACSURL}`: Copy the value from "Service provider assertion consumer service URL"
|
||||
|
||||
|
||||
|
||||
## **ZITADEL**: Create the application
|
||||
|
||||
In your existing project:
|
||||
|
||||
Press the "+"-button to add an application
|
||||
|
||||
|
||||
Fill in a name for the application and chose the SAML type, then click "Continue".
|
||||
|
||||
|
||||
Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "Continue".
|
||||
|
||||
|
||||
Check your application, if everything is correct, press "Create".
|
||||
|
||||
|
||||
## **Atlassian**: Setup authentication policies
|
||||
|
||||
Under Authentication policies, select "Edit" on the directory that you have created.
|
||||
Then check the box "Enforce single sign-on" and confirm by clicking "Update".
|
||||
|
||||
|
||||
Add members to your policy.
|
||||
|
||||
|
||||
## Verify configuration
|
||||
|
||||
Now you should be all set to verify your setup:
|
||||
|
||||
- Create an user in ZITADEL with the same email address as a member in your authentication policy.
|
||||
- In a new browser session go to https://id.atlassian.com
|
||||
- Enter the user's email address
|
||||
- You should be redirected to ZITADEL's Login screen
|
||||
- Enter the email address and password
|
||||
- Continue and you should be redirected back to Atlassian
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
title: Log in with ZITADEL on Auth0 through OIDC
|
||||
sidebar_label: Auth0 (OIDC)
|
||||
---
|
||||
|
||||
import CreateApp from "../application/_application.mdx";
|
||||
|
||||
This guide shows how to enable login with ZITADEL on Auth0.
|
||||
|
||||
It covers how to:
|
||||
|
||||
- create and configure the application in your project
|
||||
- create and configure the connection in your Auth0 tenant
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- existing ZITADEL Instance, if not present follow [this guide](/guides/start/quickstart)
|
||||
- existing ZITADEL Organization, if not present follow [this guide](/guides/manage/console/organizations-overview)
|
||||
- existing ZITADEL project, if not present follow the first 3 steps [here](/guides/manage/console/projects-overview)
|
||||
- existing Auth0 tenant as described [here](https://auth0.com/docs/get-started/auth0-overview/create-tenants)
|
||||
|
||||
> We have to switch between ZITADEL and a Auth0. If the headings begin with "ZITADEL" switch to the ZITADEL Management Console and if the headings start with "Auth0" please switch to the Auth0 GUI.
|
||||
|
||||
## **Auth0**: Create a new connection
|
||||
|
||||
In Authentication > Enterprise
|
||||
|
||||
1. Press the "+" button right to "OpenID Connect"
|
||||
|
||||
2. Set a connection name for example "ZITADEL"
|
||||
3. The issuer url is `https://${CUSTOM_DOMAIN}/.well-known/openid-configuration`
|
||||
4. Copy the callback URL (ending with `/login/callback`)
|
||||
|
||||
The configuration should look like this:
|
||||
|
||||
|
||||
|
||||
Next we have to switch to the ZITADEL Management Console.
|
||||
|
||||
## **ZITADEL**: Create the application
|
||||
|
||||
First of all we create the application in your project.
|
||||
|
||||
<CreateApp components={props.components} appType="web" authType="code" appName="Auth0" redirectURI="https://<TENANT>.<REGION>.auth0.com/login/callback"/>
|
||||
|
||||
## **Auth0**: Connect ZITADEL
|
||||
|
||||
1. Copy the client id from ZITADEL and past it into the **Client ID** field
|
||||
2. Copy the client secret from ZITADEL and past it into the **Client Secret** field
|
||||
|
||||
3. click Create
|
||||
4. To verify the connection go to the "Applications" tab and enable the Default App
|
||||
|
||||
5. Click "Back to OpenID Connect"
|
||||
6. Click on the "..." button right to the newly created connection and click "Try"
|
||||
|
||||
7. ZITADEL should open on a new tab and you can enter your login information
|
||||
8. After you logged in you should see the following:
|
||||
|
||||
@@ -0,0 +1,79 @@
|
||||
---
|
||||
title: Log in with ZITADEL on Auth0 through SAML 2.0
|
||||
sidebar_label: Auth0 (SAML)
|
||||
---
|
||||
|
||||
This guide shows how to enable login with ZITADEL on Auth0.
|
||||
|
||||
It covers how to:
|
||||
|
||||
- create and configure the application in your project
|
||||
- create and configure the connection in your Auth0 tenant
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- existing ZITADEL Instance, if not present follow [this guide](/guides/start/quickstart)
|
||||
- existing ZITADEL Organization, if not present follow [this guide](/guides/manage/console/organizations-overview)
|
||||
- existing ZITADEL project, if not present follow the first 3 steps [here](/guides/manage/console/projects-overview)
|
||||
- existing Auth0 tenant as described [here](https://auth0.com/docs/get-started/auth0-overview/create-tenants)
|
||||
|
||||
> We have to switch between ZITADEL and a Auth0. If the headings begin with "ZITADEL" switch to the ZITADEL Management Console and
|
||||
> if the headings start with "Auth0" please switch to the Auth0 GUI.
