diff --git a/public/docs-static/img/how-to-guides/netbird-idp-list.png b/public/docs-static/img/how-to-guides/netbird-idp-list.png new file mode 100644 index 00000000..f9fac70e Binary files /dev/null and b/public/docs-static/img/how-to-guides/netbird-idp-list.png differ diff --git a/public/docs-static/img/how-to-guides/okta-assign-users-by-group.png b/public/docs-static/img/how-to-guides/okta-assign-users-by-group.png new file mode 100644 index 00000000..d69b4d7e Binary files /dev/null and b/public/docs-static/img/how-to-guides/okta-assign-users-by-group.png differ diff --git a/public/docs-static/img/how-to-guides/okta-connector-configuration-test.png b/public/docs-static/img/how-to-guides/okta-connector-configuration-test.png deleted file mode 100644 index fb94bed5..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-connector-configuration-test.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-group-push-status.png b/public/docs-static/img/how-to-guides/okta-group-push-status.png deleted file mode 100644 index f85ed132..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-group-push-status.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-groups-assignments.png b/public/docs-static/img/how-to-guides/okta-groups-assignments.png deleted file mode 100644 index adf364e3..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-groups-assignments.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-netbird-app-overview.png b/public/docs-static/img/how-to-guides/okta-netbird-app-overview.png deleted file mode 100644 index 47a55c4a..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-netbird-app-overview.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-new-application.png b/public/docs-static/img/how-to-guides/okta-new-application.png deleted file mode 100644 index b81c68c7..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-new-application.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-provisioning-enabled.png b/public/docs-static/img/how-to-guides/okta-provisioning-enabled.png new file mode 100644 index 00000000..8b3b88f4 Binary files /dev/null and b/public/docs-static/img/how-to-guides/okta-provisioning-enabled.png differ diff --git a/public/docs-static/img/how-to-guides/okta-provisioning.png b/public/docs-static/img/how-to-guides/okta-provisioning.png new file mode 100644 index 00000000..fcc8f2e1 Binary files /dev/null and b/public/docs-static/img/how-to-guides/okta-provisioning.png differ diff --git a/public/docs-static/img/how-to-guides/okta-push-group-assignment.png b/public/docs-static/img/how-to-guides/okta-push-group-assignment.png deleted file mode 100644 index 0ca6e334..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-push-group-assignment.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-push-groups.png b/public/docs-static/img/how-to-guides/okta-push-groups.png new file mode 100644 index 00000000..fe21fa02 Binary files /dev/null and b/public/docs-static/img/how-to-guides/okta-push-groups.png differ diff --git a/public/docs-static/img/how-to-guides/okta-saml-configuration-feedback.png b/public/docs-static/img/how-to-guides/okta-saml-configuration-feedback.png deleted file mode 100644 index c0d16f1a..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-saml-configuration-feedback.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-saml-configuration.png b/public/docs-static/img/how-to-guides/okta-saml-configuration.png deleted file mode 100644 index 00f3c956..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-saml-configuration.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-saml-general-settings.png b/public/docs-static/img/how-to-guides/okta-saml-general-settings.png deleted file mode 100644 index 28338cf3..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-saml-general-settings.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-scim-credentials.png b/public/docs-static/img/how-to-guides/okta-scim-credentials.png new file mode 100644 index 00000000..ba441802 Binary files /dev/null and b/public/docs-static/img/how-to-guides/okta-scim-credentials.png differ diff --git a/public/docs-static/img/how-to-guides/okta-scim-provisioning-enabled.png b/public/docs-static/img/how-to-guides/okta-scim-provisioning-enabled.png deleted file mode 100644 index 682e2fa5..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-scim-provisioning-enabled.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-scim-provisioning-settings.png b/public/docs-static/img/how-to-guides/okta-scim-provisioning-settings.png deleted file mode 100644 index de7002f0..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-scim-provisioning-settings.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-scim-to-app-configuration.png b/public/docs-static/img/how-to-guides/okta-scim-to-app-configuration.png deleted file mode 100644 index 87a7825d..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-scim-to-app-configuration.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-scim-to-app-sync-enabled.png b/public/docs-static/img/how-to-guides/okta-scim-to-app-sync-enabled.png deleted file mode 100644 index 31186100..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-scim-to-app-sync-enabled.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-sso-configuration.png b/public/docs-static/img/how-to-guides/okta-sso-configuration.png new file mode 100644 index 00000000..5a2afc10 Binary files /dev/null and b/public/docs-static/img/how-to-guides/okta-sso-configuration.png differ diff --git a/public/docs-static/img/how-to-guides/okta-sync-groups.png b/public/docs-static/img/how-to-guides/okta-sync-groups.png deleted file mode 100644 index 0fb7585d..00000000 Binary files a/public/docs-static/img/how-to-guides/okta-sync-groups.png and /dev/null differ diff --git a/public/docs-static/img/how-to-guides/okta-to-app-configuration.png b/public/docs-static/img/how-to-guides/okta-to-app-configuration.png new file mode 100644 index 00000000..7079fcb4 Binary files /dev/null and b/public/docs-static/img/how-to-guides/okta-to-app-configuration.png differ diff --git a/src/pages/how-to/idp-sync.mdx b/src/pages/how-to/idp-sync.mdx index 4febeae6..c891a3c9 100644 --- a/src/pages/how-to/idp-sync.mdx +++ b/src/pages/how-to/idp-sync.mdx @@ -33,7 +33,7 @@ Before you start creating and configuring an Google Workspace application, ensur edit-service-account

