mirror of
https://github.com/netbirdio/docs.git
synced 2026-10-19 03:59:05 +02:00
Restructuring Phase 3 (#492)
This commit is contained in:
Brandon Hopkins
@@ -0,0 +1,109 @@
|
||||
|
||||
# Add users to your network
|
||||
|
||||
Whether you have a network for personal use or manage your company's corporate network, you'd probably want to invite
|
||||
people to your account and join your NetBird network.
|
||||
|
||||
There are three ways of adding users to a NetBird account - indirect, direct, and via IdP (Identity Provider) sync.
|
||||
|
||||
## Indirect user invites
|
||||
This way of adding users is managed by the NetBird system and doesn't require administrator input.
|
||||
It works only for organizations with private domains.
|
||||
|
||||
Whenever a new user signs up with a private domain (e.g., @netbird.io),
|
||||
NetBird creates a new account and associates it with the netbird.io organization (domain) automatically.
|
||||
Every consequent user signup with the same @netbird.io domain in their email address will end up under the same organization.
|
||||
|
||||
<Note>
|
||||
This feature isn't available in the self-hosted setup. By default, all users are joining the same network instead.
|
||||
</Note>
|
||||
|
||||
How does it work? Every time a previously unknown user registers at [app.netbird.io](https://app.netbird.io/),
|
||||
the system classifies the domain part of the email.
|
||||
The domain can fall into one of the following categories - `public`, `private`, or `unclassified`.
|
||||
The domains of the private category are the ones that are automatically grouped under the same account.
|
||||
Public domains are the ones of the public email providers like Gmail.
|
||||
|
||||
<Note>
|
||||
It might happen (unlikely) that the domain classification system didn't classify your company's domain as private.
|
||||
Our system was unsure about your domain and assigned an unclassified or public category to be on the safe side.
|
||||
Just email us at [hello@netbird.io](mailto:hello@netbird.io) or ping us on [Slack](/slack-url) to fix this.
|
||||
</Note>
|
||||
|
||||
## Direct user invites
|
||||
As the name stands, this way of inviting users is straightforward and works through the web UI.
|
||||
To invite a new user, proceed to `Team` then select the `Users` tab and click the <button name="button" className="button-6">Invite User</button> button.
|
||||
A window will appear, allowing you to specify the name and email address of the user you want to invite. Optionally, you could select a set of groups with which you want this user to be associated.
|
||||
|
||||
The invited users will receive an email invitation that they have to confirm.
|
||||
After logging in to the system, they will join your network automatically.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/user-invites.png" alt="high-level-dia" className="imagewrapper"/>
|
||||
</p>
|
||||
|
||||
<Note>
|
||||
If a user already has a NetBird account, you can't invite them.
|
||||
This is a limitation that is likely to be removed in future versions.
|
||||
</Note>
|
||||
|
||||
## Identity Provider (IdP) Sync
|
||||
|
||||
NetBird's IdP-Sync automates user access management by integrating with your IdP and automatically
|
||||
provisioning users and groups. You can enable this feature from the `Users` tab by clicking the `Identity Provider Sync`
|
||||
button.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync-reference.png" alt="idp-sync-reference" className="imagewrapper"/>
|
||||
</p>
|
||||
|
||||
See the [Provision Users and Groups From Your Identity Provider](/manage/team/idp-sync) section for more details.
|
||||
|
||||
## Manage user roles
|
||||
NetBird has five user roles - `Owner`, `Admin`, `Network Admin`, `Auditor` and `User`. The roles allow you to control the level of access to the management API of your account.
|
||||
|
||||
- `Owner` role - has full access to the account and can manage all aspects of the account. There can be only one account owner in NetBird. Users with the owner role can delete their organization account. See the [Delete NetBird account](/how-to/delete-account) section for more.
|
||||
- `Admin` role - has full access to the account except that administrators can't delete or update the role of the Owner user and delete the organization account.
|
||||
- `Network Admin` role - has access to manage network configurations, including access policies, DNS settings, networks, and network routes, but they can only view user and device information and general settings.
|
||||
- `Auditor` role - can read all configurations but not modify any of them.
|
||||
- `User` role - has limited access to the account, allowing users to view peers they own and others they can connect to. Users can create personal access tokens for programmatic access.
|
||||
|
||||
| | Owner | Admin | Network Admin | User | Auditor |
|
||||
| --: | :--: | :--: | :--: | :--: | :--: |
|
||||
| Peers | ✅ | ✅ | 📖 | 📖 | 📖 |
|
||||
| Setup Keys | ✅ | ✅ | 📖 | ❌ | 📖 |
|
||||
| Access Control | ✅ | ✅ | ✅ | ❌ | 📖 |
|
||||
| Networks | ✅ | ✅ | ✅ | ❌ | 📖 |
|
||||
| Network Routes | ✅ | ✅ | ✅ | ❌ | 📖 |
|
||||
| DNS | ✅ | ✅ | ✅ | ❌ | 📖 |
|
||||
| Team | ✅ | ✅ | 📖 | ❌ | 📖 |
|
||||
| Activity | ✅ | ✅ | 📖 | ❌ | 📖 |
|
||||
| Settings | ✅ | ✅ | 📖 | ❌ | 📖 |
|
||||
|
||||
| |
|
||||
|-:|
|
||||
|✅ = Full access \| 📖 = Read only \| ❌ = No access|
|
||||
|
||||
|
||||
To manage user roles, proceed to the `Users` tab and click on the user you want to update:
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/user-tab-list.png" alt="high-level-dia" className="imagewrapper-big"/>
|
||||
</p>
|
||||
After that, select the desired role from the dropdown:
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/user-update-role.png" alt="high-level-dia" className="imagewrapper-big"/>
|
||||
</p>
|
||||
Click the `Save` button to save the changes.
|
||||
<Note>
|
||||
Only users with the `Owner` role can assign another user as `Owner`; this action will transfer the `Owner` role to another user, making the current user `Admin`.
|
||||
</Note>
|
||||
|
||||
## Get started
|
||||
<p float="center" >
|
||||
<Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
|
||||
</p>
|
||||
|
||||
- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
|
||||
- Follow us [on X](https://x.com/netbird)
|
||||
- Join our [Slack Channel](/slack-url)
|
||||
- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub
|
||||
@@ -0,0 +1,31 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Approve users
|
||||
The user approval feature enhances security by requiring manual administrator approval before a user can join your NetBird organization via domain matching.
|
||||
|
||||
## Require user approval
|
||||
Navigate to the Dashboard's `Settings` page and the `Authentication` tab and enable or disable `User Approval Required`.
|
||||
|
||||
- **Enabled**: Require manual approval for new users joining via domain matching. Users will be blocked until approved. Learn how to approve or reject users in the section [below](#approve-or-reject-user).
|
||||
- **Disabled**: Manual approval for new users is not required. Users joining via domain matching will be automatically added to the organization.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/approve-users/netbird-authentication-settings-approval.png" alt="netbird-authentication-settings-approval" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
## Approve or reject user
|
||||
To approve a user, navigate to the [Users Page](https://app.netbird.io/team/users) and click the `Approve` or `Reject` button on the right side of the users table.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/approve-users/netbird-user-approval.png" alt="netbird-user-approval" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
## Get started
|
||||
<p float="center" >
|
||||
<Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
|
||||
</p>
|
||||
|
||||
- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
|
||||
- Follow us [on X](https://x.com/netbird)
|
||||
- Join our [Slack Channel](/slack-url)
|
||||
- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub
|
||||
@@ -0,0 +1,50 @@
|
||||
# Automatically Offboard Team Members from NetBird
|
||||
|
||||
[NetBird's IdP-Sync integration](https://docs.netbird.io/manage/team/idp-sync) simplifies offboarding team members, enhancing
|
||||
security and efficiency. With this integration, you can automatically revoke access when users leave the company, when
|
||||
temporary access for a freelancer ends after project completion, or when a seasonal employee's contract concludes.
