From 6c44067e2ba50f9b67fabe0763ce7fb6eda3b27e Mon Sep 17 00:00:00 2001 From: Owen Date: Thu, 22 Jan 2026 18:19:16 -0800 Subject: [PATCH] Continuing to update docs for 1.15.0 --- docs.json | 1 + images/cf_websocket_box.png | Bin 0 -> 28802 bytes manage/identity-providers/add-an-idp.mdx | 24 +- .../identity-providers/auto-provisioning.mdx | 4 +- manage/identity-providers/azure.mdx | 8 +- manage/identity-providers/google.mdx | 4 + self-host/advanced/cloudflare-proxy.mdx | 8 + self-host/advanced/config-file.mdx | 12 + self-host/advanced/container-cli-tool.mdx | 37 ++++ self-host/advanced/private-config-file.mdx | 206 ++++++++++++++++++ 10 files changed, 296 insertions(+), 8 deletions(-) create mode 100644 images/cf_websocket_box.png create mode 100644 self-host/advanced/private-config-file.mdx diff --git a/docs.json b/docs.json index fa97afd..142bea3 100644 --- a/docs.json +++ b/docs.json @@ -151,6 +151,7 @@ "group": "Advanced Configuration", "pages": [ "self-host/advanced/config-file", + "self-host/advanced/private-config-file", "self-host/advanced/wild-card-domains", "self-host/advanced/cloudflare-proxy", "self-host/advanced/without-tunneling", diff --git a/images/cf_websocket_box.png b/images/cf_websocket_box.png new file mode 100644 index 0000000000000000000000000000000000000000..8d8653b63c277e5272a7e32290dd5abc0c1d04d1 GIT binary patch literal 28802 zcmeEuRal(K)-Di8u;3D$;E=|h;KAM9-66O;!QGwU?(XgqtZ@q#TpO3uGqd-T~({9R;{Wf@2U=!lM#Inj|&e00r6g3Oh^F&0$K|Ed<**){QmAs4-xnS z(m_E~5TbGt{{Z|&$XHF>L|Phx2K)>Q0U2x#0sTi6@Cz6Gf`E9F0}1g4{0aHTZ#hu^ zE`^rLdGqgQh}%CZy1%8~hJfIQ5El|qa)mrzd+(_<-$DPRD~uzZ3PIsZ7J{QAk&qQi z6+lI5A)@i79$F)k3Q{KBPA1Z=lJddT(7oMnXm)s45Qzu!B;Kx_criueqdVLMeh4As zVnPm!8$8mkF-aV8%Awg5XB&71ydVB&8zQ96BFZ=>^1!eCR1StaLK@NNEq@1E>1|3i-Ud~}*T z)^Vx2^0$h9r*J~cecF{FzT&qbscFCU1?J>+CBz$wj-#>Fe_(3}KUj`Ps%O=V|3PNm zRlzI24l+Ldtyf5Rp&T$#)J5}hrhi!Bj!$5bK6_wt`3IsTU`dOIJ!Vl!{e7%{>zI1o z`7U0mpZ|dl&2cpnmqG*1ZgEWf&B_n@w<3}4WQVyv}c9$QzLvsMc!NQ8vr^0NFgS&F~-RuW2;bMM7LZ!$9r z)_3 zzDR}va+0qx?J{o%l-E4*0L&e! zsSSFJo)!gJ31$)xP1td_A$6r1`i)RFP>=fObKJL3Vjd()GO|~36Q6I#HxKFPNImxf zJT18FDL*-1jg{88ZF0)4R#x?Ifb!s)e@pRd5;4QISbssj?Q~_MkOv1j?i1 zL&BYY6GliHKJAmSI^69c*mL_7V+$=w*F4?agu7d?TfDvkdkfPMbwS-iHL66aL*iN| zExNqQaxxVAq31+z{(tW*;-6sMd*P_A-Z6GX^ENb|)|(*J1mr`+JV>`K<=Gfqv3?ur z(Kwu+xxU7vXvH)rWF1-TZt~WIH!YHUEQ$DWIyL1X+_44LFjV?oT$m-m4#e9C3==lW<-#%ebkcw+_5PG zUrPtAbx}rf97q#h(vrSUDc^VR@;5#2Sp?0|+y84aKvQmG$1Of4#L@88DAgtp$QC=G zm0n6-oO{wlEDvOyW=Eh<=T_961ohwWt<`Ulv=7MwgcrV3pFv0mC@>@uUgw=xWd4 zH1G1t^}B2}8RnSoCy`SC9)L0HK`he%jVwe#&Tj&y#5+&E9h5xH#whZv>~$(G+Jn~# zy7;tuC8BFc&d#Z0IkexVN;-=UsNq!)3-fne?66K~?N`&&mGcc#b;x0#RpcYp$+c%a z%n{B~kUO`az9hP~4d_E+rHpm1n*SW5{rvT)6I4SkJ4C$DE`G$H97v9q@{lr0RgcqjH)^j`Ulfq+ zn2w@5p!o|Mj1Q|NA`CH9VALP$M3Z-E1PV_j_LN}i3${l*P^Ek)x-EMR!kVkl^cRlv z9Nn9a4ua*bnOt!(U zg%*W2{}nBQTCSyX_K5NkG!eN>Qc_hKpkc+%{C?!C2Ax^Cnm?x^rC#rwC90L8sxRow zwCF8)JVlq-zp4IBl0UY#K-ucjG$2 zLNEN?U=Vy-InoEq=GKjIk;zdDmMoA`XLiI>ik|49;XRYP@#jX>a$%cV*-axytU^uD z7A}o%>^%b9;M`oUa~`+&{#U~ZbY?4LV{?Iwn};#dINh|!pig7+pAN46dtbohfNapx5!8&l(~g zTG=O+?)