-- Take note of service account email address, we will use it in next steps +- Take note of service account email address, you will use it in next steps - Click the `Keys` tab - Click the `Add key` drop-down menu, then select `Create new key` - Select `JSON` as the Key type and click `Create` @@ -126,123 +126,88 @@ Before you start creating and configuring an Azure AD application, ensure that y ### Okta -#### Step 1. Create and configure SAML 2.0 application -In this step, we will create and configure NetBird SAML 2.0 application in okta. -- Navigate to Okta Admin Dashboard -- Click `Applications` in the left menu and then click on `Applications` -- Click `Create App Integration` -- Fill in the form with the following values and click `Next` - - Sign-in method: `SAML 2.0` +If your organization relies on Okta for managing employee access, automating access to NetBird via Okta's `Provisioning` feature can streamline your operations. This integration leverages `SCIM` (System for Cross-domain Identity Management) to ensure smooth synchronization of users and groups. For comprehensive insights into Okta's SCIM capabilities, please consult this [article](https://www.okta.com/blog/2017/01/what-is-scim/). + +#### Prerequisites +- Begin by installing the NetBird application from the [Okta Integration Network](https://www.okta.com/integrations/netbird) +- Following installation, reach out to support to activate Okta SSO for your [support](mailto:support@netbird.io). + +#### Supported Features + +- **Create Users**: Users added through Okta will automatically be created in NetBird. +- **Update User Attributes**: Any changes to user attributes in Okta will be synchronized with NetBird. +- **Deactivate Users**: Deactivating a user in Okta will also deactivate them in NetBird. +- **Group Push**: Groups created in Okta will be synchronized to NetBird. + +#### Configuration Steps +##### Step 1: Configure SSO in Okta +- Access the Okta dashboard and navigate to `Applications > Applications`, selecting the previously installed `NetBird` application. +- Go to `Sign On > Settings` and select `Edit`. +- In the `Credentials Details` section, change the `Application username format` to `Email` and select `Save`.

- high-level-dia + Okta SSO Configuration

-- Fill in the form with the following values and click `Next` - - App integration name: `NetBird SCIM` +##### Step 2: Enable Okta SCIM in NetBird +- Log into [NetBird](https://app.netbird.io/). +- Proceed to [Integrations > Identity Provider](https://app.netbird.io/integrations?tab=identity-provider) and select `Connect Okta`.

- high-level-dia + NetBird Identity Provider List

-- Fill in the form will the following values and click `Next` - - Single sign-on URL: `http://localhost` - - Audience URI (SP Entity ID): `http://localhost` +- Follow the displayed instructions to link your Okta account. Ensure to note the `Authorization(Bearer) token` generated for use in the subsequent step.