|
||||
Likewise, you can use this integration to restrict access to specific resources or environments when a project finishes.
|
||||
For instance, you can limit network and resource access when a team member is removed from a group or when an entire group
|
||||
is deleted from your Identity Provider.
|
||||
|
||||
## Removing Team Members
|
||||
|
||||
In this tutorial, we will focus on `user_01`, `user_02`, and `user_03`. From NetBird's `Users` dashboard, you can see
|
||||
that `user_01` is part of the `IT Administrators` group, while `user_02` and `user_03` belong to the `Staging` group.
|
||||
|
||||
|
||||
|
||||
To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](https://docs.netbird.io/manage/team/idp-sync/microsoft-entra-id-sync).
|
||||
|
||||
Next, locate the user you want to offboard in your IdP's user management section. Let’s say you want to revoke access to
|
||||
`user_01`, in that case, you will need to select it and click the `Delete` button as shown below.
|
||||
|
||||
|
||||
|
||||
After deletion, click the `Refresh` button to confirm that the user is no longer active.
|
||||
|
||||
|
||||
|
||||
Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to the `Integrations` screen in the NetBird admin console and click the corresponding integration button to manually trigger the synchronization.
|
||||
|
||||
|
||||
|
||||
Now, go to NetBird's `Users` dashboard to verify that the user is no longer listed.
|
||||
|
||||
|
||||
|
||||
## Revoking Group Access
|
||||
|
||||
Imagine a scenario where you have an access policy that grants all members of the `Staging` group access to resources in the `Servers` group.
|
||||
|
||||
|
||||
|
||||
Let's say the current project is finished, and you no longer want members of the `Staging` group to have access to the
|
||||
`Servers` group. One way to do this is to remove the `Staging` group from your IdP.
|
||||
|
||||
|
||||
|
||||
Once the changes synchronize in NetBird, users and their group memberships will be updated; therefore,
|
||||
[network access associated with that group](https://docs.netbird.io/manage/access-control/manage-network-access) will automatically be revoked.
|
||||
|
||||
|
||||
@@ -0,0 +1,250 @@
|
||||
# Provision Users and Groups From Google Workspace
|
||||
|
||||
[Google Workspace](https://workspace.google.com/) provides a comprehensive suite of cloud-based productivity tools that enhance team collaboration and
|
||||
communication. Notably, its [identity management](https://cloud.google.com/architecture/identity/overview-google-authentication) features streamline user authentication and access control,
|
||||
ensuring efficiency and security across your organization.
|
||||
|
||||
NetBird's Google Workspace integration enhances user management capabilities by synchronizing users and groups from
|
||||
Google Workspace to NetBird. You can utilize these synchronized groups to configure your network, establish network
|
||||
access policies, and automate onboarding and offboarding processes, adding significant value to your organizational
|
||||
workflow and security posture.
|
||||
|
||||
The integration process involves two complementary services: Google Workspace and Google Cloud Platform (GCP).
|
||||
Google Workspace serves as your Identity Provider (IdP), managing user and group identities and providing Single Sign-On (SSO)
|
||||
capabilities. GCP is used to create a service account, which NetBird uses to authenticate and access Google Workspace
|
||||
data via the Admin SDK API. This service account uses OAuth 2.0 for secure, authorized access to Workspace information.
|
||||
|
||||
## Get Started with NetBird-Google Workspace Integration
|
||||
|
||||
Go to the `Integrations` section in the left menu to access the `Identity Provider integration`. Click the `Google Workspace` button. This will open a pop-up window featuring an intuitive wizard to guide you through the synchronization process between NetBird and Google Workspace.
|
||||
|
||||
|
||||
|
||||
## Prerequisites
|
||||
|
||||
The NetBird-Google Workspace integration process involves:
|
||||
|
||||
* Creating a project on the Google Cloud Platform.
|
||||
* Setting up a service account within that GCP project.
|
||||
* Creating a secret key for the service account.
|
||||
* Creating a new role in Google Workspace for the service account.
|
||||
* Granting the service account the appropriate role in Google Workspace.
|
||||
|
||||
You’ll need a Google Workspace user account with sufficient permissions to create and manage user and group access. User roles that have these permissions include:
|
||||
|
||||
* Super Admin
|
||||
* Groups Admin
|
||||
* User Management Admin
|
||||
|
||||
To [check your user permissions](https://support.google.com/a/answer/7519580?hl=en) within Google Workspace:
|
||||
|
||||
* Sign in to your Google Admin console
|
||||
* Navigate to `Directory` > `Users`.
|
||||
* Select your user account and click on `Admin roles and privileges` to view assigned roles and permissions.
|
||||
|
||||
Confirm that you have one of the required roles before proceeding with the integration:
|
||||
|
||||
|
||||
|
||||
If you lack the required permissions, please contact your workspace administrator to request them.
|
||||
|
||||
Because Google Cloud automatically provision new organizations with [Secure by Default enforcements](https://cloud.google.com/resource-manager/docs/secure-by-default-organizations), you’ll also need a GCP user account with enough permissions to create service account keys. User roles that have these permissions include:
|
||||
|
||||
* Organization Administrator
|
||||
* Organization Policy Administrator
|
||||
|
||||
To [check your organization-level permissions](https://cloud.google.com/resource-manager/docs/access-control-org) within Google Cloud:
|
||||
|
||||
* Sign in to [Google Console](https://console.cloud.google.com)
|
||||
* In the top bar, click on the dropdown. Find and select your organization in the list.
|
||||
* Once you've selected the organization, go to `IAM & Admin` > `IAM` in the left sidebar. This will show you a list of all users (principals) and service accounts with roles at the organization level.
|
||||
* Look for users with roles like `Organization Administrator`, `Organization Policy Administrator`, or other high-level roles.
|
||||
|
||||
> NOTE: Verifying your GCP permissions is mandatory before proceeding with the integration since you might need to disable the `iam.disableServiceAccountKeyCreation` constraint temporarily during the process.
|
||||
|
||||
|
||||
|
||||
If you lack the required role, contact your organization's IT department or the person who set up your Google Cloud account.
|
||||
|
||||
## Creating the NetBird Project
|
||||
|
||||
Once you have the necessary permissions, you can create the NetBird project in GCP.
|
||||
|
||||
|
||||
|
||||
Let's go through the required steps:
|
||||
|
||||
* Sign in to [Google Console](https://console.cloud.google.com)
|
||||
* Click the project dropdown at the top of the page.
|
||||
* Click `New Project` in the dropdown menu.
|
||||
* Enter `NetBird` as the project name.
|
||||
* Ensure the proper organization is selected in the `Organization` field.
|
||||
* Click `CREATE`.
|
||||
|
||||
|
||||
|
||||
To let `NetBird` authenticate and access Google Workspace, you must enable the `Admin SDK API`. Here’s how to do it:
|
||||
|
||||
* Ensure you're in the correct project.
|
||||
* Navigate to [https://console.cloud.google.com/apis/library/admin.googleapis.com](https://console.cloud.google.com/apis/library/admin.googleapis.com)
|
||||
* Click the `Enable` button.
|
||||
|
||||
|
||||
|
||||
## Creating the NetBird Service Account
|
||||
|
||||
Once you create the project, you can set up the `NetBird` service account. On NetBird, click `Continue →`. That will show you a summary of the required steps.