@aA%-3Z4QHQe&l+vE;C6k)ABZj|~3I%GB`brZl3F8%|Y1?R*x3mYeTYlYgao` zjG%+(pNr|Q9JDWydQt2mPx4`;TJR6ffbpHB=qthj{Q{1e+pULUsFjRdn^ z*|>HA0#)hnuetTLd*YxTrF`-8K{9KF3PR&KT?Js*CeCgycKE{pGoyaZzVv35{;d3+ zPz0}Vu`tw!tK^(fkJdMhHCe<_ZSOC-(6GC%R<2$4ILJnRW!2(#1$f(*S|Igg;*<7d ze&E2e{c;d-E7xX8xn5S;duY54^*p(S_xsLt`9scTyR2clEcF zDM&7La+GTf^+&w05B%aBhAKb9VZVRoP8Ct#OgVzfx=YMkALb&Me)+sc$$Po+@l4A! z62cd!#_$dDm{>%l<$1!B*$Ttw+N=@b2cBBz5NPz{S0!HzoJa-pInlu`mNVq>zR1R_ zEUy3qMu`rVnQRM@AzYZOvn%fyO0`^P5Ic+%=OJ=@>=}bPyK&{jzR*VUG=qnj*X=`x z_lY=$Obm>%;v6nD8cQps@}szqfJ%$7zc&V05X384vxu(JrgqzTxg7ar{`f-k;BnGry1Vxr znaLzWeh2*J-pBvb6>=5T}lb_b4*&Af7?mz&6r(7b7g)4j1htC zum*Ky>hQ|?h1BWy-;DD>Qm_}{t8jvZy~<=SFz7&RZc*Q9JE3DcOrEQ9*2 ze5(TCmyAtne(4c)^)SaXP9|wF@(QXi4g2!_jI&sIzXUq8V}kDrvFZ5Zu&!ed_&!V2 z522{qB)}LqkQhbAyvhgG>$|&spor#>sq16X@W-bA+^Uv^-qxanR;U#IYt@h}bXBW^EbBf0G z`+K9s2vb~yv}bfZ$CRVww-^{5q|v_;W3elwBhA7U^E7urFmUW2EWO3<3YOKnl`+i| zFT)Ewy&_d*$)SAivkhO&QQ2r~Jp38sZp!CI=5&Za*BQd=2h5P5&t|ck-U0&YMLKki$(ldK3=j@F2=Y9NMOjg zXFp_f1}=Aew?~$5zO9z+p#QjW(>VMk=XS0a6Kz2g@^2ALR8kakpTx)yYAOj(7|rES zu{YX-z9YsR+-e{GzVBPh#wtR_m}8)&CpUi;_Q57|qdyK49b}?*P)4%yYmuE0sG0LRsUxto z8PTEx=|n}u`ccBT@ipTk1-^09v~J@Rk9MDh{Bz-S_%0%U|ya2nXLVqV6Aka z0DB0Z8!G;)#%;l7F2N{f2Oevfs-)*sJ3W>NxUXUxVtrw9ysjPaQ&+3!z2W@dZJTr2 zKO)@FYZ<5fm$ac`88QA#S6mb!(qe)?X|eh(gAMd?=*@?IopBYOM)E|O9TP?OQ?soS zpd?iD#2}{6@ld^818*zLf~(pc0!_4{YelQ-sK49lVL*j5O%k zP6?${MZN4Kn5%E|b}sbsII`0<+#0gt*6-9A%vt2zesCm( z_2c;gJ3h;sA0PT{>``V5JT$Y-Rb==D9ci?44g%D|rDZu{QcVSn{l?l}CEWDGm;|1q zHSPS6c;6w^oOkwahSERk9B>}+U3VSB=w866@bc8HWZN!`2BoxKhS}nN68oQn9gIkf z(RHIz`0eD?=@GqaK9rPGS%978z}tHl@e`K2VA~@#H%>Joa>WRvFY08mys$^gYKn~9 z);jor_kktbmzsh3vgRhSVfcij?d@VU`lJfj3odBFw#|wZO0}7NvcXI z?U#Ao4o*mubhbpZtIwmxcx;_1;R*V@Lk-E=D=>vBXA^w$nPFLut|HHl^NlRlt;+Tp z86T1Xvr!WA*MYn>Bj7;InC?YAD04zBJ=tIGjn&hnyke|>20Be7@Rq4#v~u)yo6TBd zwo!UuSo$UwSV%I$Qms$D{<5eeAGV87P9Ro}yqD)1pB0_7ht1Z-t4P_OKMb3bW6pIo zeT%2!{{8!d1YeO}r9=~!MpwAyL9OH6!ZLd{uGM4S>;6EMU)q;i;MBzk6YYe{vYOh0 zs)tQfQTXl?RQ@A_r6}coj#y>*ZWn_{)>&E00OAKeeRDxj*^-^8ao=)9}m+C?fUQ^2+Mia=);lIO5-r%$N z?khx+=yA0eL{8;+&~j6T86$a5tTmk2{JiEAM&i4Q5MHgw%L*s6@OYo$WGlgGS1x)XnZ|91&h7rXAikDZd(0Hw_PU>REiTIC+u@f#AS|@12kg18b|DQ6uF-B_0SF zpBuZE$c)ui7L;qGYlfvA&@-w^nUo23zj>OFRBseTb$t@bt>Vg+f&Z^Oxu$=%PZONYIAWKk<2RLkuaKr7P}R!n0Qv~BX7!{+7I(U zdnI6l{#*bI)s?wrH;(%fxw>8d2yA-AZZR+Z`?3th3yUar;+%PUAzbUQg*&62mny_n z_dWXJa?HB#Z26cNq@oYHEA=H}D*4#hdhYcI%AXIX@e^T((97g@I->GTvjK@Ykr5QV zAC9xFZM)pjJ#_o~atqzb``vE>XH_3Kfx!#k z^)y(t&PG`sX>dbl?W-*cP+?d|p9iF=T;(bUx<;KoE-b}DIvZ8QHF{Jb*phSkpaMa= zKJLmBIEXF6g=;XLohJ^3ecs{XP|+3-@^>dzO&1Aypw!nno|W-|yNPmCGt0OV%b}?| z)!{3;V@s1>M}RjSCh6peQnRd)L}bPppSBz?(N$QD_`@>WFGPzbm7jS)&De_-EwV8d zL0hlq!j=O?#Q4*(fiT_mFlHi^+(rR|@c7yD^f>%`?*k)*?JM+$<+(8=7WlI4`j=$> zbZgkv&JB9J1(Loyotb5GQ4@V63ee||v+vS>tcp7{r~lm!k?>Wtf2w?g$3!`%n}|1h zUYj;*Uyb-V9bc?QoB={|s|9rXne;sJz6PJ0j8rKD4@>_v%>B9gY1iStY;4OFKy<^N zEeI+D+3`>u1q|bo6&EMA;j%LI)4uv96A#@jp+!