mirror of
https://github.com/netbirdio/docs.git
synced 2026-08-25 01:01:27 +02:00
team docs audit: corrections, SSO fices, nav nesting
This commit is contained in:
Brandon Hopkins
@@ -350,12 +350,48 @@ export const docsNavigation = [
|
||||
title: 'Single Sign-On',
|
||||
href: '/manage/team/single-sign-on',
|
||||
isOpen: false,
|
||||
// links: [
|
||||
// { title: 'Authentik', href: '/manage/team/single-sign-on/authentik' },
|
||||
// { title: 'Keycloak', href: '/manage/team/single-sign-on/keycloak' },
|
||||
// { title: 'Auth0', href: '/manage/team/single-sign-on/auth0' },
|
||||
// { title: 'JumpCloud', href: '/manage/team/single-sign-on/jumpcloud' },
|
||||
// ]
|
||||
links: [
|
||||
{
|
||||
title: 'Authentik',
|
||||
href: '/manage/team/single-sign-on/authentik',
|
||||
},
|
||||
{
|
||||
title: 'Keycloak',
|
||||
href: '/manage/team/single-sign-on/keycloak',
|
||||
},
|
||||
{
|
||||
title: 'JumpCloud',
|
||||
href: '/manage/team/single-sign-on/jumpcloud',
|
||||
},
|
||||
{
|
||||
title: 'Auth0',
|
||||
href: '/manage/team/single-sign-on/auth0',
|
||||
},
|
||||
{
|
||||
title: 'Duo Security',
|
||||
href: '/manage/team/single-sign-on/duo-security',
|
||||
},
|
||||
{
|
||||
title: 'Zitadel',
|
||||
href: '/manage/team/single-sign-on/zitadel',
|
||||
},
|
||||
{
|
||||
title: 'cidaas',
|
||||
href: '/manage/team/single-sign-on/cidaas',
|
||||
},
|
||||
{
|
||||
title: 'AWS Cognito',
|
||||
href: '/manage/team/single-sign-on/aws-cognito',
|
||||
},
|
||||
{
|
||||
title: 'Zoho',
|
||||
href: '/manage/team/single-sign-on/zoho',
|
||||
},
|
||||
{
|
||||
title: 'IIJ ID',
|
||||
href: '/manage/team/single-sign-on/iij-id',
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
},
|
||||
|
||||
@@ -35,6 +35,8 @@ As the name stands, this way of inviting users is straightforward and works thro
|
||||
To invite a new user, proceed to `Team` then select the `Users` tab and click the <button name="button" className="button-6">Invite User</button> button.
|
||||
A window will appear, allowing you to specify the name and email address of the user you want to invite. Optionally, you could select a set of groups with which you want this user to be associated.
|
||||
|
||||
On a self-hosted installation the same button reads `Add User`, and it only appears when [local user management](/selfhosted/identity-providers/local) is enabled. If you have [disabled local authentication](/selfhosted/identity-providers/disable-local-authentication), the button is disabled and users have to come from your IdP instead.
|
||||
|
||||
The invited users will receive an email invitation that they have to confirm.
|
||||
After logging in to the system, they will join your network automatically.
|
||||
|
||||
@@ -43,15 +45,14 @@ After logging in to the system, they will join your network automatically.
|
||||
</p>
|
||||
|
||||
<Note>
|
||||
If a user already has a NetBird account, you can't invite them.
|
||||
This is a limitation that is likely to be removed in future versions.
|
||||
If a user already has a NetBird account, you can't invite them. The invite is rejected with
|
||||
`can't invite a user with an existing NetBird account`.
|
||||
</Note>
|
||||
|
||||
## Identity Provider (IdP) Sync
|
||||
|
||||
NetBird's IdP-Sync automates user access management by integrating with your IdP and automatically
|
||||
provisioning users and groups. You can enable this feature from the `Users` tab by clicking the `Identity Provider Sync`
|
||||
button.
|
||||
provisioning users and groups. You configure it from the `Integrations` page, on the `Identity Provider Sync` tab.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync-reference.png" alt="idp-sync-reference" className="imagewrapper"/>
|
||||
|
||||
@@ -14,6 +14,11 @@ Navigate to the Dashboard's `Settings` page and the `Authentication` tab and ena
|
||||
<img src="/docs-static/img/manage/team/approve-users/netbird-authentication-settings-approval.png" alt="netbird-authentication-settings-approval" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
## What a pending user sees
|
||||
Until an administrator approves them, the user can sign in but can't reach the dashboard. They get a
|
||||
`User Approval Pending` screen telling them their account is pending approval from an administrator.