|
||||
|
||||
## **Auth0**: Create a new connection
|
||||
|
||||
In Authentication -> Enterprise
|
||||
|
||||
|
||||
1. Press the "+" button right to "SAML"
|
||||
|
||||
2. Fill out the fields as follows in the SAML Connection:
|
||||
|
||||
|
||||
This includes:
|
||||
|
||||
- a unique "Connection name"
|
||||
- the "Sign In URL"
|
||||
- the "Sign Out URL"
|
||||
- used "User ID Attribute"
|
||||
- the definition how the request should be signed
|
||||
- which binding should be used to call ZITADEL
|
||||
|
||||
All the information is filled out as an example, and to connect with any other environment you only have to change the
|
||||
used domain, for example "example.com" with "zitadel.cloud".
|
||||
Lastly, upload the certificate used to sign the responses, provided for you under the
|
||||
URL \{your_instance_domain}/saml/v2/certificate.
|
||||
|
||||
Then just press the button "Create" and the connection on Auth0 is configured.
|
||||
|
||||
## **ZITADEL**: Create the application
|
||||
|
||||
You need to upload the SAML metadata to ZITADEL for it to recognize this newly created connection.
|
||||
[Under this link](https://auth0.com/docs/authenticate/protocols/saml/saml-identity-provider-configuration-settings) are
|
||||
all necessary information to correctly fill out the metadata or download the metadata-file directly under the
|
||||
URL https://YOUR_AUTH0_DOMAIN/samlp/metadata?connection=YOUR_CONNECTION_NAME, which in this example would
|
||||
be https://example.auth0.com/samlp/metadata?connection=SAML-ZITADEL.
|
||||
|
||||
In your existing project:
|
||||
|
||||
1. Press the "+"-button to add an application
|
||||
|
||||
2. Fill in a name for the application and chose the SAML type, then click "Continue".
|
||||
|
||||
3. Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "
|
||||
Continue".
|
||||
|
||||
4. Check your application, if everything is correct, press "Create".
|
||||
|
||||
|
||||
Everything on the side of ZITADEL is done if the application is correctly created.
|
||||
|
||||
## **Auth0**: Try the connection
|
||||
|
||||
To then test the connection you only have to press "Try" on the created connection in the Authentication -> Enterprise
|
||||
screen.
|
||||
|
||||
|
||||
|
||||
To further customize the requests you can also customize the SAML communication as
|
||||
described [here](https://auth0.com/docs/authenticate/protocols/saml/saml-configuration/customize-saml-assertions)
|
||||
@@ -0,0 +1,79 @@
|
||||
---
|
||||
title: Log in with ZITADEL on AWS through SAML 2.0
|
||||
sidebar_label: Amazon Web Services
|
||||
---
|
||||
|
||||
This guide shows how to enable login with ZITADEL on AWS SSO.
|
||||
|
||||
It covers how to:
|
||||
|
||||
- create and configure the application in your project
|
||||
- create and configure the connection in your AWS SSO external IDP
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- existing ZITADEL Instance, if not present follow [this guide](/guides/start/quickstart)
|
||||
- existing ZITADEL Organization, if not present follow [this guide](/guides/manage/console/organizations-overview)
|
||||
- existing ZITADEL project, if not present follow the first 3 steps [here](/guides/manage/console/projects-overview)
|
||||
- prerequisites on AWS side [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/prereqs.html).
|
||||
- enabled AWS SSO [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/step1.html?icmpid=docs_sso_console)
|
||||
|
||||
> We have to switch between ZITADEL and a AWS. If the headings begin with "ZITADEL" switch to the ZITADEL Management Console and if
|
||||
> the headings start with "AWS" please switch to the AWS GUI.
|
||||
|
||||
## **AWS**: Change to external identity provider ZITADEL
|
||||
|
||||
As you have activated SSO you still have the possibility to use AWS itself to manage the users, but you can also use a
|
||||
Microsoft AD or an external IDP.
|
||||
|
||||
Described [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html) how you
|
||||
can connect to ZITADEL as a SAML2 IDP.
|
||||
|
||||
1. Chose the External identity provider:
|
||||
|
||||
|
||||
2. Download the metadata file, to provide ZITADEL with all the information it needs, and save the AWS SSO Sign-in URL,
|
||||
which you use to login afterwards.
|
||||
|
||||
3. Fill out the fields as follows, to provide AWS with all the information it needs:
|
||||
|
||||
|
||||
To connect to another environment, change the domains, for example if you would use ZITADEL under the url "
|
||||
https://example.com" you would have the URLs "https://example.com/saml/v2/SSO"
|
||||
and "https://example.com/saml/v2/metadata".
|
||||
|
||||
4. Download the ZITADEL-used certificate to sign the responses, so that AWS can validation the signature.
|
||||
|
||||
You can download the certificate from following
|
||||
URL: `${CUSTOM_DOMAIN}/saml/v2/certificate`
|
||||
|
||||
5. Then upload the ".crt"-file to AWS and click "next".
|
||||
|
||||
6. Lastly, accept to confirm the change and ZITADEL is used as the external identity provider for AWS SSO to provide
|
||||
connectivity to your AWS Accounts.
|
||||
|
||||
As for how the SSO users are then connected to the AWS accounts, you can find more information in the AWS documentation,
|
||||
for example [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/useraccess.html).