(7Q1jRFj;Jwf+|K6$s!>il@X~Ks zNW7vjXLk!*RSwgc7*PxBWLn&+gs%{r<~-15YTh1^54DMkx1|}S#f}4~j~2fjKH&^| zD>@fTui3SyM(^m3V&tC;VvwP~WvLvjhq2^Vj2jozR{p5yw?}H}$eBcw7bjTWS%Jc- zXkT-Y=_5Es3A!6gqE)*x;mqK*Bw5V%((*^8RoJt#O_dBD(ZH}Z+WbygCs(V-iZYJm z45*^=e>P1G@u`!8A~{LFFG6d-CvrwyY$FWc@hl*aS-B*njrX0lsd2+|AflaPs^?Be zmgK`8CDaNjAdHia#@xC*-zn8<9HxmtbCmG_~&)ni3@!Bq%M&=ihp*7a5;Ov*#X zSMAUZAmXBeaf1ASySXQpJ=yt>MngCgZk^MEI>C;q( z06(uK6AWo_;l1G?*u6KaCzL2ar&CT+oolSsrhdgF9QC8d(a004i>d@mW=t2&2|LNm zeQx>6>EePDx-0lg1MiHtHQgRJQDM8Td_I3vBVUk+Ntb*_vY zr?>0@DaLn_u)oZ4;8?NEn8Oe+SGb!;svM?Sw>V=Z4>F`fJ-@c%nPMaGfB*X=KC^2crVy#n+V8 zE-P2Bk>X=N93EhvqRpMY`8g!J@M`c_jhO`evRErDVo5gah~_l;>!7-{b*^jm;DNfb z0))mNQ^L+CPw5H;c;`GSU0kkBVwq7dGO%TGVvfUxHN`=~P9QPZ-iYYN*4BHMh)vP~UQ$@5h8NEJAdi!3sc>fV8Q=|PJ~F1p*{WZ+-Bll;-= z5FL2FQn;{wS9PSQ4nY4}%|}Tpf_BX(zR(pDDeQI>04=#wJ~A82A@#7&cg5X<#zT3F zfWYW>DFv70m{qtNWIvY`ccA1_FIi?TEkml7Tf3|i87%`j%}AqVXoaTq_`|H^*r5w? z9~H;gh%lGZb@7{!B55i62QcEb5_$Pr9F$ZkT9fm{#3E*F-Myxuqx)S{`2i&p*#^mT*#8W zt+zoOv^wsKZ>{Rbo^Qbn;#uR06g`Qqa4QK1U$EQn?>dUzkSi6bt0R-U8lwpd-l?tM zM2N~;W^iZ0l%@S-W`WC-s`VbJlsIv$i26!RwSMw?YsO<6zlw#U$&CAI)PD0+8B1v~ zJob@k0=D>)&}ylMP;yt)dJh_>}Z z7Srb%1P!u_AZjd;+Z-(J?I=}%X;SW`8ovgJ zZ4e-1GbbKXGFvgrvTH{WKP^(|d=TXp*qWzo+C1&NzCUi(5Mj-&ptDNAFvBmKhg~!? zj1k4|HQ5%DyrsS0!|bekZmmh1r7Qn-tj=7_qfyB_uyY{jaDy+JoPOT9S;v3>!yX88 z$4FJ4H3PY@??$qvV6sejS?WHb^+^5z=iY((1W`fjmv*w_1hmn{23h>!&Vk5ex1~~N z_#{mJd(e$w2=sSeK7H-<%w*L1>`7pr#1Uo3t27Yc#%-@MBqfuoFGY6b8sqVIPwPhu z*lE^DXBp4Ne=|I>>iZoF@%%Iy+rAFPP&#qsb;mTqA{ll zuW98r%0cs^%XY^3ztO%Vxh1{A<_+Uk*I#@Qm7;J!+%s|3x8 z$LzzM5z=RUmGB|w78psxFIN0@ZR5F`@9^Y7Q<8GPb%OP}H4Bqy=xwF0fznt})CKocL%k7FJqpG)o5f3a)N+s+=U@d(+S9mv@}_&Y?o9U2HGGJfmmdfoliUO)VVT0)&{ zQYel{?pC|UzSaTaTD;cD#(m@p>Do;)P@Zl*f{nCeG1OIsu*%CplUXrAw3Lzl;)QE- z%C3{2n_)oGXo0B--xfc(jgG54588!C2#F`6k~-gqTWx1I-bH4?s{DM&lrfUV52{}= z(2p}`(`@f~&tCch3}JD*wlm>_Q(|d9>42L%;(!;Yv;aAYapP$2(x2pMU1Gb~3Ye^V zMn{yFm?5L9&%_xa2H?#v55qH?@F_=J;~g1w1O&Y(z8^H-%*Vh+eBgM*CZR(qXgSidK3h=zNdIxwbrn!@UBkJ)W1tZHrIxLi%1t7+ z#mLKJ*wiAb92qsd)MqOG!6|OARJO^Y9MRrkUs0$@cl0`L(2e>-;#`ErhA8KlWAZg) zE$lJj$aMT5mo(iE+%p)O@BpkFGXv&Pcm#Qz!TOBqsw=t37>Go}q&GDnOF0#K%e3P} zB6YJSF@I}uIExoi4#;?hs;V5PuZ9g$){;J#D*3#$;WufLT|LxROvu6;Y_BZP_s-Zm1V3_o)#Fuv6$>^yUGbV z$vE$2t?2r8y=S9q9}U=UK5VJ!d#!Vq?@Ut+Yeym{7);q^D`8U++~2SbRu6! zWbfD1DzD>ndHkpD(5g^MQ*oFH@P<(8%ZF@pRpRnS+Jzj z+Nm1xt*)8Stm9@&@)VNQxSF($$L4D1x!PbqJb^l7AHxer7mJxc^bvF^U+<(J9;CBy}jxSc3Xquw`;Tr!LLzpXO) zNL>okP<7NqZ}}n@iRE@|2^_l@>mU~?JQ2PuCQjZAol*sJ>TiQLPJ{LpO0;@h%uRLP9^Xs0d-ftf|M zW}con{_JiV$7NN5%BybXHyg5|tx^P!MdbF{Vtm8dUv{pTbh8dgWP`cZ30trDB$4I% zqo-yn*+Gtlc9rz6+@9;!#c`DU1A1}XtfO=F=*BB6(O}tRQjagjEDS}cz6n*TkSTF1 zP_vWt;N9vv+-YqswlsMUuZ!L{ZLS6yBH7`~41Y?*laJ+v%Fce@C9;)|cz+MKzl^B- z!&2GKc}8~q#fMz=(OdpVxa4eYgF7>z+>K@j$CKH#Qh4HYZSnXDqhyo1CHXI((asn? zLaGB(QCBmt@yIvR^5sqC?Mv8{*3gfe`{WKZ!2RJ5>I|Wpr~Lwp{p59!tb`O@+g-p?b4w zo@hjXgdoAkJT;)vuv!f&&hp1p!AqNums!_DMRL!TfP4;V5xY4nbD|!(kCxFpOZr!E zxpzD37X^U&1FN{AyZ#ZViY!)