|
||||
They hold the `Pending` status in the `Users` table until you act on them.
|
||||
|
||||
## Approve or reject user
|
||||
To approve a user, navigate to the [Users Page](https://app.netbird.io/team/users) and click the `Approve` or `Reject` button on the right side of the users table.
|
||||
|
||||
@@ -21,6 +26,19 @@ To approve a user, navigate to the [Users Page](https://app.netbird.io/team/user
|
||||
<img src="/docs-static/img/manage/team/approve-users/netbird-user-approval.png" alt="netbird-user-approval" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
When several people are waiting, the `Pending Approval` button above the table filters it down to just
|
||||
those users, and carries a badge with the number outstanding. The button only appears while at least one
|
||||
user is waiting.
|
||||
|
||||
<Note>
|
||||
`Reject` is permanent. It removes the user from the account and can't be undone. Use `Block` instead
|
||||
if you want to keep the user on the account but deny access.
|
||||
</Note>
|
||||
|
||||
The `Approve` and `Reject` buttons only render for roles that can update users, which means `Owner` and
|
||||
`Admin`. A `Network Admin` has read-only access to the `Team` tab and won't see them. See
|
||||
[User Roles](/manage/team/user-roles) for the full breakdown.
|
||||
|
||||
## Get started
|
||||
<div>
|
||||
<Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Automatically Offboard Team Members from NetBird
|
||||
|
||||
[NetBird's IdP-Sync integration](https://docs.netbird.io/manage/team/idp-sync) simplifies offboarding team members, enhancing
|
||||
[NetBird's IdP-Sync integration](/manage/team/idp-sync) simplifies offboarding team members, enhancing
|
||||
security and efficiency. With this integration, you can automatically revoke access when users leave the company, when
|
||||
temporary access for a freelancer ends after project completion, or when a seasonal employee's contract concludes.
|
||||
Likewise, you can use this integration to restrict access to specific resources or environments when a project finishes.
|
||||
@@ -14,7 +14,7 @@ that `user_01` is part of the `IT Administrators` group, while `user_02` and `us
|
||||
|
||||
|
||||
|
||||
To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](https://docs.netbird.io/manage/team/idp-sync/microsoft-entra-id-sync).
|
||||
To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](/manage/team/idp-sync/microsoft-entra-id-sync).
|
||||
|
||||
Next, locate the user you want to offboard in your IdP's user management section. Let’s say you want to revoke access to
|
||||
`user_01`, in that case, you will need to select it and click the `Delete` button as shown below.
|
||||
@@ -25,7 +25,9 @@ After deletion, click the `Refresh` button to confirm that the user is no longer
|
||||
|
||||
|
||||
|
||||
Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to the `Integrations` screen in the NetBird admin console and click the corresponding integration button to manually trigger the synchronization.
|
||||
Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to `Integrations` in the NetBird dashboard, open the `Identity Provider Sync` tab, and trigger the synchronization manually.
|
||||
|
||||
Manual sync is only available for the API-based integrations, Google Workspace and Microsoft Entra ID via API, because NetBird pulls from those providers. SCIM-based integrations such as Okta, JumpCloud, Keycloak, and IIJ ID are push-based: the provider sends changes to NetBird, so there is nothing to trigger from the NetBird side and deprovisioning lands as soon as your IdP pushes it.
|
||||
|
||||
|
||||
|
||||
@@ -45,6 +47,6 @@ Let's say the current project is finished, and you no longer want members of the
|
||||
|
||||
|
||||
Once the changes synchronize in NetBird, users and their group memberships will be updated; therefore,
|
||||
[network access associated with that group](https://docs.netbird.io/manage/access-control/manage-network-access) will automatically be revoked.
|
||||
[network access associated with that group](/manage/access-control/manage-network-access) will automatically be revoked.
