mirror of
https://github.com/netbirdio/docs.git
synced 2026-10-18 03:29:03 +02:00
Improve Identity Providers Documentation and Navigation under Self-Hosted (#501)
* Refactor NavigationDocs component and update documentation structure - Improved formatting and organization of the NavigationDocs component for better readability. - Updated the docsNavigation structure to include detailed sections for managing peers, access control, networks, and integrations. - Removed the identity providers documentation file as part of the restructuring effort. - Enhanced the overall navigation experience by ensuring all links are properly formatted and accessible. * Update NavigationDocs to include new SSO links and remove outdated documentation - Added links for Authentik, Keycloak, Auth0, and JumpCloud under the Single Sign-On section in NavigationDocs. - Removed the single-sign-on.mdx file as part of the documentation cleanup effort. * Add more info about self-hosted IdP support * Update Single Sign-On documentation and NavigationDocs - Updated titles and added introductory text for Auth0, Authentik, JumpCloud, and Keycloak pages to clarify their use as Identity Providers with NetBird. - Commented out the links section in NavigationDocs for Single Sign-On to reflect the current documentation state. Didn't make sense to have those and didn't want to confuse people thinking those are the only supported providers. - Enhanced the index page to include detailed descriptions and setup buttons for Okta ans each OIDC Identity Provider. * Update paths in structure and documentation for Auth0, Authentik, Keycloak, Microsoft Entra ID, Google Workspace, and JumpCloud. This cleanup enhances clarity and ensures all references point to the correct resources. --------- Co-authored-by: braginini <bangvalo@gmail.com>
This commit is contained in:
Brandon Hopkins
co-authored by
braginini
braginini
parent
62d1627412
commit
67d2b0fa94
@@ -2,7 +2,7 @@ import {
|
||||
Note
|
||||
} from "@/components/mdx";
|
||||
|
||||
# Provision Users and Groups From Okta
|
||||
# Provision Users and Groups from Okta
|
||||
|
||||
Okta is a cloud-based identity and access management (IAM) platform that centralizes user and customer profiles to enhance
|
||||
security and streamline access. It offers features like multifactor authentication, single sign-on, and lifecycle
|
||||
|
||||
@@ -1,249 +0,0 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Authenticate to NetBird with Single Sign On (SSO)
|
||||
|
||||
NetBird works out of the box with popular Identity Providers (IdPs) such as Google Workspace, Microsoft Entra ID, and Okta,
|
||||
offering seamless Single Sign-On (SSO) for your users.
|
||||
|
||||
It also supports social logins including Google, GitHub, and Microsoft accounts.
|
||||
|
||||
For other OIDC (OpenID Connect)-compliant IdPs like Authentik, Keycloak, JumpCloud, and others, NetBird provides full support,
|
||||
though some additional configuration is required to complete the integration.
|
||||
|
||||
<Note>
|
||||
This guide covers the setup for cloud-hosted NetBird. If you are using the self-hosted version, please refer
|
||||
to the [self-hosted documentation](/selfhosted/identity-providers).
|
||||
</Note>
|
||||
|
||||
## Google, Microsoft, and GitHub
|
||||
|
||||
If you're using Google Workspace, Microsoft Entra ID, or a supported social login, you can simply sign in with no extra
|
||||
setup—just click the appropriate button on the [login page](https://app.netbird.io/):
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/netbird-login.png" alt="netbird-login" className="imagewrapper"/>
|
||||
</p>
|
||||
|
||||
## Okta
|
||||
|
||||
If you are using Okta as your Identity Provider, sign up with any email address and then follow the steps described
|
||||
in [this guide](/manage/team/idp-sync/okta-sync#get-started-with-net-bird-okta-integration)
|
||||
|
||||
## OIDC-compliant IdPs
|
||||
|
||||
For OIDC-compliant Identity Providers such as **Authentik**, **Keycloak**, and others, you’ll need to configure the IdP
|
||||
to integrate with NetBird. Below are the steps to set up different OIDC-compliant IdPs with NetBird.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
The Free plan supports Google, Microsoft, and social logins.