%_Rxs-+-1>fv!SO$v)eg&gEt;y=SM?c*lvjpYA;0y zH?N)ec+4Oz&0YDCps7Z_uYKBak;j(d=TA_0Gueqmd3LF<@*Vayx1k)xuJD{S!c=Nx zvixqs-b$?qHXM>Zk-~%Z2wm2N1|uuJ!3%-x!BXx#`YRZ-EVdr-t`X**3ad;7j^?Ed8q}q4Gjf*l1Z5UyR58mpbMTgp0U;Y-9Lo+LU`b?{aZp zGuxrzfk|~=`@+%r^0N$Sx7h1&zpT%+o+TJ5tA8XqTHk6=`xhSv{JWRiM}o;MBzU2) z?%Ukl+|K*PPacmaP1^zBMCQh_>FwR2Rf9e%^@Tb&Sz4_gC`KL~gIi{n!(YxLRB48p zne=%mMj_evij)?3T(%*x*pqiv=0CH`OxNPej4KjwDK(yu-8XRDw8JuEMHj5Euu8gO zx};X-VuI*aQ0$^KZjIWdhJGDp*v&v2d5GKgnFq&G2z7lc4c_vk_9_4>PXqg6QEaAm zWn^JLQWDe8_NOtlGIi}BQ2!uriE0)q*JLq^PGnjOA%lFj z`o|SZ4y+aapBc$HQ{Y5wX_4%soUui{29waVOM6a{BrU1x{v0`h_(h!UnCo+%#TPxs z1r|oVhr2VeN4o8V3|{Y^+Ix&&ZBSS{T{ZH+X;i;DnR49=ZTO^O9cv+VV^#%Y8vRqv zwhLKP5H{xIPmYOp?uSM<<{)uk$lZg!?@AY^01f2E`jT+K1>pv?h1I>x{LWc?91XUvJ-?((f z9H~ZTmirTVGp;Al&?}oNyVziau>6q*UooVn`(OBAjx2l%?U(cW&~Tr?YE(eW>ARW_ zcA8p6->@|%o!raY-YMynPL`goQlXgt!CH;zn$CYu=TAe2KO3XjWYg*H5J7#oBmBg_ zO&L!BEv27bjpbXzszlIS^7%ni1E=*Oi7?noATD;VVIuJgqchqtgfkbXU|*3QyKb6~hVR7Z zMngk!Mz&532u)ioECIKbITyXAhn8U6B5hsa;ndYH_l*An=(}B{HfNh|_04|5dY*Y~ zAe0%?n4z7r;BO#S;jqH0dcERqXk&vkcBg%=^(y|e{C77goR~0}m{e+d!2@%MssRXe zE-Y4c_VQ0E)b{0_q4yft!@U}CfQpIJGD3ot4bM`X)4B-`2Y|nnO!GA03tPG@o3r)- z2LhUH4RPm@60fMCK2CN>KVueiFYORz@VbY2AMMStYNCUc zpaT12OK=)^CgRoo*K*$D-~O^&&I!=(p0=@A7VvvvR~B__ml}ZIleNB$ewkOESD(+s zgCUX5*;ly=txs|(uEN17vyVl)<+M;8otSOCQ7)K3C)cZ`d4Dj4t+yY+t>nVdM1RK6 zgF%iU3py)%OR#dL(So9=Dv~nPBM4}(s=oc?)iMfKMqa}pD&A`dQqvxh6IU~m68e`Y zcQ?`fVZIw4T87(QZX4b`EgtBUMdKP9JRD2bpSCsg2b*glzTI#`7gce~x=)49$g)|$ zol(iyCvD_{Xz|$YS&B7%4`J%0*WS0;Di$y-=~EktRjzg4^r zH1!v+eh^#n*XCPyP+IXidYUvT_gbF*-c@fjqE2=A(;;W3-u40Xi_SslFYyj>x z3`<|&!z$~rKY$@bzG}O?QxlFXot2j*-Bg&3DY;Gc7+bcDlCVP$fKTPw{=%@TSF+n> zqGh3@I+vhs4}s*>%53747>EF{L7s}0t$5w)TI6Rg3K&-VxFJ8r)XK;;N-5d-ubd7o z0Vs?7L0tqIMz(vEYa%=AD&X;QC_6t4Z);nLL++XMkHg|a@SUeMOrwWS!r+rmR(6q4 zEJ4#>r2Y2wEfL>OZ~c!HvMFK0RR@$QJ{p127$tq5Ed4|EngrI0O2JTf5t`@b!KF%kOHj-2Fv8ho{6>6V}J5? z`!wmP7P|blWg|1=+eX4pce62k)%vKmzbZ4j-!t!NSA5Q_QXZ}Tb!6<^t&5(IIdEWD zB1$y93WUcy+g|TLwy3P-doWF>bW$wpphSW%TP`?_xH0~$o4z0Vy?OauDLlfq&kxWfAd^5HhShtj&K z1YPGyDq9FZyyCNeIa-h)@Xd%=d(Hbw3C@ohm#x!21bnaFiE-=?w>|m6z%BMV5i^x} zkSU5~a(7?hWVzAxnxsW(?)xt?^WPPCyNI;KgbrtgsYY4sK%N!IRbP7Q&6?LMM4n5` z$YjQPN)y+IV|Ek+*4o$}JqMwVu+MoDru6SS@yW8$hmLQKth3&XTxzGdX1_TQao$_9 zBctr~?3C%;{r8PO65UO^dtJL7P?z45>}j{J{`c%O2Wnasf%xLj+kG0de<;kE!BN9V z> z8XQ(<&I$Be;XLyJ7QphR8=n(rn&UUlu~EpsvO) zwTO>>bU0aeppRQeqUxeb;AGTlTo^uVo!a+#aV6!kn3rIr^Z1_OQNn-#d<;g!tEel0YQG{WQ*IxpY?)TOFXNXp(s{u_r~+b9 z9ha~Yz$rR<+0e5%*cR;E(ZcIz#WVn)GT0~&Wh>FIE5lkfJP>Q#aicUgmH#vZi(|)SirWV>bQg=SU%iF+}9yg&lUx)@p}=!NW83Z48L`2wSTv?oaSL(e4|32wGR zbL$q|tcFk&^uKhfg)$GEPmWOl2hAJb4z>-AczWN+Ox#1=pc zlL(;fU~4g!7WqdHFsPO-_k1lSl~Rim6uj&8gT+RPNA-Pj#Iv|3|F?+`n(?!E0Qt7k zGQK$9FDwR53bLh@M-?sX%G<`^rjz!`c^1){-v~yjh}~A0z4A1-H`#XXlbozrM_n3{ z3sjfiF9h>`r@I}qlkiCyf63#zuD{$cFKJe;{Ic)tv+!W7xoHI|Y%RuiUpcBCxLtOt z8Y)Egsx&@v_yND~1IF<>iXX6Da;dAQTFZqOPLPVK?5a^GX7-vr;El+lg^8?*7aVS? zE~|No)n?q3TW3`>eSphXx&fnWHYpV+qy*#P$6`zkdi#SC;=qo}<*Sn?Wz+1}Zf1?w zE*daz2pqcZnM%`*gd&`r^%UH6Bj;tuL2o6;;n)@x;!w(9_@3e)lg|dnJjiCLn6E!A z2K973I%&mz#*n@078XDc?