|
||||
|
||||
|
||||
|
||||
Here are the step-by-step instructions:
|
||||
|
||||
Navigate to [https://console.cloud.google.com/apis/credentials](https://console.cloud.google.com/apis/credentials), click `CREATE CREDENTIALS` at the top menu and select `Service account` from the dropdown list.
|
||||
|
||||
|
||||
|
||||
Complete the form with the supplied values:
|
||||
* `NerBird` for the service account name
|
||||
* `netbird` for the service account ID
|
||||
|
||||
Click `DONE` when ready.
|
||||
|
||||
|
||||
|
||||
## Getting Your Service Account Email
|
||||
|
||||
On NetBird, click `Continue →`. You’ll need to provide the email of the service account.
|
||||
|
||||
|
||||
|
||||
You can copy the email from the `Credentials` page.
|
||||
|
||||
|
||||
|
||||
## Creating a New Service Account Key
|
||||
|
||||
Back on NetBird, click `Continue →`. You’ll see a summary of how to create a service account key.
|
||||
|
||||
|
||||
|
||||
First, click on the service account email to show its details.
|
||||
|
||||
|
||||
|
||||
Next, click the `Keys` tab. Open the `ADD KEY` drop-down menu and select `Create new key` from the list.
|
||||
|
||||
|
||||
|
||||
A new pop-up window will open, select `JSON` as indicated below:
|
||||
|
||||
|
||||
|
||||
The key will automatically download to your local device. The new key will also appear as `active` in the `KEYS` tab.
|
||||
|
||||
|
||||
|
||||
During service account key creation, you may encounter the following error:
|
||||
|
||||
|
||||
|
||||
If that’s the case, activate Google Cloud Shell on the top menu (shell icon) and enter the following command:
|
||||
|
||||
```
|
||||
gcloud org-policies delete iam.disableServiceAccountKeyCreation --organization=ORGANIZATION_ID
|
||||
```
|
||||
|
||||
Remember to replace `ORGANIZATION_ID` with your organization ID.
|
||||
|
||||
Now, you can upload the service account key to NetBird. After a successful upload, you'll see the key listed in the NetBird interface.
|
||||
|
||||
|
||||
|
||||
## Creating a New Admin Role in Google Workspace
|
||||
|
||||
After creating the service account in GCP and uploading its secret key, return to NetBird and click 'Continue →'. The next steps will guide you through creating a role in Google Workspace for this service account
|
||||
|
||||
|
||||
|
||||
Navigate to Google Workspace [Admin Console](https://admin.google.com/ac/home). Select `Account` on the left menu and then click `Admin Roles`
|
||||
|
||||
|
||||
|
||||
Click `Create new role`
|
||||
|
||||
|
||||
|
||||
Fill in the form with the values provided in NetBird:
|
||||
* Name: `User and Group Management ReadOnly`
|
||||
* Description: `User and Group Management ReadOnly`
|
||||
|
||||
When done, click `CONTINUE`
|
||||
|
||||
|
||||
|
||||
## Granting Role Privileges
|
||||
|
||||
Return to NetBird and click `Continue →`. The next screen shows the privileges needed for the Admin API.
|
||||
|
||||
|
||||
|
||||
Back to Google Workspace, enter `admin api` in the search bar and enable the following privileges for the Admin API:
|
||||
* Users: `Read`
|
||||
* Groups: `Read`
|
||||
|
||||
Then, click `CONTINUE`
|
||||
|
||||
|
||||
|
||||
Review the Admin API privileges to verify they are correct and click `CREATE ROLE` when ready.
|
||||
|
||||
|
||||
|
||||
## Assigning Admin API Privileges to Google Cloud Service Account
|
||||
|
||||
In NetBird, click `Continue →`. For convenience, you can copy the service account Email from this screen and use it to grant it the necessary permissions in Google Workspace.
|
||||
|
||||
|
||||
|
||||
Then, in Google Workspace, click on `Assign service accounts` as shown below:
|
||||
|
||||
|
||||
|
||||
Paste the service account Email address and click the `ADD` button.
|
||||
|
||||
|
||||
|
||||
Verify the Email and click `ASSIGN ROLE` to grant the role `User and Group Management ReadOnly` to the `NetBird` service account.
|
||||
|
||||
|
||||
|
||||
## Entering Customer ID
|
||||
|
||||
Go back to NetBird and click `Continue →`. The next screen will prompt you to enter your Google Workspace Customer ID.
|
||||
|
||||
|
||||
|
||||
To get your customer ID, navigate to [Account Settings](https://admin.google.com/ac/accountsettings/profile?hl=en_US) and copy the corresponding ID.
|
||||
|
||||
|
||||
|
||||
## Synchronizing Google Workspace Groups and Users
|
||||
|
||||
Return to NetBird. The next two screens allow you to select which Google Workspace groups and users you want to synchronize. By default, NetBird synchronizes all groups and users. If you're okay with syncing everything, click `Continue` on both screens.
|
||||
|
||||
|
||||
|
||||
You can also click on `+ Add group (or user group) filter` to change this settings as you see fit. To finish the integration process, click the `Connect` button.
|
||||
|
||||
|
||||
|
||||
The next screen, should be similar the following one, verifying that the integration was successful:
|
||||
|
||||
|
||||
|
||||
To verify the integration is working correctly, you can also navigate to `Team` > `Users`. Here, you should see your synchronized Google Workspace users listed.
|
||||
|
||||
|
||||
|
||||
The users should be the same listed in Google Workspace Admin console:
|
||||
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
# Provision Users and Groups From Your Identity Provider
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/supported-identity-providers.png" alt="supported-identity-providers"
|
||||
className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Managing private network access in a business environment is a critical yet often cumbersome task.
|
||||
As companies grow and evolve, the manual process of granting access for new employees and revoking it for
|
||||
departing ones becomes increasingly time-consuming and error-prone. This challenge strains IT resources, poses significant
|
||||
security risks, and impacts productivity.
|
||||
|
||||
NetBird's IdP-Sync automates user access management to private networks by integrating with your identity provider (IdP)
|
||||
and automatically provisioning users and groups. This integration ensures that changes to groups and users are
|
||||
synchronized from your identity provider to NetBird, granting appropriate network access to new users and immediately
|
||||
revoking access for departing employees.
|
||||
|
||||
NetBird allows you to use synchronized groups to create [access control policies](/manage/access-control/manage-network-access#creating-policies),
|
||||
or update network configurations like [DNS](/manage/dns#distribution-groups),
|
||||
eliminating the need for manual grouping.
|
||||
|
||||
<Note>
|
||||
This feature is only available in the cloud version of NetBird in the [Team plan](https://netbird.io/pricing) and above.
|
||||
</Note>
|
||||
|
||||
This video guide walks you through an example integration with Microsoft Entra ID, covering both user onboarding and
|
||||
offboarding scenarios:
|
||||
|
||||
<div className="videowrapper">
|
||||
<iframe src="https://www.youtube.com/embed/RxYWTpf7cgY" allow="fullscreen;"></iframe>
|
||||
</div>
|
||||
|
||||
## Supported Identity Providers
|
||||
|
||||
NetBird provides native support for syncing with the most popular identify providers.
|
||||
For detailed setup and configuration steps, select an IdP from the section below:
|
||||
|
||||
* [Entra ID (Azure AD)](/manage/team/idp-sync/microsoft-entra-id-sync)
|
||||
* [Okta](/manage/team/idp-sync/okta-sync)
|
||||
* [Google Workspace](/manage/team/idp-sync/google-workspace-sync)
|
||||
* [JumpCloud](/manage/team/idp-sync/jumpcloud-sync)
|
||||
* [Keycloak](/manage/team/idp-sync/keycloak-sync)
|
||||
|
||||
### Generic SCIM
|
||||
|
||||
NetBird provides a way to sync users and groups from any identity provider that supports the SCIM (System for Cross-domain Identity Management) protocol.