|
||||
|
||||
## **ZITADEL**: Create the application
|
||||
|
||||
The metadata used in this part is from "Change to external identity provider ZITADEL" step 2.
|
||||
|
||||
In your existing project:
|
||||
|
||||
1. Press the "+"-button to add an application
|
||||
|
||||
2. Fill in a name for the application and chose the SAML type, then click "Continue".
|
||||
|
||||
3. Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "
|
||||
Continue".
|
||||
|
||||
4. Check your application, if everything is correct, press "Create".
|
||||
|
||||
|
||||
Everything on the side of ZITADEL is done if the application is correctly created.
|
||||
|
||||
## **AWS**: Test the connection
|
||||
|
||||
The result, you can now login to you AWS account through your ZITADEL-login with the AWS SSO Sign-in URL, which you
|
||||
should have saved in "Change to external identity provider ZITADEL" step 2.
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
title: Configure ZITADEL as an OIDC Identity Provider on Cloudflare Zero Trust
|
||||
sidebar_label: Cloudflare Zero Trust
|
||||
---
|
||||
|
||||
import CreateApp from "../application/_application.mdx";
|
||||
|
||||
This guide shows how to configure ZITADEL as OpenID Connect identity provider for Cloudflare Zero Trust.
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Existing ZITADEL instance, organization, and project. Follow our [get started](/guides/start/quickstart) guide to get started. If not present follow [this guide](/guides/start/quickstart)
|
||||
- Existing Cloudflare account and [team domain](https://developers.cloudflare.com/cloudflare-one/glossary/#team-domain)
|
||||
|
||||
## Create the client in ZITADEL
|
||||
|
||||
<CreateApp components={props.components} appType="web" authType="code" appName="Cloudflare" redirectURI="https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback"/>
|
||||
|
||||
## Send user info in tokens
|
||||
|
||||
Make sure to enable "User Info inside ID Token" on your application settings.
|
||||
|
||||
|
||||
|
||||
<Callout>
|
||||
Cloudflare will return an error "User email was not returned. API permissions are likely incorrect". Enable to send the user information inside the token on your client settings.
|
||||
</Callout>
|
||||
|
||||
## Configure Cloudflare Zero Trust Authentication
|
||||
|
||||
1. On the Cloudflare dashboard go to Zero Trust, click settings, and then select "Authentication"
|
||||
2. Add a new login method with the type "OpenID Connect"
|
||||
3. Fill in the required information. Check the discovery endpoint of your instance `https://${CUSTOM_DOMAIN}/.well-known/openid-configuration` for the urls. As mentioned in the Cloudflare docs the Certificate Url is jwks_uri.
|
||||
4. Disable PKCE (Cloudflare requires a client secret for PKCE, which is currently not supported)
|
||||
5. Add the following claims: "openid", "profile", "email"
|
||||
6. Test the connection
|
||||
|
||||
### Example configuration
|
||||
|
||||
```json
|
||||
{
|
||||
"config": {
|
||||
"client_id": "<your client id>",
|
||||
"client_secret": "<your client secret>",
|
||||
"auth_url": "https://${CUSTOM_DOMAIN}.zitadel.cloud/oauth/v2/authorize",
|
||||
"token_url": "https://${CUSTOM_DOMAIN}.zitadel.cloud/oauth/v2/token",
|
||||
"certs_url": "https://${CUSTOM_DOMAIN}.zitadel.cloud/oauth/v2/keys",
|
||||
"scopes": ["openid", "email", "profile"],
|
||||
"pkce_enabled": false,
|
||||
},
|
||||
"type": "oidc",
|
||||
"name": "Generic Google"
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,68 @@
|
||||
---
|
||||
title: Log in with ZITADEL on Gitlab through SAML 2.0
|
||||
sidebar_label: Gitlab
|
||||
---
|
||||
|
||||
This guide shows how to enable login with ZITADEL on Gitlab.
|
||||
|
||||
It covers how to:
|
||||
|
||||
- create and configure the application in your project
|
||||
- create and configure the connection in Gitlab SaaS
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- existing ZITADEL Instance, if not present follow [this guide](/guides/start/quickstart)
|
||||
- existing ZITADEL Organization, if not present follow [this guide](/guides/manage/console/organizations-overview)
|
||||
- existing ZITADEL project, if not present follow the first 3 steps [here](/guides/manage/console/projects-overview)
|
||||
- existing Gitlab SaaS Setup in the premium tier
|
||||
|
||||
> We have to switch between ZITADEL and Gitlab. If the headings begin with "ZITADEL" switch to the ZITADEL
|
||||
> Management Console and
|
||||
> if the headings start with "Gitlab" please switch to the Gitlab GUI.
|
||||
|
||||
## **Gitlab**: Create a new external identity provider
|
||||
|
||||
Please follow the instructions on [Gitlab docs](https://docs.gitlab.com/ee/user/group/saml_sso/index.html) to configure a SAML identity provider for SSO.
|
||||
The following instructions give you a quick overview of the most important steps.
|
||||
|
||||
[Open the group](https://gitlab.com/dashboard/groups) to which you want to add the SSO configuration.
|
||||
Select on the menu Settings and then SAML SSO.