%Al8)7@mV)zGUEK>${GWKdSrhO(D0h`L_Ci~{7-9DSRX_`!%7nj;;ik2ge>Tg|05D@g6fBYA~o}gRNfycIQ z=VHM~8hLcr#GzU@b=?zfbKOMOOJ>343cZgC+Xx5FLb|ud^M+&6Anli5vIXF%=@ssl zzmH1K#{Gh(L$sv8g^gjW@0mKqf$oxfzOAF>t#?bw6|JC7avN?e-+-b@H{){!p0)cX z?=Sgl_7RP?OGi9Yy~#+su~&KRQQ(r3`n@S={QMR#P;zZW}RjuvinwoU6Qu3fo?;g@P{V0ZY>1{A# zznZRrK$3Q@`+H-xinZojPq!Y+>94kRQm=I+ArAF&ZXsVAu+@K1Iu2x>is}!&RDYQzQ`;tkxD~`%4<8i_gZ81lv}QAp zh&cSJ68vJ*bvJq`^)GOzi6RI1?w-K~{p~770AAdX{$eIpM9WZ^o9$rw#!CyK zu|EJFB5T>4ds#YsS8u$9Pc3RvSuVohYtKIql4$M~z01bGHt|vz4n!WXbZWDa5?LDK zMmqEfrh4WzzAy~kQ^-|WhbVuUcyp%vCLX4feP}eb`8b-zxy`~IkZ1daW6Ohyxb=E@hZS)c0tnpR#= zjd=I>N9=Ifx66`@N9Rf{giHuCH&ISD!fUNo=;f^`OJuVz&hH1zl zsdt4NhRGoRQ4|m5W>Q?o6~dFUFs9@2#y*>5a~<1sMrr|(!jWtI4RLxNjjZ*+nAdsH z=6j%^$ZqjeDmR)((bMJQu`C_GA0jByx^#dDUgCT`SVsNxFs&uTiH$BPnNcWqHgWxw zdwUZ*LSv0f-wnFkPJ>hhARZNv7?3&KMTuHRnXZRJM*7`3LEDqumEy0|YGNp8rA;B} zS$V!yaGqoq>Sh9dUroMLx=cJ7LX)!=*-Y4Km#n~ySxbkqPfA5`-***s5orlqT{F2| z!%RA#HE3L97&yTXyUb)I3*o!-06{s6L&_ny;kgop9sLeI9-8Xfw*5 z{cYme(aG!9_8*_h20UtC1ly2|af5gk+J01X=}jhdHI^Nq4LYMP$euT9ZZyhWH5Mgeou;bNN{|HPQo_XX3u72-3wc49*Kx@0aJkmhTEV4{7=P~UZ|0r1RmRB;?IT(9xNU9YG-nPlZHj@yid zpHr-7p=Rb{%a+1X-__qzaUasaQ1?1vmC$;ZN}h2Hz~~-mg0WvPCg{(WKOP@TZi`83 zU0;rQq4810^48Z+wXq7Kuh&w#R%701ch7)N?C;xD+#t469 zACrFa!ydNG7NzxB=P3D#)zZPA8|Gj@Fh44x%iWf?B`{W)>HRJ%&cH|Zwz3zsz^5XI z*e-igni`nP3ue%$>s#tZI ze3L~;$>&TNoxRP7+%IZaS=8hH+J}Dn&PJH)^s|hs4h$D zBVM?iyZ+c-nlq9IdLxHm&T2KD-A^Ci9=4VJ+E5rMMOCJUfs?Z6kz%%ynYV5@YBFNP zA8pZ0cVCvd&5A=$iY^T>A?u0Nl(L)0BNZQ&+aR`-SVJpnshU1qe&%v43zhoYe@vWb zqJcMT_Nil6YUEP({^&50`t@}W{{02MW1C!uJ!9=c1O2f2y%Cau>L^rv-K9JY-?FpB zH~;++U47&SBV6$9c0s`CQS?vKS)-Gn$l)I|O}Q6qf;+nSIpgK`-TB=kkHzb?SSHNC~X`o(M-&1*ppe&y97Lyq{G5Bzn^Y6RNjmPPV`cP zy+}Rp)sHWTd?H`E#zZyt?5)PpS9fy!w`?%pSmd@kx&f>mg%f1*GO zzeuf~W*leOElwi3Z#*t9UoJHy8MZL*<=@dYZvmcJu__$h;YFE2^Bo+bwz~a3)>gp2m_ngdl-+*OW*OV<+(KE|I^-g#x=DqeM?u0fJ$#7O(_B@ zRU{x?n$*xik={EJsz{Tjbfk$Wy-H|OLX(IBp#(zj5L!SwA%wi~+;i_$&-4BL@H}7k zFMF@O%B;O+=D%iUP3}-3H!8oQN`~R8^jXZ2!>LY^4guv49ra&sZ~OMD=2~~$6(9B< zmFR#S%s3f+XTBx&U?Qr`rWmnzGRG#RTHfCU=Q~rO^v0d;!i^0BJhna8!#=bx!a+-3 z@5UhO{N~kO%{8#Kr~%9)WnoQr9=(;@qm6bLert28Pmu;(n6M%lg3fm3D4@kLM!1?4 zD>}csvw?_QWumjqV+xucwUelBWCwBNYA4b`<9^!D&B6$Q%aHUcIX=S}{5hddBsWma zaRkW%n1H9Kn}ZQ@GIuNlmBz-U1%vLf*qBs9DW^uh+_PInhWw{{0B=8^v$<3G zGaD04CSm-|vU258F_I=XR1Y90^-$@wmn++*19)%SqOYK77tnTU zT1g%Idk&V*KaY6&fiuzwff=EgewjXeE`kK(+9$D_!ga~(bXgMlXIF}%%%Akf4Q@Eg zFOWYUKWQ>?F4^k8Wi+#39K{0(ptj94?27-F4HZ8rKk@RK2|jI2WsrXgA+Rk}@R3hVQZ*xrvN)ml;X8mHnAA}O07%j+-EjZu)^`Ohf?+t`I?-5%oXSqM!q0Ke~DUZ7! zr|h0Ad$aK$9UBVW4rwbWvRNc(iI_Xj3raWie+QKCVqsnUyk_g0F4VNwykDDMPic>w_iopDZ=XTKGLJDmbev+i@bFFJ>E?Z)c&m9XuOE3BQGwrcfrM|_7viN?g=bU zpPX8nAPqS5C!kGR_=O?7v*%yb;1Ol!Emgc#`G`P*{SRf(0LD?tFBJo)fkPs`< z?NfiDS+`v^e;r}iVi%xNxi#=bz^ZP1rx6CrsM{6VtK>tb{r;EJlX4skYkvJ=2*LAu zs>Q`c_k*<|w`S(qJ!`0D4AnKt^UN|F5I)uy`oM)P# z74s$EhBN_~sY4>G^j&qj-gqMtcb7P3!geJtcOsyP^WEv5=}gWPZ^ZdKB0;RjU7R)+ zAttdN)MfVVFovCX7>0EbSdyk>YASt1n9q21N$hh;L;1`zhO{N-; z{FSSLE=?3_I#Ig|P-V@ymN+MrWM$sj-9C4Xc1_8Ia23eI=?