|
||||
SCIM is a standardized protocol that works with most modern identity providers, although configuration varies between providers.
|
||||
|
||||
If your provider is not listed above, contact us at support@netbird.io for assistance with your specific IdP setup.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/generic-scim.png" alt="generic-scim"
|
||||
className="imagewrapper-big"/>
|
||||
</p>
|
||||
@@ -0,0 +1,115 @@
|
||||
# Provision Users and Groups From JumpCloud
|
||||
|
||||
JumpCloud is a comprehensive cloud-based directory platform that provides identity, access, and device management capabilities.
|
||||
It offers features like single sign-on (SSO), multi-factor authentication (MFA), and centralized user management
|
||||
to help organizations secure and manage access to their resources.
|
||||
|
||||
NetBird's JumpCloud integration enhances user management by allowing you to utilize JumpCloud as your identity provider.
|
||||
This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management
|
||||
to your applications and resources.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before you begin the integration process, ensure you have the necessary [admin permissions in JumpCloud](https://jumpcloud.com/support/admin-portal-roles). You need a JumpCloud user account with one of the following roles:
|
||||
|
||||
* Administrator (minimum required)
|
||||
* Administrator with Billing
|
||||
|
||||
These roles have the required permissions to configure SSO applications and manage SCIM provisioning.
|
||||
|
||||
## Setting Up SSO with JumpCloud
|
||||
|
||||
Before configuring SCIM provisioning, you must first set up Single Sign-On (SSO) with JumpCloud. Please follow the detailed setup instructions in our [Single Sign-On guide for JumpCloud](/manage/team/single-sign-on#jump-cloud).
|
||||
|
||||
Once SSO is configured, and you can successfully log in to NetBird using your JumpCloud credentials, you can proceed with the SCIM setup below.
|
||||
|
||||
## Enabling JumpCloud SCIM in NetBird
|
||||
|
||||
To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Provider Sync` in your NetBird dashboard.
|
||||
|
||||
|
||||
|
||||
Click the `Connect Jumpcloud` button to begin the configuration process.
|
||||
|
||||
|
||||
|
||||
Click `Get Started` to launch the configuration wizard. You will be guided through several configuration options:
|
||||
|
||||
**Groups to be synchronized**
|
||||
|
||||
By default, all groups assigned to the NetBird application in JumpCloud will be synchronized. If you want to synchronize only assigned groups that start with a specific prefix, you can specify them in the filter. Keep in mind that the prefix matching is case-sensitive.
|
||||
|
||||
|
||||
|
||||
Click `Continue` to proceed to the next step.
|
||||
|
||||
**Users to be synchronized**
|
||||
|
||||
By default, all users from the groups assigned to the NetBird application will be synchronized. If you want to further filter and synchronize only users from specific assigned groups, you can specify those group names in the filter. The group name matching is case-sensitive.
|
||||
|
||||
|
||||
|
||||
Click `Continue` to generate your SCIM credentials.
|
||||
|
||||
**SCIM Credentials**
|
||||
|
||||
NetBird will generate the SCIM credentials required to configure JumpCloud. Make note of both the **Base URL** and **Token Key** as you will need them in the next section to complete the JumpCloud configuration.
|
||||
|
||||
|
||||
|
||||
Click `Finish Setup` to complete the NetBird SCIM configuration.
|
||||
|
||||
|
||||
|
||||
You can now proceed to configure the SCIM application in JumpCloud using the credentials generated above.
|
||||
|
||||
## Configure SCIM Application in JumpCloud
|
||||
|
||||
In your [JumpCloud admin console](https://console.jumpcloud.com/), go to `SSO Applications`, select your `NetBird`
|
||||
application, and then select the `Identity Management` tab.
|
||||
|
||||
In the **Configuration Settings** section, enter the following SCIM Service Provider details:
|
||||
|
||||
* **API Type**: `SCIM API` (default)
|
||||
* **SCIM Version**: `SCIM 2.0` (default)
|
||||
* **Base URL**: `https://api.netbird.io/api/scim/v2`
|
||||
* **Token Key**: Paste the Bearer token you copied from NetBird
|
||||
* **Test User Email**: Provide a new, unused email address for testing (e.g., `test@yourdomain.com`)
|
||||
|
||||
|
||||
|
||||
* Click `Test Connection` to verify the SCIM connection
|
||||
|
||||
If the connection is successful, you'll see a success message. Click `Activate` to enable SCIM provisioning.
|
||||
|
||||
|
||||
|
||||
## Assigning Groups for SCIM Synchronization
|
||||
|
||||
To enable SCIM synchronization of groups and their memberships to NetBird, you need to assign user groups to the NetBird SCIM application.
|
||||
|
||||
In your [JumpCloud admin console](https://console.jumpcloud.com/):
|
||||
|
||||
* Navigate to your `NetBird` SSO application
|
||||
* Click on the `User Groups` tab
|
||||
* Select the groups whose members you want to synchronize to NetBird
|
||||
* Click `Save` to apply the changes
|
||||
|
||||
|
||||
|
||||
Once saved, JumpCloud will automatically synchronize the selected groups and their user memberships to NetBird.
|
||||
|
||||
## Verify Synchronization
|
||||
|
||||
After assigning groups in JumpCloud, the synchronization will begin automatically. You can verify that users and groups
|
||||
have been successfully synchronized by navigating to `Team > Users` in your NetBird dashboard.
|
||||
|
||||
|
||||
|
||||
<Note>
|
||||
SCIM provisioning will manage only resources that are created through Jumpcloud. Any resources created directly in NetBird will not be managed by SCIM.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Synced groups will only be available for membership and will not change the role of user in NetBird
|
||||
</Note>
|
||||
@@ -0,0 +1,165 @@
|
||||
# Provision Users and Groups From Keycloak
|
||||
|
||||
Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO),
|
||||
multi-factor authentication (MFA), user federation, and centralized identity management to help organizations
|
||||
secure and manage access to their applications and resources.
|
||||
|
||||
NetBird's Keycloak integration enhances user management by allowing you to utilize Keycloak as your identity provider.
|
||||
This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management
|
||||
to your applications and resources.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before you begin the integration process, ensure you have the necessary permissions in Keycloak. You need:
|
||||
|
||||
* The `scim-admin` or `realm-admin` role assigned to your user to access the SCIM Administration Console
|
||||
* [SCIM for Keycloak plugin installed](https://scim-for-keycloak.de/)
|
||||
|
||||
Once the SCIM plugin is installed, you should see the SCIM section available in your Keycloak admin console.
|
||||
|
||||
|
||||
|
||||
## Setting Up SSO with Keycloak
|
||||
|
||||
Before configuring SCIM provisioning, you must first set up Single Sign-On (SSO) with Keycloak. Please follow the detailed setup instructions in our [Single Sign-On guide for Keycloak](/manage/team/single-sign-on#keycloak).
|
||||
|
||||
Once SSO is configured, and you can successfully log in to NetBird using your Keycloak credentials, you can proceed with the SCIM setup below.
|
||||
|
||||
## Enabling Keycloak SCIM in NetBird
|
||||
|
||||
To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Provider Sync` in your NetBird dashboard.
|
||||
|
||||
|
||||
|
||||
Click the `Connect Generic SCIM` button to begin the configuration process.