- high-level-dia + Okta SCIM Credentials

-- Select App type as `This is an internal app that we have created` and click `Finish` +##### Step 3: Enable Provisioning in Okta + +- From the Okta dashboard, navigate to `Applications > Applications` and select the `NetBird` application. +- Under the` Provisioning` tab, choose `Integration`, then select `Configure API Integration`

- high-level-dia + Okta Provisioning Configuration

-#### Step 2. Create Okta SCIM integration -Refer to the [api.md](https://github.com/netbirdio/docs/blob/main/misc/idp-sync/api.md#okta-scim-endpoints) document for detailed instructions on how to create the integration. -After creating, please take note of the `auth_token` from the response as we will use it in the next step. - -#### Step 3. Enable and configure SCIM provisioning -Before proceeding with this step, we need to create -- Navigate to Okta Admin Dashboard -- Click `Applications` in the left menu and then click on `Applications` -- Select the `NetBird SCIM` application we created earlier +- Opt to `Enable API integration` and insert previously noted `Authorization(Bearer) token` into the `API Token` field.

- high-level-dia + Enabling Okta Provisioning

-- Click `General` tab and in `App Settings` click `Edit` to update the settings -- Tick `Enable SCIM provisioning` and click `Save` +- Click `Test API Credentials` to verify the SCIM connection, then select `Save`. +- Navigate to `Provisioning > Settings > To App`, click `Edit`, enable `Create Users`, `Update User Attributes`, and `Deactivate Users`, then select `Save`.

- high-level-dia + Okta to App Configuration

-- Click `Provisioning` and under `SCIM connection` click `Edit` -- Fill in the form will the following values and click `Save` - - SCIM connector base URL: `https://api.netbird.io/api/scim/v2` - - Unique identifier field for users: `userName` - - Supported provisioning actions: `Push New Users`, `Push Profile Updates`, `Push Groups` - - Authentication Mode: `HTTP Header` - - HTTP Header Token you obtained from NetBird : `nbs_zKY09...` +##### Step 4: Sync Users to NetBird +- Access the `Assignments` tab, click `Assign`, then `Assign to Groups`. +- Choose the groups for provisioning, select `Assign` and then `Save and Go Back`. +- Click `Done` to conclude the group assignment process.

- high-level-dia + high-level-dia

-- Click on `Test Connector Configuration` to verify if the SCIM configuration is working. After the test is completed, -make sure `Create Users`, `Update User Attributes`, and `Push Groups` were successful. - +#### Step 5. Sync groups to NetBird +- Access the `Push Groups` tab

- high-level-dia + high-level-dia

- -- Click `Save` and then click `Provisioning` tab - -

- high-level-dia -

- -- Go to the `Provisioning` tab, and select the `To App` settings and click `Edit` -- Enable `Create Users`, `Update User Attributes`, and `Deactivate Users` and click `Save` - -

- high-level-dia -

- -#### Step 4. Assign groups to application and push to NetBird - -This step will cover how to provision user sync using groups and push them to NetBird. If you are interested in managing single user -access without using the groups, you can learn how to do it [here](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-assign-apps.htm). - -- Go to the `Assignments` tab. - -

- high-level-dia -

- -- Select the `Assign` and then click `Assign to Groups` -- Select the groups you want to provision, and then select `Assign` and click `Save and Go Back`. -- Select `Done` after you've finished assigning groups. - -At this point, all members of the groups assigned to the application will be synced to NetBird. - -- Go to the `Push Groups` tab - -

- high-level-dia -

- -- Select the `Push Groups` and then click `Find groups by name` +- Select the `Push Groups` and then `Find groups by name` - Search groups to push and then click `Save` -

- high-level-dia -

- - The selected groups will then be synced to NetBird. -

- high-level-dia -

+ + + SCIM provisioning will manage only resources that are created through Okta. Any resources created directly in + NetBird will not be managed by SCIM. + + + Synced groups will only be available for membership and will not change the role of user in NetBird. +