Move IdP Sync to a separate page (#215)

This commit is contained in:
Misha Bragin
2024-08-13 11:12:49 +02:00
committed by GitHub
parent d955b3d928
commit 474f0eca2f
32 changed files with 433 additions and 216 deletions

View File

@@ -0,0 +1,107 @@
# Provision Users and Groups From Okta
[Okta](https://www.okta.com/) is a cloud-based identity management service that enables organizations to manage user authentication,
authorization, and access across a wide range of applications and services.
Like with [other IdPs](/how-to/provision-users-and-groups-from-idp), NetBird's IdP-Sync feature automates user access management by integrating with Okta and automatically
provisioning users and groups. This integration syncs changes from Okta to NetBird, ensuring that new users receive the
correct network access and that employees leaving the organization have their access immediately revoked.
## Get Started with NetBird-Okta Integration
To get started, navigate to [Integrations](https://app.netbird.io/integrations) in the left menu, which will take you to the `Identity Provider` integration.
Click the `Enter ID (Azure AD)` button. This action will trigger a pop-up window that will present you with a user-friendly
wizard, guiding you through the synchronization process between NetBird and Azure AD.
![NetBird Get Started IdP](/docs-static/img/how-to-guides/microsoft-entra-id-sync/FkdC8BV.png)
If your organization relies on Okta for managing employee access, automating access to NetBird via Okta's `Provisioning` feature can streamline your operations. This integration leverages `SCIM` (System for Cross-domain Identity Management) to ensure smooth synchronization of users and groups. For comprehensive insights into Okta's SCIM capabilities, please consult this [article](https://www.okta.com/blog/2017/01/what-is-scim/).
#### Prerequisites
- Begin by installing the NetBird application from the [Okta Integration Network](https://www.okta.com/integrations/netbird)
- Following installation, reach out to support to activate Okta SSO for your [support](mailto:support@netbird.io).
#### Supported Features
##### OIDC Features
- **SP-initiated SSO (Single Sign-On)**: Users must start authentication from NetBird's [login page](https://app.netbird.io/)
by entering their Okta email and clicking `Continue`.
##### SCIM Features
- **Create Users**: Users added through Okta will automatically be created in NetBird.
- **Update User Attributes**: Any changes to user attributes in Okta will be synchronized with NetBird.
- **Deactivate Users**: Deactivating a user in Okta will also deactivate them in NetBird.
- **Group Push**: Groups created in Okta will be synchronized to NetBird.
#### Configuration Steps
##### Step 1: Configure SSO in Okta
- Access the Okta dashboard and navigate to `Applications > Applications`, selecting the previously installed `NetBird` application.
- Go to `Sign On > Settings` and select `Edit`.
- In the `Credentials Details` section, change the `Application username format` to `Email` and select `Save`.
<p>
<img src="/docs-static/img/how-to-guides/okta-sso-configuration.png" alt="Okta SSO Configuration" className="imagewrapper-big"/>
</p>
##### Step 2: Enable Okta SCIM in NetBird
- Log into [NetBird](https://app.netbird.io/).
- Proceed to [Integrations > Identity Provider](https://app.netbird.io/integrations?tab=identity-provider) and select `Connect Okta`.
<p>
<img src="/docs-static/img/how-to-guides/netbird-idp-list.png" alt="NetBird Identity Provider List" className="imagewrapper-big"/>
</p>
- Follow the displayed instructions to link your Okta account. Ensure to note the `Authorization(Bearer) token` generated for use in the subsequent step.
<p>
<img src="/docs-static/img/how-to-guides/okta-scim-credentials.png" alt="Okta SCIM Credentials" className="imagewrapper-big"/>
</p>
##### Step 3: Enable Provisioning in Okta
- From the Okta dashboard, navigate to `Applications > Applications` and select the `NetBird` application.
- Under the` Provisioning` tab, choose `Integration`, then select `Configure API Integration`
<p>
<img src="/docs-static/img/how-to-guides/okta-provisioning.png" alt="Okta Provisioning Configuration" className="imagewrapper-big"/>
</p>
- Opt to `Enable API integration` and insert previously noted `Authorization(Bearer) token` into the `API Token` field.
<p>
<img src="/docs-static/img/how-to-guides/okta-provisioning-enabled.png" alt="Enabling Okta Provisioning" className="imagewrapper-big"/>
</p>
- Click `Test API Credentials` to verify the SCIM connection, then select `Save`.
- Navigate to `Provisioning > Settings > To App`, click `Edit`, enable `Create Users`, `Update User Attributes`, and `Deactivate Users`, then select `Save`.
<p>
<img src="/docs-static/img/how-to-guides/okta-to-app-configuration.png" alt="Okta to App Configuration" className="imagewrapper-big"/>
</p>
##### Step 4: Sync Users to NetBird
- Access the `Assignments` tab, click `Assign`, then `Assign to Groups`.
- Choose the groups for provisioning, select `Assign` and then `Save and Go Back`.
- Click `Done` to conclude the group assignment process.
<p>
<img src="/docs-static/img/how-to-guides/okta-assign-users-by-group.png" alt="high-level-dia" className="imagewrapper-big"/>
</p>
#### Step 5. Sync groups to NetBird
- Access the `Push Groups` tab
<p>
<img src="/docs-static/img/how-to-guides/okta-push-groups.png" alt="high-level-dia" className="imagewrapper-big"/>
</p>
- Select the `Push Groups` and then `Find groups by name`
- Search groups to push and then click `Save`
- The selected groups will then be synced to NetBird.
<Note>
SCIM provisioning will manage only resources that are created through Okta. Any resources created directly in
NetBird will not be managed by SCIM.
</Note>
<Note>
Synced groups will only be available for membership and will not change the role of user in NetBird.
</Note>