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@ import {Note} from "@/components/mdx";
|
||||
|
||||
# Enable NetBird for Microsoft Entra ID
|
||||
|
||||
Before your organization can use Microsoft Entra ID features with NetBird — such as user provisioning, group sync, or single sign-on — you need to enable the NetBird enterprise application in your Entra ID tenant and grant admin consent.
|
||||
Before your organization can use Microsoft Entra ID features with NetBird, such as user provisioning, group sync, or single sign-on, you need to enable the NetBird enterprise application in your Entra ID tenant and grant admin consent.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@ import {Note} from "@/components/mdx";
|
||||
|
||||
# Provision Users and Groups From Keycloak (Embedded IdP)
|
||||
|
||||
Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO),
|
||||
Keycloak is an open source identity and access management solution that provides features like single sign-on (SSO),
|
||||
multi-factor authentication (MFA), user federation, and centralized identity management to help organizations
|
||||
secure and manage access to their applications and resources.
|
||||
|
||||
|
||||
@@ -20,7 +20,9 @@ or update network configurations like [DNS](/manage/dns#distribution-groups),
|
||||
eliminating the need for manual grouping.
|
||||
|
||||
<Note>
|
||||
This feature is only available in the cloud version of NetBird in the [Team plan](https://netbird.io/pricing) and above.
|
||||
IdP-Sync is available on NetBird Cloud in the [Team plan](https://netbird.io/pricing) and above. It is also
|
||||
available on self-hosted deployments running a [Commercial License](https://netbird.io/pricing#on-prem) with the
|
||||
embedded IdP, which use a separate set of setup guides listed under Self-hosted.
|
||||
</Note>
|
||||
|
||||
This video guide walks you through an example integration with Microsoft Entra ID, covering both user onboarding and
|
||||
@@ -28,10 +30,43 @@ offboarding scenarios:
|
||||
|
||||
<YouTube videoId="RxYWTpf7cgY" />
|
||||
|
||||
## How syncing works
|
||||
|
||||
NetBird syncs in one of two directions, and which one you get depends on the provider.
|
||||
|
||||
**Pull, over the provider's API.** NetBird holds credentials for your IdP and reads users and groups from it on a
|
||||
schedule. You can also trigger a sync by hand from the dashboard. Google Workspace and Entra ID (API) work this way.
|
||||
|
||||
**Push, over SCIM.** Your IdP sends changes to NetBird as they happen, using a SCIM endpoint and token that NetBird
|
||||
issues. There is no manual sync to trigger, because NetBird is the receiver. Entra ID (SCIM), Okta, JumpCloud, and any
|
||||
generic SCIM provider work this way.
|
||||
|
||||
The practical difference is timing and troubleshooting. A pull integration is late by at most one sync cycle and you can
|
||||
force it. A push integration is near-immediate, but when it stalls you fix it in your IdP's provisioning logs, not in
|
||||
NetBird.
|
||||
|
||||
## Supported Identity Providers
|
||||
|
||||
NetBird provides native support for syncing with the most popular identity providers. Pick yours below for detailed setup and configuration steps.
|
||||
|
||||
| Provider | Direction | Set up in NetBird with |
|
||||
| --- | --- | --- |
|
||||
| Google Workspace | Pull (API) | `Connect Google Workspace` |
|
||||
| Entra ID (API) | Pull (API) | `Connect Entra ID (API)` |
|
||||
| Entra ID (SCIM) | Push (SCIM) | `Connect Entra ID (SCIM)` |
|
||||
| Okta | Push (SCIM) | `Connect Okta` |
|
||||
| JumpCloud | Push (SCIM) | `Connect Jumpcloud` |
|
||||
| Keycloak | Push (SCIM) | `Connect Generic SCIM` |
|
||||
| IIJ ID | Push (SCIM) | `Connect Generic SCIM` |
|
||||
|
||||
Keycloak and IIJ ID have no dedicated card on the `Identity Provider Sync` tab. Both are set up through
|
||||
`Connect Generic SCIM`, and their guides below walk through that path.
|
||||
|
||||
<Note>
|
||||
You can only have one IdP-Sync integration enabled at a time. While one is enabled, the setup buttons on
|
||||
every other card are disabled, so switching providers means disabling the current integration first.
|
||||
</Note>
|
||||
|
||||
### Entra ID (API)
|
||||
|
||||
Provision users and groups from Microsoft Entra ID through the Graph API. See [Entra ID (API) setup](/manage/team/idp-sync/microsoft-entra-id-sync).