|
||||
</Note>
|
||||
|
||||
### Authentik
|
||||
|
||||
1. You need to create a new Application and Provider.
|
||||
- Browse to the Applications Administration menu, click on Application, and then click on Create with Provider:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/1-create-with-provider.png" alt="create-with-provider" className="imagewrapper-big"/>
|
||||
</p>
|
||||
- Name the Application and select a suitable explicit user flow. In the example below, we used NetBird:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/2-new-application.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next and select the OAuth2/OpenID Provider Type:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/3-new-application-type.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next and select an explicit user authorization flow, then take note of the Client ID and Client Secret:
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/4-new-application-client-id.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Add the following redirect URL and select a signing key: <br/>
|
||||
URL: `https://login.netbird.io/login/callback`
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/5-new-application-sign.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click on Advanced protocol settings and ensure that the email, opened, and profile scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/6-new-application-scopes.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next on the following two screens and Submit to create the provider and application:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/7-new-application-submit.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- You should see an application listed as follow:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/8-list-applications.png" alt="list-applications" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
2. We need to copy the OpenID Configuration URL for the new provider. You can do that by navigating to Providers in the left menu and then selecting the newly created provider. There you should see a windows similar to the following:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/9-list-providers.png" alt="list-providers" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Copy the OpenID Configuration URL.
|
||||
|
||||
|
||||
3. Then, share the following information with the NetBird support team at support@netbird.io:
|
||||
|
||||
- Client ID
|
||||
- Client Secret
|
||||
- OpenID Configuration URL
|
||||
- Email domains for your users
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
https://onetimesecret.com/en/ <br/>
|
||||
https://password.link/en
|
||||
</Note>
|
||||
|
||||
### Keycloak
|
||||
|
||||
1. You need to create a new client
|
||||
|
||||
- Browse to the clients Administration menu and then click in Create client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/1-new-client.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
2. Create a client with the type OpenID Connect and add any client ID and name for the client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/2-new-client-type.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
3. Click Next and enable the following options for Capability config:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/3-new-client-capability.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. Click Next and fill the following fields:
|
||||
|
||||
Valid redirect URIs: `https://login.netbird.io/login/callback` <br/>
|
||||
Web origins: `+`
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/4-new-client-callback.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
5. Click Save.
|
||||
|
||||
6. Next we need to retrieve the secret for the client, you can get that in the Credentials tab for the client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/5-new-client-credentials.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
7. Then, share the following information with the NetBird support team at support@netbird.io:
|
||||
|
||||
- Client ID
|
||||
- Keycloak URL
|
||||
- Realm
|
||||
- Client Secret
|
||||
- Email domains for your users
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
https://onetimesecret.com/en/ <br/>
|
||||
https://password.link/en
|
||||
</Note>
|
||||
|
||||
### JumpCloud
|
||||
|
||||
1. Access the JumpCloud and navigate to USER AUTHENTICATION > SSO Applications
|
||||
|
||||
2. Click + Add New Application, select Custom Application and click Next
|
||||
|
||||
3. Enable Manage Single Sign-On (SSO), select Configure SSO with OIDC and click Next
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/jumpcloud-idp/jumpcloud-sso.png" alt="jumpcloud" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. Add NetBird as Display Label and click Next. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
|
||||
|
||||
5. Review the application setting and click Configure Application to proceed
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/jumpcloud-idp/jumpcloud-sso-config.png" alt="jumpcloud-idp" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
6. On the New Application screen, go to the SSO tab and under Endpoint Configuration set the following values:
|
||||
|
||||
- Redirect URIs: https://login.netbird.io/login/callback
|
||||
|
||||
- Login URL: https://app.netbird.io
|
||||
|
||||
7. Under Attribute Mapping enable Email and Profile scopes
|
||||
|
||||
<Note>
|
||||
Sometimes, the Jumpcloud application configuration will add duplicate attributes, like email and email_verified. The duplicates should be removed.