|
||||
Copy `GitLab metadata URL` for the next step.
|
||||
|
||||
|
||||
## **ZITADEL**: Create the application
|
||||
|
||||
In your existing project:
|
||||
|
||||
Press the "+"-button to add an application
|
||||
|
||||
|
||||
Fill in a name for the application and chose the SAML type, then click "Continue".
|
||||
|
||||
|
||||
Enter the URL from before, then click "Continue".
|
||||
|
||||
|
||||
Check your application, if everything is correct, press "Create".
|
||||
|
||||
|
||||
## **Gitlab**: Configuration
|
||||
|
||||
Complete the configuration as follows:
|
||||
|
||||
- `Identity provider single sign-on URL`: `${CUSTOM_DOMAIN}/saml/v2/SSO`
|
||||
- `Certificate fingerprint`: You need to download the certificate from \{your_instance_domain}/saml/v2/certificate and create a SHA1 fingerprint
|
||||
|
||||
Save the changes.
|
||||
|
||||
|
||||
|
||||
## **Gitlab**: Verify SAML configuration
|
||||
|
||||
Once you saved the changes, click on the button "Verify SAML configuration".
|
||||
|
||||
You should be redirected to ZITADEL.
|
||||
Login with your user.
|
||||
After that you should be redirected back to GitLab and you can inspect the Response Output.
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
---
|
||||
title: Log in with ZITADEL on Gitlab OmniAuth Provider
|
||||
---
|
||||
|
||||
import CreateApp from "../application/_application.mdx";
|
||||
|
||||
This guide shows how to enable login with ZITADEL on self-hosted Gitlab instances.
|
||||
|
||||
It covers how to:
|
||||
|
||||
- create and configure the application in your ZITADEL project
|
||||
- create and configure the connection in a self-hosted Gitlab instance
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- existing ZITADEL Instance, if not present follow [this guide](/guides/start/quickstart)
|
||||
- existing ZITADEL Organization, if not present follow [this guide](/guides/manage/console/organizations-overview)
|
||||
- existing ZITADEL project, if not present follow the first 3 steps [here](/guides/manage/console/projects-overview)
|
||||
- running Gitlab instance see [installation guide](https://docs.gitlab.com/ee/install/)
|
||||
|
||||
<CreateApp components={props.components} appType="web" authType="code" appName="Gitlab" redirectURI="https://<your_gitlab_url>/users/auth/openid_connect/callback"/>
|
||||
|
||||
## Gitlab configuration
|
||||
|
||||
Follow [this guide](https://docs.gitlab.com/ee/administration/auth/oidc.html) of gitlab to configure the omniauth provider. Following is an example configuration with redacted secrets.
|
||||
|
||||
Replace the values of the following fields:
|
||||
|
||||
- `args.client_options.identifier` with the `ClientId` generated by ZITADEL in the last step of [Create application in ZITADEL])()
|
||||
- `args.client_options.secret` with the `ClientSecret` generated by ZITADEL in the last step of [Create application in ZITADEL])()
|
||||
- `args.client_options.redirect_uri` with the proper URL to your gitlab instance and callback
|
||||
|
||||
```yaml
|
||||
gitlab_rails['omniauth_providers'] = [
|
||||
{
|
||||
name: "openid_connect",
|
||||
label: "ZITADEL",
|
||||
icon: "https://${CUSTOM_DOMAIN}/ui/console/assets/icons/favicon-32x32.png",
|
||||
args: {
|
||||
name: "openid_connect",
|
||||
scope: ["openid","profile","email"],
|
||||
response_type: "code",
|
||||
issuer: "https://${CUSTOM_DOMAIN}",
|
||||
discovery: true,
|
||||
client_options: {
|
||||
identifier: "<CLIENT ID from ZITADEL>",
|
||||
secret: "<CLIENT SECRET from ZITADEL>",
|
||||
redirect_uri: "https://<YOUR_GITLAB_URL>/users/auth/openid_connect/callback"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
```
|
||||
@@ -0,0 +1,130 @@
|
||||
---
|
||||
title: Log in with ZITADEL on Google Cloud with Workforce Identity Federation (OIDC)
|
||||
sidebar_label: Google Cloud
|
||||
---
|
||||
|
||||
import CreateApp from "../application/_application.mdx";
|
||||
|
||||
This guide shows how to login users and assign roles with [Workforce Identity Federation to Google Cloud](https://cloud.google.com/iam/docs/workforce-identity-federation).
|
||||
|
||||
It covers how to:
|
||||
|
||||
- create and configure your application in ZITADEL
|
||||
- configure an Action to transform claims
|
||||
- create and configure the connection to Google Cloud with Workforce Identity Federation using OpenID Connect (OIDC)
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- existing ZITADEL Instance, if not present follow [this guide](/guides/start/quickstart)
|
||||
- existing ZITADEL Organization, if not present follow [this guide](/guides/manage/console/organizations-overview)
|
||||
- existing ZITADEL project, if not present follow the first 3 steps [here](/guides/manage/console/projects-overview)
|
||||
- prerequisites on Google Cloud side [in the configuration guide](https://cloud.google.com/iam/docs/configuring-workforce-identity-federation).