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Provision Users and Groups From Keycloak
|
||||
|
||||
Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO),
|
||||
Keycloak is an open source identity and access management solution that provides features like single sign-on (SSO),
|
||||
multi-factor authentication (MFA), user federation, and centralized identity management to help organizations
|
||||
secure and manage access to their applications and resources.
|
||||
|
||||
|
||||
@@ -1,9 +1,14 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Auth0 on NetBird Cloud
|
||||
# Auth0 on NetBird Cloud
|
||||
|
||||
You can use Auth0 as your Identity Provider with NetBird, but it will require some additional configuration steps. Auth0 is a flexible, drop-in solution to add authentication and authorization services to your applications. It's a managed service that offers extensive customization options, developer-friendly APIs, universal login, social identity providers, and advanced security features like anomaly detection and breached password detection.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
The Free plan supports Google, Microsoft, and social logins.
|
||||
</Note>
|
||||
|
||||
1. Access the [Auth0 console](https://manage.auth0.com/) and navigate to Applications > Applications
|
||||
|
||||
2. Click **+ Create Application**
|
||||
@@ -15,24 +20,24 @@ You can use Auth0 as your Identity Provider with NetBird, but it will require so
|
||||
</p>
|
||||
|
||||
4. On the New Application screen, go to the Settings tab and under Application URIs set the following values:
|
||||
- Application Login URI: https://app.netbird.io
|
||||
- Allowed Callback URLs: https://login.netbird.io/login/callback
|
||||
- Allowed Logout URLs: https://app.netbird.io
|
||||
- Allowed Web Origins: https://app.netbird.io
|
||||
- **Application Login URI**: `https://app.netbird.io`
|
||||
- **Allowed Callback URLs**: `https://login.netbird.io/login/callback`
|
||||
- **Allowed Logout URLs**: `https://app.netbird.io`
|
||||
- **Allowed Web Origins**: `https://app.netbird.io`
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-configure.png" alt="auth0-application-configure" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
6. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
|
||||
5. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
|
||||
|
||||
7. Retrieve Application's **Domain** from the **Basic Information** tab
|
||||
6. Retrieve Application's **Domain** from the **Basic Information** tab
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-domain.png" alt="auth0-application-domain" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
8. Share following with our team. Please use a secure method for sharing the sensitive parts of this information:
|
||||
7. Share the following with our team. Please use a secure method for sharing the sensitive parts of this information:
|
||||
1. Application's **Domain**,
|
||||
2. (sensitive) **Client ID** and **Client Secret**,
|
||||
3. list of email domains to be registered for this SSO configuration,
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Authentik on NetBird Cloud
|
||||
# Authentik on NetBird Cloud
|
||||
|
||||
You can use Authentik as your Identity Provider with NetBird, but it will require some additional configuration steps. Authentik is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols.
|
||||
You can use Authentik as your Identity Provider with NetBird, but it will require some additional configuration steps. Authentik is an open source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
@@ -38,7 +38,7 @@ You can use Authentik as your Identity Provider with NetBird, but it will requir
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/5-new-application-sign.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click on Advanced protocol settings and ensure that the email, opened, and profile scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
|
||||
- Click on Advanced protocol settings and ensure that the `openid`, `email`, and `profile` scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/6-new-application-scopes.png" alt="new-application" className="imagewrapper-big"/>
|
||||
|
||||
@@ -18,7 +18,7 @@ though some additional configuration is required to complete the integration.
|
||||
## Google, Microsoft, and GitHub
|
||||
|
||||
If you're using Google Workspace, Microsoft Entra ID, or a supported social login, you can simply sign in with no extra
|
||||
setup—just click the appropriate button on the [login page](https://app.netbird.io/):
|
||||
setup. Just click the appropriate button on the [login page](https://app.netbird.io/):
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/netbird-login.png" alt="netbird-login" className="imagewrapper"/>
|
||||
@@ -48,13 +48,13 @@ to integrate with NetBird. Below are the steps to set up different OIDC-complian
|
||||
|
||||
### Authentik
|
||||
|
||||
[Authentik](https://goauthentik.io/) is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols. Authentik includes audit logging, password policies, and full API access for automation.
|
||||
[Authentik](https://goauthentik.io/) is an open source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols. Authentik includes audit logging, password policies, and full API access for automation.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/authentik" variant="outline">Setup Authentik</Button>
|
||||
|
||||
### Keycloak
|
||||
|
||||
[Keycloak](https://www.keycloak.org/) is an open-source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IDP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols.