|HzIk&O6@Xg&(T6|ng z5mnyn7tL<3oeWQ}J8sRK44s_Y`%*)f-{nbQ8;|#SkxoeNKpte)igezqZq6Y_Mz+`m ziOk(5XsLQp8JYET&gHX{b5OWhmU6QUqz>#m4N4^PoA%@)Rhvp+#a)@zJ~7Zyt)3x* z23;QSQC>P5N@lcAz5oYeo|rui_7M$V1H6t2b0_|Z zJe)FKj+C`Iyf4o{Cld$m4v~$c)d1XDSy9GI2L|dI3M$rp#rdbqyg;7$Ff{d(B(#X^ zxK8YYqR7SV=hO@J_H%tQRSF;20+E5w1{kSFpd9m9YU-{7zdax}Z!R*dF?2+e>ST*` z(Dzh?nK@zcAalvyUM5~VFbu}bJm`K_PD#Z0YRFo}y4bMaep=F(k{7#-%+*)S-LM|O^fnD9a-Id+4d(R6}kgNsz1yYa#k@)G*y>*GDK_x zNLQz#7QyhcvFFSRJFf!<7!hq2nhXe~VsRB{EaHRlNfQbqsVj{5hV*FMwDa-+#ueRo zJ0UnNTTJ3JTu;Q9I8oxq>9G|ra=U1tiuOSwryhI98R&}pc_<&F-V=mp1 zJmYjsJXM6nJrh-M#~MIAz`f)7!FgZ!RJ6GG$Gm1R>`9aBh)GKB>~aMclm}(@9SSdY zjV`Q0*0NX4RjMn|&A0`OXs1`MEp1i9Ba968NAQ_UHY^Jnh+;*Z)k@B~GZuYhvIKuc zzFTO7Ut61WxbBKU2Tn8Klm?wfsvLk+9p;H&eX{I37pUhDRhKYP{ z#QA8_gM_cBI8ONHR#BEsc!{*D!}75Z(S|PBBlW-&3}F5NOqUHLD;0(bxf%QZNFvF{ z!~CUvZCY0*^^YE>y3@CJL0RtoFVKwp;T`@sZ9dVngc4OrzRk53+w#pCGU(3tZUyC+ z0&p=;ePxOnTjj2hO8GCc6)O3b3dfz!`he`Y)v#zsr_riQc?ZbR=xBnuDDuqpCJbvz zdL9<-qkpEv_9lSZC|afG^AC_inewf$ml+}1p>I6n*>^bxS9-al%ZOi9?}UbMvd!l7 z&^EcMOl~K|9a|-uMbQ))n+K&aySB%7nRv_};vVMsqI>mowU;NU0?;|#xeb=k^Q(6p z`$pE5h_3wjO0CSb(M9dydyJX?0JN0h z>zZmh=S3@;FP9zRJr1b1r1qhi0bli#2Z4R}-0lQrG30ROtaB^aT^W9P4JP>xe)-Ab zJyKc)4<6I*Z${(#41(Noq7TLB(*&I`bC~NhMXhCg-+_LR`&`?zGhPGR=lpud8n1BN-G>H*gJmGw@J z?oQOLoC>MhipLR{(}nNrBniu=qV<5%5o@8(9tKTm<7Kv(1QjuVS$-FYjsd-<5nX)= zpm*T(Rs3YDQ&}lgh-Pn=OnPdr!UFR>P;kvEopmG7P@DRm{YYVeOJhj*TY7Djkf4Eh zDl$yiVDl693j~*)iiKJjC?Ym$J~Ys>sa7{pyY2*Quujn>$iYQkDqrJUa2dV4YUZ_$sTE<796i>G!Yx!{k9xz z+v6=Y5hpd(T}W+S&1tW0$4K*5Sfw)j0^!B$p?_WEhBR^`rd#9@oUhEwbl zCCw7vHyuX=KS?Bl`A93cOiE^f)N86w^ZSivZz0)zKJS>RU&bmQJ6b?LOwLtS9m*Kj>#XH=|1j4)~dbOH7(A#KNNv!du0I z_;eJp8{Jx41^NYc&ECZo0!KoD7%kMqXEh0*Rgi&Ks%uk)GDjUw4rHwd5Oh*&y-{-| z374tXwA&I+#9_ZhF)BU`?Fr^4BB_68x3Z^06_mY2z*m)wUAIJT$t0_gj)vH3_?a~f z6WWGfwM~@>9?N}2vHOhUREEo78x3=cxG(1Pv|Ay*w5oQ8L(8JqZwE^dBw|qoGXeP= z^XdUh>wA>jTSoF^MBMVakTBExMT!0;;1c=Vti0r`nrHfUiEO%4qJDt#NXT?SVZTI) z7p~;ssf&5;=_hs+Wsz5>JNJ1X-2S7I6j?I$>7J@HHp!@rigMg- zsMuh1n13|*NzvOIObS|ezQrqJ^q)`h2DyqbvBs1(R6W{sYnHd0lcqIwAL+ldw_XhH zD_rE>&^4(wh%ZZuFmU)TVRHB*eY*GFwqfbFZ#KgpX>BflQ(KJ=nS5?t0WOj34HPqF z)+6NAyCso`Xg1$qPgsjRR=(yNV*TimL9IwD>EEA$R^vwZat&ap9*rof~aZ0?&5S2loN36&?=%%sE0ABt7{?;9^Eghrqs+=TUZKI>PDu=Wj;M>6O!^&2EomjBce1LVDiQ zZ?7Wt>y+l~gN*z}xxZBp-7~0ng+*(!e4E@l_IFnMXvj^~wTsD6Wx%?zv6UK(Si0%u zkjQr;5GClc_)mXvxAQfYAc^nllno1Y${~Dubz6A6#VN0-L zmfsHi>Sm<#lVOgj&JSz>DAZwn=m()f<_E<^7X6LyV2C%#WC#0Srr@8@FtAg&598eZ za-=2GNWl@AHw?9WNeSYt=cIM4MXd6^-cSww)-y*&%ow>~4HgQzV6jWX;3M%WL z5|`wZeQx_W%F-E#vP2nfqGANhSqI->Q5*X$)u7Ho-Ls?Uu}t|*>EmW&j*zK6?xN+B z6wvLivWh98XPzt^gZV*Zqn`?tKy9ffsWlkKIR?u!iRY=klVmcHj~e$nu&Eid7DGE8v((P&z{}a3Jrc}T%m3$WJs)lCxAE%HiO1C>=M=8_$lok+p?A9)Kl$(zCQpx# zNW*sT-s@k!dYBZ$#fYva$7~EhA17yLeH9g`L2HzNuLnjTaNOdfC;EK_lc*?n`;ud@ z!}l%WQJZwJ(-^GJR6%r;w3(wv7~Dqv8)648Awjvu2jiZD-)R;|y?v>yuMj{5iW~QsLLHiTq9Bg=RymoCgxD8$9`=Ukb95&RALJB}9%i)vGduk;* zBe^rBfh)J_4mDD)H`$~F;BJ5T@QmT->b~AisD#CRCvXLpCddsE(@#QdVju;i6`89w zZAaqq3)+P=f*x+Y!WAqRGoq~2R(i+|Pv%hi3QuP>9DG{e?i7!