|
||||
|
||||
|
||||
|
||||
Click `Get Started` to launch the configuration wizard. You will be guided through several configuration options:
|
||||
|
||||
**Groups to be synchronized**
|
||||
|
||||
By default, all groups mapped in the Keycloak SCIM client will be synchronized. If you want to synchronize only groups that start with a specific prefix, you can specify them in the filter. Keep in mind that the prefix matching is case-sensitive.
|
||||
|
||||
|
||||
|
||||
Click `Continue` to proceed to the next step.
|
||||
|
||||
**Users to be synchronized**
|
||||
|
||||
By default, all users from the mapped groups will be synchronized. If you want to further filter and synchronize only users from specific groups, you can specify those group names in the filter. The group name matching is case-sensitive.
|
||||
|
||||
|
||||
|
||||
Click `Continue` to generate your SCIM credentials.
|
||||
|
||||
**SCIM Credentials**
|
||||
|
||||
NetBird will generate the SCIM credentials required to configure Keycloak. Make note of both the **Base URL** and **Token Key** as you will need them in the next section to complete the Keycloak configuration.
|
||||
|
||||
|
||||
|
||||
Click `Finish Setup` to complete the NetBird SCIM configuration.
|
||||
|
||||
|
||||
|
||||
You can now proceed to configure the SCIM client in Keycloak using the credentials generated above.
|
||||
|
||||
## Configure SCIM Client in Keycloak
|
||||
|
||||
To configure SCIM in Keycloak, you need to access the SCIM Administration Console and create a service provider configuration.
|
||||
|
||||
Navigate to the SCIM Administration Console. On the first login screen, enter your realm name (e.g., `netbird`) and click `Start Login`.
|
||||
|
||||
|
||||
|
||||
Once logged in, navigate to the `SCIM Client` menu and click on `Remote SCIM Provider`. Then click the `+` button to add a new service provider configuration.
|
||||
|
||||
|
||||
|
||||
In the SCIM Remote Provider Configuration form, fill out the following sections:
|
||||
|
||||
**SCIM Provider Details:**
|
||||
* **Name**: `NetBird`
|
||||
* **Provider Enabled**: Enable this checkbox
|
||||
* **Is User Federation Provider active**: Enable this checkbox only if you are using a federation provider like LDAP. Otherwise, leave it disabled
|
||||
* **Send externalId as id in requests**: Enable this checkbox
|
||||
|
||||
**Connection Details:**
|
||||
* **Base URL**: Paste the Base URL you copied from NetBird (e.g., `https://api.netbird.io/api/scim/v2`)
|
||||
* **Hostname-Verifier Enabled**: Enable this checkbox
|
||||
|
||||
|
||||
|
||||
**Authentication:**
|
||||
* **Authentication Type**: Select `Long Life Bearer Token Authentication`
|
||||
* **Bearer Token**: Paste the Token Key you copied from NetBird
|
||||
|
||||
Click `Add` to save the configuration.
|
||||
|
||||
|
||||
|
||||
After adding the configuration, click `Save Configuration` and then click `Use default Configuration` to apply the settings.
|
||||
The default schema for the SCIM provider will be created automatically.
|
||||
|
||||
|
||||
|
||||
Next, assign the SCIM provider to your realm. Click the `Realm Assignment` tab to view all available realms.
|
||||
|
||||
|
||||
|
||||
Find your realm (e.g., `netbird`) and click `Assign to Realm` to enable SCIM synchronization for that realm.
|
||||
|
||||
|
||||
|
||||
## Configure Resource Filtering
|
||||
|
||||
By default, the SCIM provider will synchronize all groups and users from your Keycloak realm to NetBird.
|
||||
To control which specific groups and users should be synchronized, you need to configure resource filtering rules.
|
||||
|
||||
Under the `SCIM Client` menu section, click on `Remote SCIM Provider`, then click `Edit` in the NetBird provider row.
|
||||
Select the `Resource Filtering Rules` tab.
|
||||
|
||||
|
||||
|
||||
**User Filtering**
|
||||
|
||||
To synchronize only users from specific groups, configure the user filtering rule and click `Save Configuration`:
|
||||
|
||||
* **Invert Filter Rule**: Leave this checkbox disabled
|
||||
* **Filter Type**: Select `Group`
|
||||
* **Group Name**: Enter the name of the group to sync users from
|
||||
|
||||
**Group Filtering**
|
||||
|
||||
To synchronize only groups that match specific criteria, configure the group filtering rule and click `Save Configuration`:
|
||||
|
||||
* **Invert Filter Rule**: Leave this checkbox disabled
|
||||
* **Filter Type**: Select `Property`
|
||||
* **Property Name**: Enter `Groupname`
|
||||
* **Comparator**: Select `Contains`
|
||||
* **Comparison Value**: Enter the text that should be contained in the group name
|
||||
|
||||
|
||||
|
||||
<Note>
|
||||
By default, Keycloak SCIM will not automatically push existing users and groups after the initial configuration.
|
||||
To synchronize existing resources, navigate to `Synchronization` tab. Here you will find two tabs for Users and
|
||||
Groups where you can manually trigger the initial sync.
|
||||
</Note>
|
||||
|
||||
## Verify Synchronization
|
||||
|
||||
After configuring mappings in Keycloak, the synchronization will begin based on your schedule settings. You can verify that users and groups
|
||||
have been successfully synchronized by navigating to `Team > Users` in your NetBird dashboard.
|
||||
|
||||
|
||||
|
||||
<Note>
|
||||
SCIM provisioning will manage only resources that are created through Keycloak. Any resources created directly in
|
||||
NetBird will not be managed by SCIM.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Synced groups will only be available for membership and will not change the role of user in NetBird
|
||||
</Note>
|
||||
@@ -0,0 +1,186 @@
|
||||
# Provision Users and Groups From Microsoft Entra ID
|
||||
|
||||
[Microsoft Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id),
|
||||
formerly known as Azure Active Directory (Azure AD), is a cloud-based identity and access management service that provides
|
||||
organizations with secure authentication, single sign-on, and user management capabilities. In the context of network security,
|
||||
it can be effectively used to control network access based on organizational structure, such as groups and individual user accounts.
|
||||
|
||||
NetBird's Microsoft Entra ID integration allows you to synchronize users and groups from Entra ID to NetBird.
|
||||
You can then use these synchronized groups to configure your network, create network access policies, and automate
|
||||
onboarding and offboarding processes.
|
||||
|
||||
## Get Started with NetBird-Entra ID Integration
|
||||
|
||||
To get started, navigate to [Integrations](https://app.netbird.io/integrations) in the left menu, which will take you to the
|
||||
`Identity Provider` integration. Click the `Entra ID (Azure AD)` button. This action will trigger a pop-up window that will
|
||||
present you with a user-friendly wizard, guiding you through the synchronization process between NetBird and Azure AD.
|
||||
|
||||
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before starting the integration process, verify that you have the required permissions in Microsoft Entra ID (Azure AD).
|
||||
Specifically, you will need an Azure user account with at least one of these roles:
|
||||
|
||||
* Application Administrator
|
||||
* Cloud Application Administrator
|
||||
* Global Administrator
|
||||
|
||||
To check your permissions:
|
||||
|
||||
* Log in to the [Azure portal](portal.azure.com).
|
||||
* Navigate to Manage Microsoft Entra ID and click `View`.
|
||||
* Expand the `Manage` tab and click on `Roles and administrators` in the left menu.
|
||||
* Look for your username and verify if you're assigned any of the above roles.
|
||||
|
||||
|
||||
|
||||
If you don't have the required permissions, contact your Azure AD administrator to grant you the appropriate role before proceeding with the NetBird integration.