|
||||
|
||||
> We have to switch between ZITADEL and a Google Cloud. If the headings begin with "ZITADEL" switch to the ZITADEL Management Console and if
|
||||
> the headings start with "Google Cloud" please refer to the configuration guide on Google Cloud.
|
||||
|
||||
## **Google Cloud**: Configure
|
||||
|
||||
Follow the steps **Before you begin**, **Required roles**, and **create a workforce identity pool** (OIDC) in the [in the configuration guide](https://cloud.google.com/iam/docs/configuring-workforce-identity-federation).
|
||||
|
||||
Before you create the workforce identity pool provider you should create your application in ZITADEL.
|
||||
|
||||
## **ZITADEL**: Create the application
|
||||
|
||||
In your existing project:
|
||||
|
||||
First of all we create the application in your project.
|
||||
|
||||
<Callout>
|
||||
Google Cloud requires just an ID Token as JWT including the [described required and optional scopes](https://cloud.google.com/iam/docs/workforce-identity-federation#attribute-mappings).
|
||||
</Callout>
|
||||
|
||||
Create a new application and click on "I'm a pro. Skip this wizard."
|
||||
|
||||
- **Application Type**: Web
|
||||
- **Grant Types**: Implicit
|
||||
- **Response Type**: ID Token
|
||||
- **Authentication Method**: None
|
||||
|
||||
<Callout>
|
||||
You need to add the redirect URL and configure token settings after creating the application.
|
||||
</Callout>
|
||||
|
||||
|
||||
|
||||
## **ZITADEL**: Redirect url
|
||||
|
||||
|
||||
|
||||
After creating, go to the application settings "Redirect settings" and add the redirect url from Googles configuration guide.
|
||||
It looks something like `https://auth.cloud.google/signin-callback/locations/global/workforcePools/WORKFORCE_POOL_ID/providers/WORKFORCE_PROVIDER_ID`.
|
||||
|
||||
Save the settings.
|
||||
|
||||
<Callout type="warn">
|
||||
Make sure to replace the `WORKFORCE_POOL_ID` and `WORKFORCE_PROVIDER_ID` with your values in the redirect url
|
||||
</Callout>
|
||||
|
||||
## **ZITADEL**: Token settings
|
||||
|
||||
|
||||
|
||||
After creating, go to the application settings "Token settings" and configure as follows:
|
||||
|
||||
- **Auth Token Type**: JWT
|
||||
- **Add user roles to the access token**: disabled (optional)
|
||||
- **User roles inside ID Token**: enabled
|
||||
- **User Info inside ID Token**: enabled
|
||||
|
||||
Save the settings.
|
||||
|
||||
## **ZITADEL**: Custom claims
|
||||
|
||||
Go to your project and create roles according to the Groups in Google Cloud.
|
||||
Authorize a test user by assigning roles in ZITADEL.
|
||||
|
||||
Google Cloud expects some claims, including groups, in a specific format as [described here](https://cloud.google.com/iam/docs/workforce-identity-federation#attribute-mappings).
|
||||
Claims can be transformed in ZITADEL with [Actions](/guides/manage/console/actions-overview).
|
||||
|
||||
Create an Action with the following code to flatten the roles and include the claim for the users' display name.
|
||||
|
||||
<Callout>
|
||||
If you want to configure a special attribute mapping in the workforce identity pool provider, then adjust the claims accordingly.
|
||||
</Callout>
|
||||
|
||||
```javascript
|
||||
function googleGroups(ctx, api) {
|
||||
if (ctx.v1.user.grants == undefined || ctx.v1.user.grants.count == 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
let grants = [];
|
||||
ctx.v1.user.grants.grants.forEach(claim => {
|
||||
claim.roles.forEach(role => {
|
||||
grants.push(claim.projectId+':'+role)
|
||||
})
|
||||
})
|
||||
|
||||
api.v1.claims.setClaim('google.groups', grants)
|
||||
api.v1.claims.setClaim('google.display_name', ctx.v1.getUser().human.displayName)
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
<Callout type="warn">
|
||||
Make sure that the name of the action matches the name of the function.
|
||||
</Callout>
|
||||
|
||||
And add the the Action Script to the following Flow and Trigger:
|
||||
|
||||
- **Flow Type**: Complement Token
|
||||
- **Trigger Type**: Pre access token creation
|
||||
- **Actions**: googleGroups
|
||||
|
||||
|
||||
|
||||
## **Google Cloud**: Create a WIP provider
|
||||
|
||||
Complete the steps in the [in the configuration guide](https://cloud.google.com/iam/docs/configuring-workforce-identity-federation) with the `ISSUER_URI` and `CLIENT_ID` from ZITADEL.
|
||||
@@ -0,0 +1,211 @@
|
||||
---
|
||||
title: Google Workspace SSO with ZITADEL
|
||||
sidebar_label: Google Workspace
|
||||
---
|
||||
|
||||
This guide shows how to enable login with ZITADEL on Google Workspace.
|
||||
|
||||
You can configure two types of SAML SSO on Google Workspace:
|
||||
|
||||
- [SSO profile for your organization](#sso-profile-for-your-organization)
|
||||
- [Third-party SSO SAML profile](#third-party-sso-saml-profile)
|
||||
|
||||
Both profiles need to be configured differently.