@gZ&2Rk63Fj=(Y{i z<0%r7ETpYHB2R04Zfm%`Jo*%EM6v(@(5$lB>T_RDh<{M6`&S_>fhT6L4FOTy+IGl zy=2Bgk3mycy+X-b36=0NtThUZtD|>ut1scJzpN!#Jr<&mvDnHrBCh{h+VZ39F7s$U zwyMMi6wB@skGp&SD5m1@=}7u#msU3MUxoY4KmtPEh&ko`kSKARCHQyPB<#%ct-$IP z#t}KYtl;6yO;#wmftB++J(qhX`Qp^a5&zZMp;Z_3JOg7?|E0nI`}_i-{MGALSHSc| zZNJj@*K6|va_!ye(Zv5Kpt*-1h`f`>M(nQ*{qx5EYGnD7twW5=_fjFn{EKMFeN@LWD!U-ZAUn-RL` zuf}t?kZoO_rJljZC9)ag(qey#@i$}>9!4`3C$^WeCEDDtQojbK$?l%)|urw@oVJe%FG{R%c|=QkwW z0yoN+#%ol()P@ucg3`eC4vy=3x^ymfkYx`kzwzQMh*Z&T6lTR4{RVvVFv!`X#bf!x8=Sw-Q)rRg#L{q{YW`Z{M+%o= zsb1rBYZI*j!uOs%Ubz{=9q%`{rr^AG2*7t^P{qNKI=_^wY~EDGE*Z7D6lhmMwaoct zf@ZkqHbgG~$rBMUn_lY}l}#r2`r+WSM=%}R_rrZefhzyD1pI9iu$m-v+5x{)(a+Zt zHXTbxjY#kKIVb7a%BSe$4X2H-#iXY3POc;mV!$l-JQ@Z~0f$=NsW8dIoZ*eFEO$fw z$&O<_?R#h8+3xy0I2~d0IF8#=yId?TPvw&%RrEa%GJC-#AcSSX;A|>+P9g^-mNOTc zvvE!OtQDS;i=pTk+FwPUC=QInSuMjC|7)lC>(?ujd0Ht6bGH$X*$m2rY=86oq-gJv z2gYK4L}bZs-`3Oi-)ZuAIHQsgI8gzV_vLQow{Yhitu(YI2;~R@J#K=D^*^mMRt}M( z6^yZIJkcg^5=|Yw-?E=4y02Kxor@G@*|i3ZWN+yINSGz`3W%iT_4=mvZl>-)YJ8buPwN) z9Sb-wYx;h9=y%|BcC_q~Wno?5>Al||<_a*LdYp?E3x8nT>+|HRMOUE0R_d4htydQrcOu`vS_LTFrm}XM7OrJg{-Qi|}*K`fg7hEM=94&-ox1{XAER%EPgL0U- zJ$kc3J$l7}rN>7u@l!0(E%oFqnMpNLHsbGB9)9!Ai`#E%qffQ2B-h$y)blL7sC4I7 z^n~XhGr}YO`RMonNf)-Wyh>FZdg3m5yrnR*e!ca!B*Neu>u#>!;pVsBazi#crqTg~%=4 z&jkY|wEJdyk4)j$izb3nt5=Mlb|j(d{hhxkMa=dMiBB{ccqd40NaiSL^kyc|JNzag z2#9rwZ+N;+2%3Ltm^x6>OW^Z!dDazk8#G$sGw*a`JvM_kxo@xb=6!UyrOp}GNDQKOJHn`$f5RpL^ii#{##CeZK2f zNpn%Pe-N8XNKb<{S2|y3-*MIH9qA<$q!FpflSx||p<>kFoO!Xnj2T6KeU!?o=68`Q zQ0eqI`XRzO>5=jW?Wx7hZtmojuUtXS1Xn;6KNi^PbK_bQPde3m;m-jKan`dYeONU@ zUN5&tF@JOle0<$|&+dqP>1fe-esqN2G3*K^6CYCaLLmL@E(vsK?go&Ykhe)+GV*tQ z__&b}Ij8eAc-;0@sI`S0A@B3&k}`mRq`A=9LC$hlw ztMLC@dfy>oe3Epl)9?3{jW4{|A}3F*(F27V=<3omTsa}b{{!70oVIGxj@oYy!bO1T z6jK&EBPdMT0?`jWmn{BRLwM!ziqJK04uui^P;s4**AA9zps7h!pg}*J+|_#HkFko7 z5cqk=Od +## Identity Provider Types + +### Organization Identity Providers + +Organization identity providers are configured per organization and only apply to that specific organization. Each org can have its own identity providers, allowing for authentication methods based on the organization's needs. + + + In Pangolin Enterprise you must enable `use_org_only_idp` in the [private config file](/self-host/advanced/private-config-file#param-use-org-only-idp) `privateConfig.yml`. + + +### Global Identity Providers + +Global identity providers are managed at the server level and not the individual organization. They can apply to all or some organizations on the server. This means you must define policies per organization to map users to specific organizations and roles within those organizations. + + + Global identity providers are the only supported method in Pangolin Community. + + ## Supported Identity Providers ### OAuth2/OIDC @@ -40,7 +58,7 @@ This can be used to connect to any external identity provider that supports the ### Google -Google IdP is only available in Pangolin