|
||||
</Note>
|
||||
|
||||
8. Go to the User Groups and select the list of groups to which you want to give access to the application and then click activate
|
||||
|
||||
9. Record the Client ID and Client Secret that JumpCloud generates for your application.
|
||||
|
||||
10. Share your Client ID, and Client Secret with our team. Please use a secure method for sharing this information.
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
- https://onetimesecret.com/en/ <br/>
|
||||
- https://password.link/en <br/>
|
||||
</Note>
|
||||
|
||||
### Auth0
|
||||
|
||||
1. Access the [Auth0 console](https://manage.auth0.com/) and navigate to Applications > Applications
|
||||
|
||||
2. Click **+ Create Application**
|
||||
|
||||
3. Enter **NetBird** as the name, select **Single Page Web Applications** as the application type and click **Create**
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-create.png" alt="auth0-application-create" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. On the New Application screen, go to the Settings tab and under Application URIs set the following values:
|
||||
- Application Login URI: https://app.netbird.io
|
||||
- Allowed Callback URLs: https://login.netbird.io/login/callback
|
||||
- Allowed Logout URLs: https://app.netbird.io
|
||||
- Allowed Web Origins: https://app.netbird.io
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-configure.png" alt="auth0-application-configure" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
6. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
|
||||
|
||||
7. Retrieve Application's **Domain** from the **Basic Information** tab
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-domain.png" alt="auth0-application-domain" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
8. Share following with our team. Please use a secure method for sharing the sensitive parts of this information:
|
||||
1. Application's **Domain**,
|
||||
2. (sensitive) **Client ID** and **Client Secret**,
|
||||
3. list of email domains to be registered for this SSO configuration,
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
- https://onetimesecret.com/en/ <br/>
|
||||
- https://password.link/en <br/>
|
||||
</Note>
|
||||
@@ -0,0 +1,44 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Auth0 on NetBird Cloud
|
||||
|
||||
You can use Auth0 as your Identity Provider with NetBird, but it will require some additional configuration steps. Auth0 is a flexible, drop-in solution to add authentication and authorization services to your applications. It's a managed service that offers extensive customization options, developer-friendly APIs, universal login, social identity providers, and advanced security features like anomaly detection and breached password detection.
|
||||
|
||||
1. Access the [Auth0 console](https://manage.auth0.com/) and navigate to Applications > Applications
|
||||
|
||||
2. Click **+ Create Application**
|
||||
|
||||
3. Enter **NetBird** as the name, select **Single Page Web Applications** as the application type and click **Create**
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-create.png" alt="auth0-application-create" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. On the New Application screen, go to the Settings tab and under Application URIs set the following values:
|
||||
- Application Login URI: https://app.netbird.io
|
||||
- Allowed Callback URLs: https://login.netbird.io/login/callback
|
||||
- Allowed Logout URLs: https://app.netbird.io
|
||||
- Allowed Web Origins: https://app.netbird.io
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-configure.png" alt="auth0-application-configure" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
6. Record the **Client ID** and **Client Secret** that Auth0 generates for your application.
|
||||
|
||||
7. Retrieve Application's **Domain** from the **Basic Information** tab
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/auth0-idp/application-domain.png" alt="auth0-application-domain" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
8. Share following with our team. Please use a secure method for sharing the sensitive parts of this information:
|
||||
1. Application's **Domain**,
|
||||
2. (sensitive) **Client ID** and **Client Secret**,
|
||||
3. list of email domains to be registered for this SSO configuration,
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
- https://onetimesecret.com/en/ <br/>
|
||||
- https://password.link/en <br/>
|
||||
</Note>
|
||||
@@ -0,0 +1,79 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Authentik on NetBird Cloud
|
||||
|
||||
You can use Authentik as your Identity Provider with NetBird, but it will require some additional configuration steps. Authentik is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
The Free plan supports Google, Microsoft, and social logins.