|
||||
Please make sure to configure your application for the correct type.
|
||||
Please refer to Google Help to [Set up SSO for your organization](https://support.google.com/a/answer/12032922) in case you need additional information on the Workspace setup.
|
||||
|
||||
<Callout title="OpenID Connect">
|
||||
At this time Google supports SSO with OpenID Connect only for few providers.
|
||||
</Callout>
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- You need to have a domain registered with your Google Workspace account to configure SSO profiles
|
||||
- Make sure that you [verify the same domain also in your ZITADEL organization and set it as primary domain](/guides/manage/console/organizations-overview#primary-domain)
|
||||
- A user in Google Workspace (eg, [email protected])
|
||||
- A user in ZITADEL with the same username (eg, [email protected]); make sure you verify the domain to set the username. This is different than the user's email address
|
||||
|
||||
## SSO profile for your organization
|
||||
|
||||
### Configure SSO profile on Google Workspace
|
||||
|
||||
Open the Google settings for [SSO with third-party IdP](https://admin.google.com/u/1/ac/security/sso) and click on *ADD SSO PROFILE*.
|
||||
|
||||
|
||||
|
||||
Download the public certificate from your ZITADEL instance by requesting `${CUSTOM_DOMAIN}/saml/v2/certificate`
|
||||
|
||||
```bash
|
||||
wget ${CUSTOM_DOMAIN}/saml/v2/certificate -O idp.crt
|
||||
```
|
||||
|
||||
Always replace `${CUSTOM_DOMAIN}` with your Custom Domain.
|
||||
|
||||
Use the following configuration
|
||||
|
||||
| Setting | Value |
|
||||
| --- | --- |
|
||||
| Set up SSO with third-party identity provider | Enable (check) |
|
||||
| Sign-in page URL | `${CUSTOM_DOMAIN}`/saml/v2/SSO |
|
||||
| Sign-out page URL | `${CUSTOM_DOMAIN}`/saml/v2/SLO |
|
||||
| Verification Certificate | Upload the certificate (idp.crt) |
|
||||
| Use a domain-specific issuer | Enable (check) |
|
||||
| Network masks | Leave blank|
|
||||
| Change password URL | `${CUSTOM_DOMAIN}`/ui/console/users/me?id=security |
|
||||
|
||||
### Create a SAML application in ZITADEL
|
||||
|
||||
Create a new .xml file with the following minimal SAML metadata contents:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0"?>
|
||||
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${ENTITYID}">
|
||||
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol">
|
||||
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${ACSURL}" index="0"/>
|
||||
</md:SPSSODescriptor>
|
||||
</md:EntityDescriptor>
|
||||
```
|
||||
|
||||
Set or replace the variables with the values from the next screen as follows:
|
||||
|
||||
- `${ENTITYID}`: `google.com/a/<your_domain>`
|
||||
- `${ACSURL}`: `https://www.google.com/a/<your_domain>/acs`
|
||||
|
||||
`<your_domain>` is the domain you have verified in Google Workspace.
|
||||
|
||||
In your existing project:
|
||||
|
||||
Press the "+"-button to add an application
|
||||
|
||||
|
||||
Fill in a name for the application and chose the SAML type, then click "Continue".
|
||||
|
||||
|
||||
Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "Continue".
|
||||
|
||||
|
||||
Check your application, if everything is correct, press "Create".
|
||||
|
||||
|
||||
### Activate the SSO profile for your organization
|
||||
|
||||
Make sure to enable the SSO profile for your organization.
|
||||
|
||||
In the [domain-specific service URLs](https://admin.google.com/u/1/ac/security/sso/domain-specific-service-urls) settings select "Automatically redirect users to the third-party IdP in the following SSO profile" and select as SSO profile "SSO profile for your organization".
|
||||
|
||||
|
||||
|
||||
Save the settings.
|
||||
|
||||
|
||||
|
||||
### Verify the SSO profile for your organization
|
||||
|
||||
Now you should be all set to verify your setup:
|
||||
|
||||
- Open Gmail in an incognito session with the following link: `https://mail.google.com/a/<your_domain>`
|
||||
- Enter your username and credentials
|
||||
- You should be redirected to Gmail and logged in
|
||||
|
||||
`<your_domain>` is the domain you have verified in Google Workspace.
|
||||
|
||||
## Third-party SSO SAML profile
|
||||
|
||||
Configure a third party SSO SAML profile and login users with ZITADEL to Google Workspace.
|
||||
|
||||
### Add SAML profile on Google Workspace
|
||||
|
||||
Open the Google settings for [SSO with third-party IdP](https://admin.google.com/u/1/ac/security/sso) and click on *ADD SAML PROFILE*.
|
||||
|
||||
|
||||
|
||||
Download the public certificate from your ZITADEL instance by requesting `${CUSTOM_DOMAIN}/saml/v2/certificate`
|
||||
|
||||
```bash
|
||||
wget ${CUSTOM_DOMAIN}/saml/v2/certificate -O idp.crt
|
||||
```
|
||||
|
||||
Always replace `${CUSTOM_DOMAIN}` with your Custom Domain.