|
||||
[Keycloak](https://www.keycloak.org/) is an open source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IdP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/keycloak" variant="outline">Setup Keycloak</Button>
|
||||
|
||||
@@ -72,13 +72,13 @@ to integrate with NetBird. Below are the steps to set up different OIDC-complian
|
||||
|
||||
### Duo Security
|
||||
|
||||
[Duo Security](https://duo.com/) is a cloud-based security platform that provides secure access through single sign-on (SSO), multi-factor authentication (MFA), and device trust. Duo offers comprehensive identity verification and access policies to protect applications and data, with a focus on zero trust security architecture.
|
||||
[Duo Security](https://duo.com/) is a cloud-based security platform that provides secure access through single sign-on (SSO), multi-factor authentication (MFA), and device trust. Duo offers comprehensive identity verification and access policies to protect applications and data, with a focus on Zero Trust security architecture.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/duo-security" variant="outline">Setup Duo Security</Button>
|
||||
|
||||
### Zitadel
|
||||
|
||||
[Zitadel](https://zitadel.com/) is an open-source, API-first identity infrastructure platform built with multi-tenancy at its core. It provides single sign-on, passwordless authentication, role-based access control, and supports OpenID Connect, OAuth 2.0, and SAML.
|
||||
[Zitadel](https://zitadel.com/) is an open source, API-first identity infrastructure platform built with multi-tenancy at its core. It provides single sign-on, passwordless authentication, role-based access control, and supports OpenID Connect, OAuth 2.0, and SAML.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/zitadel" variant="outline">Setup Zitadel</Button>
|
||||
|
||||
|
||||
@@ -1,10 +1,15 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# JumpCloud on NetBird Cloud
|
||||
# JumpCloud on NetBird Cloud
|
||||
|
||||
You can use JumpCloud as your Identity Provider with NetBird, but it will require some additional configuration steps. JumpCloud is a cloud-based directory platform that provides identity, access, and device management in a unified solution. It offers single sign-on, multi-factor authentication, directory services, device management, and network access control, providing a comprehensive approach to managing users, devices, and applications from a single platform.
|
||||
|
||||
1. Access the JumpCloud and navigate to USER AUTHENTICATION > SSO Applications
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
The Free plan supports Google, Microsoft, and social logins.
|
||||
</Note>
|
||||
|
||||
1. Access JumpCloud and navigate to USER AUTHENTICATION > SSO Applications
|
||||
|
||||
2. Click + Add New Application, select Custom Application and click Next
|
||||
|
||||
@@ -24,14 +29,14 @@ You can use JumpCloud as your Identity Provider with NetBird, but it will requir
|
||||
|
||||
6. On the New Application screen, go to the SSO tab and under Endpoint Configuration set the following values:
|
||||
|
||||
- Redirect URIs: https://login.netbird.io/login/callback
|
||||
- **Redirect URIs**: `https://login.netbird.io/login/callback`
|
||||
|
||||
- Login URL: https://app.netbird.io
|
||||
- **Login URL**: `https://app.netbird.io`
|
||||
|
||||
7. Under Attribute Mapping enable Email and Profile scopes
|
||||
|
||||
<Note>
|
||||
Sometimes, the Jumpcloud application configuration will add duplicate attributes, like email and email_verified. The duplicates should be removed.
|
||||
Sometimes, the JumpCloud application configuration will add duplicate attributes, like email and email_verified. The duplicates should be removed.
|
||||
</Note>
|
||||
|
||||
8. Go to the User Groups and select the list of groups to which you want to give access to the application and then click activate
|
||||
|
||||
@@ -1,8 +1,13 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Keycloak on NetBird Cloud
|
||||
# Keycloak on NetBird Cloud
|
||||
|
||||
You can use Keycloak as your Identity Provider with NetBird, but it will require some additional configuration steps. Keycloak is an open-source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IDP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols.
|
||||
You can use Keycloak as your Identity Provider with NetBird, but it will require some additional configuration steps. Keycloak is an open source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IdP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
The Free plan supports Google, Microsoft, and social logins.
|
||||
</Note>
|
||||
|
||||
1. You need to create a new client
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@ import {Note} from "@/components/mdx";
|
||||
|
||||
# Zitadel on NetBird Cloud
|
||||
|
||||
You can use Zitadel as your Identity Provider with NetBird, but it will require some additional configuration steps. Zitadel is an open-source, API-first identity infrastructure platform built with multi-tenancy at its core. It provides single sign-on, passwordless authentication, role-based access control, and supports OpenID Connect, OAuth 2.0, and SAML.