Cloud. +Google IdP is only available in Pangolin Cloud or Pangolin Enterprise with org identity providers. See above to enable. Easily set up Google Workspace authentication for your organization. Users can sign in with their Google accounts and access Pangolin resources using their existing Google credentials. Perfect for organizations already using Google Workspace for email, calendar, and other services. @@ -48,7 +66,7 @@ Easily set up Google Workspace authentication for your organization. Users can s ### Azure Entra ID -Azure Entra ID IdP is only available in Pangolin Cloud. +Azure Entra ID IdP is only available in Pangolin Cloud or Pangolin Enterprise with org identity providers. See above to enable. Integrate with Microsoft's enterprise identity platform to allow users to authenticate using their Azure Active Directory accounts. Ideal for organizations using Microsoft 365 or other Azure services, providing seamless single sign-on across your Microsoft ecosystem. @@ -56,7 +74,7 @@ Integrate with Microsoft's enterprise identity platform to allow users to authen ## How to Add an Identity Provider -In the CE and EE, identity providers are created and managed via the Server Admin UI rather than the organization settings. +When using global IDPs, identity providers are created and managed via the Server Admin UI rather than the organization settings. diff --git a/manage/identity-providers/auto-provisioning.mdx b/manage/identity-providers/auto-provisioning.mdx index 5261a8a..46b0d6e 100644 --- a/manage/identity-providers/auto-provisioning.mdx +++ b/manage/identity-providers/auto-provisioning.mdx @@ -71,9 +71,7 @@ contains(groups, 'admin') && 'Admin' || 'Member' This example will return the string "Admin". If the user is not a member of the "admin" group, it will return "Member". -## Community Edition - -In the Community Edition, identity providers are managed at the server level and not the individual organization. This means you must define policies per organization to map users to specific organizations and roles within those organizations. +## Global Identity Providers After you create an IdP, on the edit page, you can manage organization policies via the "Organization Policies" tab. You can set default (fallback) policies, or define them on a per org basis. diff --git a/manage/identity-providers/azure.mdx b/manage/identity-providers/azure.mdx index b6aa497..58d770c 100644 --- a/manage/identity-providers/azure.mdx +++ b/manage/identity-providers/azure.mdx @@ -3,6 +3,10 @@ title: "Azure Entra ID" description: "Configure Azure Entra ID Single Sign-On" --- + +Azure SSO is only available on Pangolin Cloud and Enterprise deployments. In enterprise, you must enable `use_org_only_idp` in your [private config file](/self-host/advanced/private-config-file) `privateConfig.yml`. + + The following steps will integrate Microsoft SSO using the built in Azure Entra ID identity provider in Pangolin.