|
||||
|
||||
## Create and Configure a Microsoft Entra ID Application for NetBird Integration
|
||||
|
||||
Now that you have the required permissions, return to the NetBird dashboard. Click on the `Get Started` button to initiate the integration process.
|
||||
|
||||
A new wizard screen will appear, offering step-by-step instructions for creating and configuring your Microsoft Entra ID application. To simplify the process, the wizard also provides quick-copy buttons for essential information:
|
||||
|
||||
* Name
|
||||
* Account Type
|
||||
* Redirect Type
|
||||
* Redirect URI
|
||||
|
||||
|
||||
|
||||
For convenience, click on [Azure Active Directory](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) (step 1). That will open the Azure dashboard. Navigate to `App registrations` in the left menu and then click `+New registration` as indicated below:
|
||||
|
||||
|
||||
|
||||
Fill in the required information:
|
||||
|
||||
|
||||
|
||||
After entering all required information, click the `Register` button at the bottom of the form to finalize the application registration process.
|
||||
|
||||
Upon successful registration, you'll be redirected to a confirmation screen similar to the following:
|
||||
|
||||
|
||||
|
||||
Copy and securely store the generated `Application (client) ID` and `Directory (tenant) ID` as you will need them shortly.
|
||||
|
||||
## Configure API Permissions for NetBird-Entra ID Integration
|
||||
|
||||
On the NetBird dashboard click the `Continue →` button. A new wizard screen will appear, this time, offering step-by-step instructions for setting up API permissions.
|
||||
|
||||
|
||||
|
||||
Back to Azure, in the `App registrations` screen, click on `Manage` in the left menu to expand it and then click on `API permissions`:
|
||||
|
||||
|
||||
|
||||
Look for the `+ Add a permission` button, located near the top of the permissions list and click on it.
|
||||
|
||||
|
||||
|
||||
A new pop-up window will appear, asking you to select an API. Click on `Microsoft Graph`.
|
||||
|
||||
|
||||
|
||||
On the next screen, click on the `Application permissions` button, which will let you select the appropriate permissions for NetBird to function correctly with your Microsoft Entra ID environment.
|
||||
|
||||
|
||||
|
||||
To assign user permissions:
|
||||
|
||||
* Locate the search bar at the top. Type `User.Read.All` into the search bar and press `Enter`.
|
||||
* In the search results, click on the `User` tab to expand it and view the available permissions.
|
||||
* Click on the checkbox to select and enable the `User.Read.All` permission.
|
||||
|
||||
|
||||
|
||||
The `User.Read.All` permission allows NetBird to read the full set of profile properties, group memberships, and reports of the signed-in user and other users in your organization.
|
||||
|
||||
Next, repeat the procedure. This time, search for `Group.Read.All` and click on the checkbox to enable it as shown below:
|
||||
|
||||
|
||||
|
||||
Once done, click the `Add permissions` button. You will see a few warnings:
|
||||
|
||||
|
||||
|
||||
Locate the `Grant admin consent for [Your Organization Name]` button (you’ll find it next to `+Add a permission` button). Click on it to grant the required permissions.
|
||||
|
||||
A confirmation dialog will appear, asking you to verify this action. Review the permissions listed in the dialog and click `Yes` to confirm. Wait for the process to complete, this may take a few seconds.
|
||||
|
||||
Once finished, the status of the permissions should change to `Granted for [Your Organization Name]`. Verify that all selected permissions now show a green checkmark, indicating they've been successfully granted:
|
||||
|
||||
|
||||
|
||||
## Create a Client Secret for Secure NetBird-Entra ID Authentication
|
||||
|
||||
Back to the NetBird dashboard, click the `Continue →` button. A new wizard screen will appear, showing instructions for generating a client secret in Entra ID.
|
||||
|
||||
|
||||
|
||||
On Azure, click on the `Certificates & secrets` button in the left menu to open the management page. Click on `+New client secret` as shown below. Choose an expiration time that suits your security needs and click the `Add` button.
|
||||
|
||||
|
||||
|
||||
A new client secret will be generated and displayed on the screen. Copy and securely store the `Value` field immediately, as you will needed in the next step.
|
||||
|
||||
|
||||
|
||||
## Enter Application ID and Directory ID in NetBird
|
||||
|
||||
Paste the secret `Value` from the previous step into NetBird and click the `Continue →` button. A new wizard screen will appear, asking for the `Application (client) ID` and the `Directory (tenant) ID` credentials generated previously.
|
||||
|
||||
Paste the values and click the `Continue →` button.
|
||||
|
||||
|
||||
|
||||
## Choose Groups to Synchronize from Entra ID
|
||||
At this stage, NetBird is set to synchronize all groups from your Microsoft Entra ID by default. You have two options:
|
||||
|
||||
* If you want to synchronize all groups, simply click the `Continue →` button.
|
||||
* To synchronize only specific groups, click the `+ Add group filter` button, which will open a new panel where you can set criteria to include or exclude groups.
|
||||
|
||||
|
||||
|
||||
## Choose Users to Synchronize from Entra ID
|
||||
After configuring group synchronization, you'll now set up user synchronization. Similar than before, NetBird is configured to synchronize all users from your Microsoft Entra ID by default.
|
||||
|
||||
* If you want to synchronize all users, you don't need to take any action, simply click the `Continue →` button.
|
||||
* To synchronize only specific users, click the `+ Add user filter` button. This opens a new panel where you can set criteria to include or exclude users.
|
||||
|
||||
<Note>
|
||||
You can modify these synchronization settings later if necessary.
|
||||
</Note>
|
||||
|
||||
|
||||
|
||||
After configuring user and group synchronization, the setup wizard will finalize the process and you'll automatically return to the main Identity Provider screen.
|
||||
|
||||
On this screen, you'll see two key indicators of successful integration:
|
||||
|
||||
* The Microsoft Entra ID toggle will be switched on (enabled).
|
||||
* Next to the toggle, you'll see a button with a status message saying `Synced a few seconds ago`.
|
||||
|
||||
These indicators confirm that:
|
||||
|
||||
* The integration between NetBird and Microsoft Entra ID is active.
|
||||
* The initial synchronization has been completed successfully.
|
||||
* NetBird will now automatically sync with your Microsoft Entra ID at regular intervals.
|
||||
|
||||
<Note>
|
||||
You can manually trigger a sync or adjust settings by clicking on the Microsoft Entra ID section in the Identity Provider screen
|
||||
</Note>
|
||||
|
||||
|
||||
|
||||
## Verify the Integration
|
||||
|
||||
To verify the synchronization, navigate to `Teams > Users` in the left menu.
|
||||
You should see all the users and groups from your Microsoft Entra ID environment listed in the NetBird dashboard.
|
||||
|
||||
|
||||
|
||||
You can now proceed to configure [access control policies](/manage/access-control/manage-network-access#creating-policies) using the synchronized groups to allow or deny access to the
|
||||
synchronized users.
|
||||
@@ -0,0 +1,220 @@
|
||||
import {
|
||||
Note
|
||||
} from "@/components/mdx";
|
||||
|
||||
# Provision Users and Groups From Okta
|
||||
|
||||
Okta is a cloud-based identity and access management (IAM) platform that centralizes user and customer profiles to enhance
|
||||
security and streamline access. It offers features like multifactor authentication, single sign-on, and lifecycle
|
||||
management to help organizations manage user identities effectively.
|
||||
|
||||
NetBird's Okta integration enhances user management by allowing you to utilize Okta as your identity provider.
|
||||
This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management
|
||||
to your applications and resources.