|
||||
You can use Zitadel as your Identity Provider with NetBird, but it will require some additional configuration steps. Zitadel is an open source, API-first identity infrastructure platform built with multi-tenancy at its core. It provides single sign-on, passwordless authentication, role-based access control, and supports OpenID Connect, OAuth 2.0, and SAML.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
@@ -67,7 +67,7 @@ Click **Continue** to proceed to the review stage. Verify your application setti
|
||||
|
||||
## Step 5: Copy the Client Credentials
|
||||
|
||||
After creation, Zitadel displays the **Client ID** and **Client Secret**. Copy and store these securely — the Client Secret is only shown once.
|
||||
After creation, Zitadel displays the **Client ID** and **Client Secret**. Copy and store these securely. The Client Secret is only shown once.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/zitadel-idp/client-credentials.png" alt="zitadel-client-credentials" className="imagewrapper-big"/>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import {Note} from "@/components/mdx"
|
||||
|
||||
export const description = "Understand NetBird's user roles — Owner, Admin, Network Admin, Billing Admin, Auditor, and User — what each can access, and how to assign them."
|
||||
export const description = "Understand NetBird's user roles: Owner, Admin, Network Admin, Billing Admin, Auditor, and User. What each can access, and how to assign them."
|
||||
|
||||
# User Roles
|
||||
|
||||
@@ -22,6 +22,7 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a
|
||||
| Activity | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ |
|
||||
| Settings | ✅ | ✅ | 📖 | ✅<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> | 📖 | ❌ |
|
||||
| Reverse Proxy | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
|
||||
| Agent Network | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
|
||||
| Tenants | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
|
||||
| Integrations | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ |
|
||||
|
||||
@@ -29,7 +30,7 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a
|
||||
|
||||
<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>1</sup> A `User` can only see the peers they own and peers they're allowed to connect to.
|
||||
|
||||
<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> A `Billing Admin`'s Settings access is limited to **Plans & Billing** and **Invoices**.
|
||||
<sup style={{fontSize: '0.9em', fontWeight: 'bold'}}>2</sup> A `Billing Admin`'s Settings access is limited to `Plans & Billing` and `Invoices`.
|
||||
|
||||
## Owner
|
||||
The `Owner` has full access to the account and can manage every aspect of it. There can be only one account owner in NetBird. Owners are the only users who can delete the organization account - see [Delete NetBird account](/manage/settings/delete-account) for more.
|
||||
@@ -38,7 +39,7 @@ The `Owner` has full access to the account and can manage every aspect of it. Th
|
||||
An `Admin` has full access to the account, with two exceptions: administrators can't delete or change the role of the `Owner`, and they can't delete the organization account.
|
||||
|
||||
## Network Admin
|
||||
A `Network Admin` fully manages network configuration - Control Center, Access Control, Network Routing, and DNS. They have read-only access to Peers, Setup Keys, Team, Activity, and Settings, and no access to Reverse Proxy, Tenants, or Integrations. A `Network Admin` can view setup keys but not create them, and can't invite users or create service users.
|
||||
A `Network Admin` fully manages network configuration - Control Center, Access Control, Network Routing, and DNS. They have read-only access to Peers, Setup Keys, Team, Activity, and Settings, and no access to Reverse Proxy, Agent Network, Tenants, or Integrations. A `Network Admin` can view setup keys but not create them, and can't invite users or create service users.
|
||||
|
||||
## Billing Admin
|
||||
A `Billing Admin` manages billing only. They can access `Settings` → `Plans & Billing` and `Settings` → `Invoices`, and have no access to any other part of the account.
|
||||
@@ -50,7 +51,11 @@ An `Auditor` can read every configuration in the account but can't modify anythi
|
||||
A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to.
|
||||
|
||||
## Roles and the API
|
||||
Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role. Every role except `User` can create a personal access token that carries the same permissions as that user's role, so they can interact with the API programmatically.
|
||||
Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role.
|
||||
|
||||
`Owner`, `Admin`, and `Network Admin` can create personal access tokens, which carry the same permissions as the user who owns them. `Auditor` and `User` cannot create a token, not even for themselves, because token creation is a create operation and neither role is granted one. An `Auditor` that needs programmatic read access has to be issued a token by an admin on a service user instead.
|
||||
|
||||
Token expiration must be between 1 and 365 days.
|
||||
|
||||
## Roles and identity provider sync
|
||||
<Note>
|
||||
|
||||
Reference in New Issue
Block a user