|
||||
|
||||
Use the following configuration
|
||||
|
||||
| Setting | Value |
|
||||
|--------------------------|----------------------------------------------------|
|
||||
| SSO profile name | ZITADEL SSO |
|
||||
| IDP entity ID | `${CUSTOM_DOMAIN}`/saml/v2/metadata |
|
||||
| Sign-in page URL | `${CUSTOM_DOMAIN}`/saml/v2/SSO |
|
||||
| Sign-out page URL | `${CUSTOM_DOMAIN}`/saml/v2/SLO |
|
||||
| Change password URL | `${CUSTOM_DOMAIN}`/ui/console/users/me?id=security |
|
||||
| Verification Certificate | Upload the certificate (idp.crt) |
|
||||
|
||||
Now go ahead and click *SAVE*
|
||||
|
||||
### Entity ID and ACS URL
|
||||
|
||||
Open the Google settings for [SSO with third-party IdP](https://admin.google.com/u/1/ac/security/sso) and click on the SAML Profile *ZITADEL SSO*
|
||||
|
||||
|
||||
|
||||
You can copy the "Entity ID" and "ACS URL" from the "SP details" section.
|
||||
|
||||
|
||||
|
||||
### Create a SAML application in ZITADEL
|
||||
|
||||
Create a new .xml file with the following minimal SAML metadata contents:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0"?>
|
||||
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${ENTITYID}">
|
||||
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol">
|
||||
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${ACSURL}" index="0"/>
|
||||
</md:SPSSODescriptor>
|
||||
</md:EntityDescriptor>
|
||||
```
|
||||
|
||||
Set or replace the variables with the values from the next screen as follows:
|
||||
|
||||
- `${ENTITYID}`: `https://accounts.google.com/samlrp/metadata?rpid=<your_value>`
|
||||
- `${ACSURL}`: `https://accounts.google.com/samlrp/acs?rpid=<your_value>`
|
||||
|
||||
Replace `<your_value>` with the values from the [SSO profile](#entity-id-and-acs-url).
|
||||
|
||||
In your existing project:
|
||||
|
||||
Press the "+"-button to add an application
|
||||
|
||||
|
||||
Fill in a name for the application and chose the SAML type, then click "Continue".
|
||||
|
||||
|
||||
Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "Continue".
|
||||
|
||||
|
||||
Check your application, if everything is correct, press "Create".
|
||||
|
||||
|
||||
### Activate the SSO profile
|
||||
|
||||
Make sure to enable the SSO profile.
|
||||
|
||||
In the [domain-specific service URLs](https://admin.google.com/u/1/ac/security/sso/domain-specific-service-urls) settings select "Automatically redirect users to the third-party IdP in the following SSO profile" and select as SSO profile "ZITADEL SSO".
|
||||
|
||||
|
||||
|
||||
Save the settings.
|
||||
|
||||
|
||||
|
||||
### Verify the SAML SSO profile
|
||||
|
||||
Now you should be all set to verify your setup:
|
||||
|
||||
- Open Gmail in an incognito session with the following link: `https://mail.google.com/a/<your_domain>`
|
||||
- Enter your username and credentials
|
||||
- You should be redirected to Gmail and logged in
|
||||
|
||||
`<your_domain>` is the domain you have verified in Google Workspace.
|
||||
|
||||
### Troubleshooting
|
||||
|
||||
Make sure you don't use a super admin account in Google Workspace to test SSO. Super Admin users are not allowed to login with SSO and you might receive an status code 500.
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
title: "Integrate ZITADEL with your Favorite Services"
|
||||
description: "With the guides in this section you will learn how to integrate ZITADEL with your services."
|
||||
---
|
||||
|
||||
{/* THIS FILE IS AUTO-GENERATED FROM SIDEBAR-DATA.
|
||||
ANY MANUAL CHANGES WILL BE OVERWRITTEN.