|
||||
</Note>
|
||||
|
||||
1. You need to create a new Application and Provider.
|
||||
- Browse to the Applications Administration menu, click on Application, and then click on Create with Provider:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/1-create-with-provider.png" alt="create-with-provider" className="imagewrapper-big"/>
|
||||
</p>
|
||||
- Name the Application and select a suitable explicit user flow. In the example below, we used NetBird:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/2-new-application.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next and select the OAuth2/OpenID Provider Type:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/3-new-application-type.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next and select an explicit user authorization flow, then take note of the Client ID and Client Secret:
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/4-new-application-client-id.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Add the following redirect URL and select a signing key: <br/>
|
||||
URL: `https://login.netbird.io/login/callback`
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/5-new-application-sign.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click on Advanced protocol settings and ensure that the email, opened, and profile scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/6-new-application-scopes.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Click Next on the following two screens and Submit to create the provider and application:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/7-new-application-submit.png" alt="new-application" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- You should see an application listed as follow:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/8-list-applications.png" alt="list-applications" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
2. We need to copy the OpenID Configuration URL for the new provider. You can do that by navigating to Providers in the left menu and then selecting the newly created provider. There you should see a windows similar to the following:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/authentik-idp/9-list-providers.png" alt="list-providers" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Copy the OpenID Configuration URL.
|
||||
|
||||
|
||||
3. Then, share the following information with the NetBird support team at support@netbird.io:
|
||||
|
||||
- Client ID
|
||||
- Client Secret
|
||||
- OpenID Configuration URL
|
||||
- Email domains for your users
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
https://onetimesecret.com/en/ <br/>
|
||||
https://password.link/en
|
||||
</Note>
|
||||
@@ -0,0 +1,71 @@
|
||||
import { Note, Button } from '@/components/mdx'
|
||||
|
||||
# Authenticate to NetBird with Single Sign On (SSO)
|
||||
|
||||
NetBird works out of the box with popular Identity Providers (IdPs) such as Google Workspace, Microsoft Entra ID, and Okta,
|
||||
offering seamless Single Sign-On (SSO) for your users.
|
||||
|
||||
It also supports social logins including Google, GitHub, and Microsoft accounts.
|
||||
|
||||
For other OIDC (OpenID Connect)-compliant IdPs like Authentik, Keycloak, JumpCloud, and others, NetBird provides full support,
|
||||
though some additional configuration is required to complete the integration.
|
||||
|
||||
<Note>
|
||||
This guide covers the setup for cloud-hosted NetBird. If you are using the self-hosted version, please refer
|
||||
to the [self-hosted documentation](/selfhosted/identity-providers).
|
||||
</Note>
|
||||
|
||||
## Google, Microsoft, and GitHub
|
||||
|
||||
If you're using Google Workspace, Microsoft Entra ID, or a supported social login, you can simply sign in with no extra
|
||||
setup—just click the appropriate button on the [login page](https://app.netbird.io/):
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/netbird-login.png" alt="netbird-login" className="imagewrapper"/>
|
||||
</p>
|
||||
|
||||
## Okta
|
||||
|
||||
[Okta](https://www.okta.com/) is a cloud-based identity and access management service designed for enterprise use. It provides single sign-on, multifactor authentication, user management, and lifecycle management capabilities. Okta offers extensive integration options with thousands of pre-built connectors, adaptive authentication, and comprehensive API access management.
|
||||
|
||||
<Note>
|
||||
The detailed setup steps for Okta integration, including SSO configuration and user/group provisioning, are available in our [Provision Users and Groups from Okta](/manage/team/idp-sync/okta-sync) documentation.
|
||||
</Note>
|
||||
|
||||
NetBird's Okta integration enhances user management by allowing you to utilize Okta as your identity provider. This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management to your applications and resources.
|
||||
|
||||
<Button href="/manage/team/idp-sync/okta-sync" variant="outline">Setup Okta</Button>
|
||||
|
||||
## OIDC-compliant IdPs
|
||||
|
||||
For OIDC-compliant Identity Providers such as **Authentik**, **Keycloak**, **JumpCloud**, and **Auth0**, you'll need to configure the IdP
|
||||
to integrate with NetBird. Below are the steps to set up different OIDC-compliant IdPs with NetBird.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
The Free plan supports Google, Microsoft, and social logins.