|
||||
|
||||
The integration process consists of two stages: first, you’ll set up OpenID Connect (OIDC) to enable Single Sign-On (SSO)
|
||||
from NetBird's login page using Okta credentials. Next, you’ll configure SCIM (System for Cross-domain Identity Management)
|
||||
to synchronize users and groups smoothly.
|
||||
|
||||
## Get Started with NetBird-Okta Integration
|
||||
|
||||
To set up SSO, go to `Integrations` in the NetBird admin console's left menu to access the Identity Provider integration page. Click the `Connect Okta` button to get started with the Okta-NetBird integration. This will open a pop-up window with detailed instructions on synchronizing NetBird and Okta.
|
||||
|
||||
|
||||
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before you begin the integration process, ensure you have the [necessary permissions in Okta](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm). You need an Okta user account with one of the following roles:
|
||||
|
||||
* Super Admin
|
||||
* Org Admin
|
||||
* Group Admin
|
||||
|
||||
To check your user permissions in Okta:
|
||||
|
||||
* Log in to your Okta **admin** dashboard.
|
||||
* Expand `People` in the left menu.
|
||||
* Select your user.
|
||||
* Navigate to the `Admin roles` tab.
|
||||
|
||||
Confirm that you have one of the required roles before proceeding with the integration.
|
||||
|
||||
|
||||
|
||||
|
||||
## Installing the NetBird Integration
|
||||
|
||||
Once you have the necessary permissions, you can set up the NetBird application. First, on NetBird, click `Continue →` to show a summary of the necessary steps.
|
||||
|
||||
|
||||
|
||||
|
||||
Let's go through them one by one:
|
||||
|
||||
* In Okta’s admin dashboard, click `Applications` in the left menu.
|
||||
* Select `Applications` from the submenu.
|
||||
* Click the `Browse App Catalog` button.
|
||||
|
||||
|
||||
|
||||
|
||||
In the app catalog, enter "NetBird" in the search bar. Then, click the `Add Integration` button.
|
||||
|
||||
|
||||
|
||||
|
||||
Accept the default application name and click the `Done` button. On the next screen, click the `Assign` dropdown and select `Assign to People`.
|
||||
|
||||
|
||||
|
||||
|
||||
You will see a list of users. Find your user account, click `Assign`, and save the changes. Verify your user is assigned to the NetBird app and click `Done`.
|
||||
|
||||
|
||||
|
||||
|
||||
After that, you will see your user listed in the NetBird application.
|
||||
|
||||
|
||||
|
||||
|
||||
## Configuring SSO in Okta
|
||||
|
||||
The next step is to configure Okta-NetBird SSO integration.
|
||||
|
||||
In NetBird, click the `Continue →` button. A new wizard screen will appear, offering the instructions for retrieving Okta’s OpenID Connect credentials. You can click `Close` and navigate to Okta.
|
||||
|
||||
|
||||
|
||||
|
||||
* Click on the `Sign On` tab on Okta. Look for `OpenID Connect` under `Sign on methods` in the `Settings` section.
|
||||
* Copy the `Client ID` value.
|
||||
* Copy the `Client Secret` value.
|
||||
|
||||
Store these credentials securely, as you will need them soon.
|
||||
|
||||
|
||||
|
||||
|
||||
* Click `Edit` in the `Settings` section.
|
||||
* In `Credential Details`, change the `Application username format` from `Okta username` to `Email`.
|
||||
* Click the `Save` button
|
||||
|
||||
|
||||
|
||||
* On the top right, click on your username
|
||||
* Copy your [Okta account domain](https://developer.okta.com/docs/guides/find-your-domain/main/) as shown below:
|
||||
|
||||
|
||||
|
||||
The final step is to [send an email to the NetBird team](support@netbird.io) with the authentication information you just retrieved:
|
||||
|
||||
* Okta `Client ID`
|
||||
* Okta `Client secret`
|
||||
* Okta account domain
|
||||
* Okta primary email domain (usually your username)
|
||||
|
||||
You will receive an email once the NetBird team enables authentication for your account.
|
||||
|
||||
This completes the first stage, enabling Single Sign-On (SSO) from NetBird's login page using Okta credentials. Now, you can navigate to [app.netbird.io](app.netbird.io) and log in using [Okta Verify](https://help.okta.com/eu/en-us/content/topics/end-user/ov-overview.htm).
|
||||
|
||||
## Enabling Okta SCIM in NetBird
|
||||
|
||||
In NetBird, go to `Integrations > Identity Provider` and click on the `Connect to Okta` button.
|
||||
|
||||
|
||||
|
||||
You will see a reminder of the permissions your user will require in Okta. Click the `Get Started →` button to continue.
|
||||
|
||||
|
||||
|
||||
If you haven't already, you'll need to set up SSO in Okta. If you've completed the previous section, skip this step and click the `Continue →` button.
|
||||
|
||||
|
||||
|
||||
The next screen will show you how to enable NetBird API credentials in Okta. Copy the value of the `Authorization (Bearer)` token.
|
||||
|
||||
|
||||
|
||||
Navigate to the NetBird app in your Okta admin dashboard. Click the `Provisioning` tab, then select `Configure API Integration`.
|
||||
|
||||
|
||||
|
||||
Follow these steps:
|
||||
|
||||
* Check the box to enable API Integration.
|
||||
* Enter your NetBird API Token.
|
||||
* Click `Test API Credentials` to verify the SCIM connection.
|
||||
|
||||
|
||||
|
||||
If everything works as expected, you'll see the message: "NetBird was verified successfully!" as shown below. Click `Save` to continue.
|
||||
|
||||
|
||||
|
||||
## Configuring SCIM Provisioning to NetBird
|
||||
|
||||
On NetBird, click `Continue →`. You'll see instructions for configuring SCIM provisioning to NetBird.
|
||||
|
||||
|
||||
|
||||
Back to Okta, click `Edit` as shown below.
|
||||
|
||||
|
||||
|
||||
Enable Okta to create, update, and deactivate NetBird users by checking the corresponding boxes:
|
||||
|
||||
* Create Users
|
||||
* Update User Attributes
|
||||
* Deactivate Users
|
||||
|
||||
When done, click `Save`.
|
||||
|
||||
|
||||
|
||||
## Assigning NetBird Application to Okta Groups
|
||||
|
||||
In NetBird, click `Continue →`, you'll see the steps for assigning the NetBird integration to Okta groups.
|
||||
|
||||
|
||||
|
||||
* Navigate to the `Assignments` tab.
|
||||
* Similar than before when you assigned your user to NetBird app, click the `Assign` button
|
||||
* This time, select `Assign to Groups`.
|
||||
* Select Okta groups that you want to assign to the NetBird app.
|
||||
|
||||
|
||||
|
||||
Once you assign the desired groups, click `Done`. You'll see the selected groups listed in Okta.
|
||||
|
||||
|
||||
|
||||
## Push Okta Groups to NetBird
|
||||
|
||||
One more time, go to NetBird and click `Continue →`. You'll see the final instructions to push Okta groups to NetBird.
|
||||
|
||||
|
||||
|
||||
* In Okta, navigate to `Push Groups` tab
|
||||
* Click the `Push Groups` button
|
||||
* Select `Find groups by name`
|
||||
* Search for specific groups to push to NetBird.
|
||||
|
||||
|
||||
|
||||
Once you finish, go back to NetBird and click `Finish Setup`. You can verify the synchronization by navigating to `Team > Users`
|
||||
|
||||
|
||||
|
||||
The users listed in NetBird should match those you created in Okta.