|
||||
*/}
|
||||
|
||||
import { Card, Cards } from 'fumadocs-ui/components/card';
|
||||
import { FileText, Folder, Link as LinkIcon } from 'lucide-react';
|
||||
|
||||
<Cards>
|
||||
<Card title="Google Workspace" href="/guides/integrate/services/google-workspace" icon={<FileText />} />
|
||||
<Card title="Aws Saml" href="/guides/integrate/services/aws-saml" icon={<FileText />} />
|
||||
<Card title="Atlassian Saml" href="/guides/integrate/services/atlassian-saml" icon={<FileText />} />
|
||||
<Card title="Pingidentity Saml" href="/guides/integrate/services/pingidentity-saml" icon={<FileText />} />
|
||||
<Card title="Google Cloud" href="/guides/integrate/services/google-cloud" icon={<FileText />} />
|
||||
<Card title="Cloudflare Oidc" href="/guides/integrate/services/cloudflare-oidc" icon={<FileText />} />
|
||||
<Card title="Gitlab Saml" href="/guides/integrate/services/gitlab-saml" icon={<FileText />} />
|
||||
<Card title="Auth0 Saml" href="/guides/integrate/services/auth0-saml" icon={<FileText />} />
|
||||
<Card title="Auth0 Oidc" href="/guides/integrate/services/auth0-oidc" icon={<FileText />} />
|
||||
<Card title="Gitlab Self Hosted" href="/guides/integrate/services/gitlab-self-hosted" icon={<FileText />} />
|
||||
<Card title="Bold BI" href="https://support.boldbi.com/kb/article/13708/how-to-configure-zitadel-oauth-login-in-bold-bi" icon={<LinkIcon />} external />
|
||||
<Card title="Cloudflare Workers" href="https://zitadel.com/blog/increase-spa-security-with-cloudflare-workers" icon={<LinkIcon />} external />
|
||||
<Card title="Firezone" href="https://www.firezone.dev/docs/authenticate/oidc/zitadel" icon={<LinkIcon />} external />
|
||||
<Card title="Netbird" href="https://docs.netbird.io/selfhosted/identity-providers" icon={<LinkIcon />} external />
|
||||
<Card title="Nextcloud" href="https://zitadel.com/blog/zitadel-as-sso-provider-for-selfhosting" icon={<LinkIcon />} external />
|
||||
<Card title="Psono" href="https://doc.psono.com/admin/configuration/oidc-zitadel.html" icon={<LinkIcon />} external />
|
||||
<Card title="Zoho Desk" href="https://help.zoho.com/portal/en/kb/desk/user-management-and-security/data-security/articles/setting-up-saml-single-signon-for-help-center#Zitadel_IDP" icon={<LinkIcon />} external />
|
||||
</Cards>
|
||||
@@ -0,0 +1,85 @@
|
||||
---
|
||||
title: Log in with ZITADEL on Ping Identity through SAML 2.0
|
||||
sidebar_label: Ping Identity
|
||||
---
|
||||
|
||||
This guide shows how to enable login with ZITADEL on Ping Identity.
|
||||
|
||||
It covers how to:
|
||||
|
||||
- create and configure the application in your project
|
||||
- create and configure the connection in your Ping Identity tenant
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- existing ZITADEL Instance, if not present follow [this guide](/guides/start/quickstart)
|
||||
- existing ZITADEL Organization, if not present follow [this guide](/guides/manage/console/organizations-overview)
|
||||
- existing ZITADEL project, if not present follow the first 3 steps [here](/guides/manage/console/projects-overview)
|
||||
- existing Pingidentity environment [here](https://docs.pingidentity.com/bundle/pingone/page/wqe1564020490538.html)
|
||||
|
||||
> We have to switch between ZITADEL and Ping Identity. If the headings begin with "ZITADEL" switch to the ZITADEL
|
||||
> Management Console and
|
||||
> if the headings start with "Ping" please switch to the PingIdentity GUI.
|
||||
|
||||
## **Ping**: Create a new external identity provider
|
||||
|
||||
To add an
|
||||
additional [external identity provider](https://docs.pingidentity.com/bundle/pingone/page/jvz1567784210191.html), you
|
||||
can follow the instructions [here](https://docs.pingidentity.com/bundle/pingone/page/ovy1567784211297.html)
|
||||
|
||||
1. As described you have to create a new provider, with a unique identifier:
|
||||
|
||||
|
||||
We recommend activating signing the auth request whenever possible:
|
||||
|
||||
|
||||
2. Manually enter the necessary information:
|
||||
|
||||
- SSO Endpoint, for example https://accounts.example.com/saml/SSO
|
||||
- IDP EntityID, for example https://accounts.example.com/saml/metadata
|
||||
- Binding, which is a decision which you can take yourself, we recommend HTTP POST as it has fewer restrictions
|
||||
- Import certificate, provided from the certificate endpoint
|
||||
|
||||
|
||||
Everything you need to know about the attribute mapping you can find
|
||||
in [Ping Identity's documentation](https://docs.pingidentity.com/bundle/pingone/page/pwv1567784207915.html)
|
||||
|
||||
3. With this you have defined to connection to ZITADEL as an external IDP, next is the policy to use ZITADEL as an IDP
|
||||
to
|
||||
connect to an application. The "How to" for that can be
|
||||
found [here](https://docs.pingidentity.com/bundle/pingone/page/zqd1616600404402.html).
|
||||
|
||||
## **ZITADEL**: Create the application
|
||||
|
||||
To add the connection to ZITADEL you have to build the metadata, which should minimalistic look like this, the necessary
|
||||
information can be found on the External IDPs page under "P1Connection" and "IDP Configuration" :
|
||||
|
||||
```xml
|
||||
ENTITYID="PINGONE (SP) ENTITY ID"
|
||||
ACSURL="ACS ENDPOINT"
|
||||
<?xml version="1.0"?>
|
||||
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${ENTITYID}">
|
||||
<md:SPSSODescriptor
|
||||
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol">
|
||||
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${ACSURL}"
|
||||
index="0"/>
|
||||
</md:SPSSODescriptor>
|
||||
</md:EntityDescriptor>
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
In your existing project:
|
||||
|
||||
1. Press the "+"-button to add an application
|
||||
|
||||
2. Fill in a name for the application and chose the SAML type, then click "Continue".
|
||||
|
||||
3. Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "
|
||||
Continue".
|
||||
|
||||
4. Check your application, if everything is correct, press "Create".
|
||||
|
||||
|
||||
Everything on the side of ZITADEL is done if the application is correctly created.
|
||||
Reference in New Issue
Block a user