|
||||
</Note>
|
||||
|
||||
### Authentik
|
||||
|
||||
[Authentik](https://goauthentik.io/) is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols. Authentik includes audit logging, password policies, and full API access for automation.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/authentik" variant="outline">Setup Authentik</Button>
|
||||
|
||||
### Keycloak
|
||||
|
||||
[Keycloak](https://www.keycloak.org/) is an open-source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IDP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/keycloak" variant="outline">Setup Keycloak</Button>
|
||||
|
||||
### JumpCloud
|
||||
|
||||
[JumpCloud](https://jumpcloud.com/) is a cloud-based directory platform that provides identity, access, and device management in a unified solution. It offers single sign-on, multi-factor authentication, directory services, device management, and network access control, providing a comprehensive approach to managing users, devices, and applications from a single platform.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/jumpcloud" variant="outline">Setup JumpCloud</Button>
|
||||
|
||||
### Auth0
|
||||
|
||||
[Auth0](https://auth0.com/) is a flexible, drop-in solution to add authentication and authorization services to your applications. It's a managed service that offers extensive customization options, developer-friendly APIs, universal login, social identity providers, and advanced security features like anomaly detection and breached password detection.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/auth0" variant="outline">Setup Auth0</Button>
|
||||
@@ -0,0 +1,47 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# JumpCloud on NetBird Cloud
|
||||
|
||||
You can use JumpCloud as your Identity Provider with NetBird, but it will require some additional configuration steps. JumpCloud is a cloud-based directory platform that provides identity, access, and device management in a unified solution. It offers single sign-on, multi-factor authentication, directory services, device management, and network access control, providing a comprehensive approach to managing users, devices, and applications from a single platform.
|
||||
|
||||
1. Access the JumpCloud and navigate to USER AUTHENTICATION > SSO Applications
|
||||
|
||||
2. Click + Add New Application, select Custom Application and click Next
|
||||
|
||||
3. Enable Manage Single Sign-On (SSO), select Configure SSO with OIDC and click Next
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/jumpcloud-idp/jumpcloud-sso.png" alt="jumpcloud" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. Add NetBird as Display Label and click Next. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
|
||||
|
||||
5. Review the application setting and click Configure Application to proceed
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/jumpcloud-idp/jumpcloud-sso-config.png" alt="jumpcloud-idp" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
6. On the New Application screen, go to the SSO tab and under Endpoint Configuration set the following values:
|
||||
|
||||
- Redirect URIs: https://login.netbird.io/login/callback
|
||||
|
||||
- Login URL: https://app.netbird.io
|
||||
|
||||
7. Under Attribute Mapping enable Email and Profile scopes
|
||||
|
||||
<Note>
|
||||
Sometimes, the Jumpcloud application configuration will add duplicate attributes, like email and email_verified. The duplicates should be removed.
|
||||
</Note>
|
||||
|
||||
8. Go to the User Groups and select the list of groups to which you want to give access to the application and then click activate
|
||||
|
||||
9. Record the Client ID and Client Secret that JumpCloud generates for your application.
|
||||
|
||||
10. Share your Client ID, and Client Secret with our team. Please use a secure method for sharing this information.
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
- https://onetimesecret.com/en/ <br/>
|
||||
- https://password.link/en <br/>
|
||||
</Note>
|
||||
@@ -0,0 +1,57 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Keycloak on NetBird Cloud
|
||||
|
||||
You can use Keycloak as your Identity Provider with NetBird, but it will require some additional configuration steps. Keycloak is an open-source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IDP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols.
|
||||
|
||||
1. You need to create a new client
|
||||
|
||||
- Browse to the clients Administration menu and then click in Create client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/1-new-client.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
2. Create a client with the type OpenID Connect and add any client ID and name for the client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/2-new-client-type.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
3. Click Next and enable the following options for Capability config:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/3-new-client-capability.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
4. Click Next and fill the following fields:
|
||||
|
||||
Valid redirect URIs: `https://login.netbird.io/login/callback` <br/>
|
||||
Web origins: `+`
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/4-new-client-callback.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
5. Click Save.
|
||||
|
||||
6. Next we need to retrieve the secret for the client, you can get that in the Credentials tab for the client:
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/keycloak-idp/5-new-client-credentials.png" alt="new-client" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
7. Then, share the following information with the NetBird support team at support@netbird.io:
|
||||
|
||||
- Client ID
|
||||
- Keycloak URL
|
||||
- Realm
|
||||
- Client Secret
|
||||
- Email domains for your users
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client’s secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
https://onetimesecret.com/en/ <br/>
|
||||
https://password.link/en
|
||||
</Note>
|
||||
|
||||
Reference in New Issue
Block a user