|
||||
|
||||
|
||||
|
||||
<Note>
|
||||
SCIM provisioning will manage only resources that are created through Okta. Any resources created directly in NetBird will not be managed by SCIM.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Synced groups will only be available for membership and will not change the role of user in NetBird
|
||||
</Note>
|
||||
@@ -0,0 +1,249 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Authenticate to NetBird with Single Sign On (SSO)
|
||||
|
||||
NetBird works out of the box with popular Identity Providers (IdPs) such as Google Workspace, Microsoft Entra ID, and Okta,
|
||||
offering seamless Single Sign-On (SSO) for your users.
|
||||
|
||||
It also supports social logins including Google, GitHub, and Microsoft accounts.
|
||||
|
||||
For other OIDC (OpenID Connect)-compliant IdPs like Authentik, Keycloak, JumpCloud, and others, NetBird provides full support,
|
||||
though some additional configuration is required to complete the integration.
|
||||
|
||||
<Note>
|
||||
This guide covers the setup for cloud-hosted NetBird. If you are using the self-hosted version, please refer
|
||||
to the [self-hosted documentation](/selfhosted/identity-providers).
|
||||
</Note>
|
||||
|
||||
## Google, Microsoft, and GitHub
|
||||
|
||||
If you're using Google Workspace, Microsoft Entra ID, or a supported social login, you can simply sign in with no extra
|
||||
setup—just click the appropriate button on the [login page](https://app.netbird.io/):
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/netbird-login.png" alt="netbird-login" className="imagewrapper"/>
|
||||
</p>
|
||||
|
||||
## Okta
|
||||
|
||||
If you are using Okta as your Identity Provider, sign up with any email address and then follow the steps described
|
||||
in [this guide](/manage/team/idp-sync/okta-sync#get-started-with-net-bird-okta-integration)
|
||||
|
||||
## OIDC-compliant IdPs
|
||||
|
||||
For OIDC-compliant Identity Providers such as **Authentik**, **Keycloak**, and others, you’ll need to configure the IdP
|
||||
to integrate with NetBird. Below are the steps to set up different OIDC-compliant IdPs with NetBird.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
The Free plan supports Google, Microsoft, and social logins.
|
||||
</Note>
|
||||
|
||||
### Authentik
|
||||
|
||||
1. You need to create a new Application and Provider.
|
||||
- Browse to the Applications Administration menu, click on Application, and then click on Create with Provider:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/1-create-with-provider.png" alt="create-with-provider" className="imagewrapper-big"/>
|
||||
</p>
|
||||
- Name the Application and select a suitable explicit user flow. In the example below, we used NetBird:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/2-new-application.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next and select the OAuth2/OpenID Provider Type:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/3-new-application-type.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next and select an explicit user authorization flow, then take note of the Client ID and Client Secret:
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/4-new-application-client-id.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Add the following redirect URL and select a signing key: <br/>
|
||||
URL: `https://login.netbird.io/login/callback`
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/5-new-application-sign.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click on Advanced protocol settings and ensure that the email, opened, and profile scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/6-new-application-scopes.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next on the following two screens and Submit to create the provider and application:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/7-new-application-submit.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- You should see an application listed as follow:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/8-list-applications.png" alt="list-applications" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
2. We need to copy the OpenID Configuration URL for the new provider. You can do that by navigating to Providers in the left menu and then selecting the newly created provider. There you should see a windows similar to the following:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/9-list-providers.png" alt="list-providers" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Copy the OpenID Configuration URL.
|
||||
|
||||
|
||||
3. Then, share the following information with the NetBird support team at support@netbird.io:
|
||||
|
||||
- Client ID
|
||||
- Client Secret
|
||||
- OpenID Configuration URL
|
||||
- Email domains for your users
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
https://onetimesecret.com/en/ <br/>
|
||||
https://password.link/en
|
||||
</Note>
|
||||
|
||||
### Keycloak
|
||||
|
||||
1. You need to create a new client
|
||||
|
||||
- Browse to the clients Administration menu and then click in Create client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/1-new-client.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
2. Create a client with the type OpenID Connect and add any client ID and name for the client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/2-new-client-type.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
3. Click Next and enable the following options for Capability config:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/3-new-client-capability.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. Click Next and fill the following fields:
|
||||
|
||||
Valid redirect URIs: `https://login.netbird.io/login/callback` <br/>
|
||||
Web origins: `+`
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/4-new-client-callback.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
5. Click Save.
|
||||
|
||||
6. Next we need to retrieve the secret for the client, you can get that in the Credentials tab for the client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/5-new-client-credentials.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
7. Then, share the following information with the NetBird support team at support@netbird.io:
|
||||
|
||||
- Client ID
|
||||
- Keycloak URL
|
||||
- Realm
|
||||
- Client Secret
|
||||
- Email domains for your users
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
https://onetimesecret.com/en/ <br/>
|
||||
https://password.link/en
|
||||
</Note>
|
||||
|
||||
### JumpCloud
|
||||
|
||||
1. Access the JumpCloud and navigate to USER AUTHENTICATION > SSO Applications
|
||||
|
||||
2. Click + Add New Application, select Custom Application and click Next
|
||||
|
||||
3. Enable Manage Single Sign-On (SSO), select Configure SSO with OIDC and click Next
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/jumpcloud-idp/jumpcloud-sso.png" alt="jumpcloud" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. Add NetBird as Display Label and click Next. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
|
||||
|
||||
5. Review the application setting and click Configure Application to proceed
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/jumpcloud-idp/jumpcloud-sso-config.png" alt="jumpcloud-idp" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
6. On the New Application screen, go to the SSO tab and under Endpoint Configuration set the following values:
|
||||
|
||||
- Redirect URIs: https://login.netbird.io/login/callback
|
||||
|
||||
- Login URL: https://app.netbird.io
|
||||
|
||||
7. Under Attribute Mapping enable Email and Profile scopes
|
||||
|
||||
<Note>
|
||||
Sometimes, the Jumpcloud application configuration will add duplicate attributes, like email and email_verified. The duplicates should be removed.
|
||||
</Note>
|
||||
|
||||
8. Go to the User Groups and select the list of groups to which you want to give access to the application and then click activate
|
||||
|
||||
9. Record the Client ID and Client Secret that JumpCloud generates for your application.
|
||||
|
||||
10. Share your Client ID, and Client Secret with our team. Please use a secure method for sharing this information.
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
- https://onetimesecret.com/en/ <br/>
|
||||
- https://password.link/en <br/>
|
||||
</Note>
|
||||
|
||||
### Auth0
|
||||
|
||||
1. Access the [Auth0 console](https://manage.auth0.com/) and navigate to Applications > Applications
|
||||
|
||||
2. Click **+ Create Application**
|
||||
|
||||
3. Enter **NetBird** as the name, select **Single Page Web Applications** as the application type and click **Create**
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-create.png" alt="auth0-application-create" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. On the New Application screen, go to the Settings tab and under Application URIs set the following values:
|
||||
- Application Login URI: https://app.netbird.io
|
||||
- Allowed Callback URLs: https://login.netbird.io/login/callback
|
||||
- Allowed Logout URLs: https://app.netbird.io
|
||||
- Allowed Web Origins: https://app.netbird.io
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-configure.png" alt="auth0-application-configure" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
6. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
|
||||
|
||||
7. Retrieve Application's **Domain** from the **Basic Information** tab
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-domain.png" alt="auth0-application-domain" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
8. Share following with our team. Please use a secure method for sharing the sensitive parts of this information:
|
||||
1. Application's **Domain**,
|
||||
2. (sensitive) **Client ID** and **Client Secret**,
|
||||
3. list of email domains to be registered for this SSO configuration,
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
- https://onetimesecret.com/en/ <br/>
|
||||
- https://password.link/en <br/>
|
||||
</Note>
|
||||
Reference in New Issue
Block a user