diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-add-group.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-add-group.png new file mode 100644 index 00000000..a1263221 Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-add-group.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-connect.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-connect.png new file mode 100644 index 00000000..53fe92e4 Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-connect.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-enable-export.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-enable-export.png new file mode 100644 index 00000000..ca7729ff Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-enable-export.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-provisioning-settings.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-provisioning-settings.png new file mode 100644 index 00000000..8b471d65 Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-provisioning-settings.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-credentials.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-credentials.png new file mode 100644 index 00000000..81a58019 Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-credentials.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-enabled.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-enabled.png new file mode 100644 index 00000000..cc903ff5 Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-enabled.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-getting-started.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-getting-started.png new file mode 100644 index 00000000..d9d4a8bb Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-getting-started.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-group-filter.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-group-filter.png new file mode 100644 index 00000000..afa1248f Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-group-filter.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-user-group-filter.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-user-group-filter.png new file mode 100644 index 00000000..51114439 Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-user-group-filter.png differ diff --git a/public/docs-static/img/manage/team/idp-sync/iij-id-sync/netbird-verify-users.png b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/netbird-verify-users.png new file mode 100644 index 00000000..b4f30a72 Binary files /dev/null and b/public/docs-static/img/manage/team/idp-sync/iij-id-sync/netbird-verify-users.png differ diff --git a/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/application-information.png b/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/application-information.png new file mode 100644 index 00000000..269114a2 Binary files /dev/null and b/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/application-information.png differ diff --git a/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/assign-users.png b/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/assign-users.png new file mode 100644 index 00000000..2612f470 Binary files /dev/null and b/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/assign-users.png differ diff --git a/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/create-custom-app.png b/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/create-custom-app.png new file mode 100644 index 00000000..2fe8370a Binary files /dev/null and b/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/create-custom-app.png differ diff --git a/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/federation-settings.png b/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/federation-settings.png new file mode 100644 index 00000000..077c9c34 Binary files /dev/null and b/public/docs-static/img/manage/team/single-sign-on/iij-id-idp/federation-settings.png differ diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx index 7fc36d18..66f305aa 100644 --- a/src/components/NavigationDocs.jsx +++ b/src/components/NavigationDocs.jsx @@ -331,6 +331,10 @@ export const docsNavigation = [ title: 'Keycloak', href: '/manage/team/idp-sync/keycloak-sync', }, + { + title: 'IIJ ID', + href: '/manage/team/idp-sync/iij-id-sync', + }, ], }, { diff --git a/src/pages/manage/team/idp-sync/iij-id-sync.mdx b/src/pages/manage/team/idp-sync/iij-id-sync.mdx new file mode 100644 index 00000000..386abc69 --- /dev/null +++ b/src/pages/manage/team/idp-sync/iij-id-sync.mdx @@ -0,0 +1,139 @@ +import {Note} from "@/components/mdx"; + +# Provision Users and Groups From IIJ ID + +[IIJ ID](https://www.iij.ad.jp/biz/iid/) is a cloud-based identity and access management service (IDaaS) from Internet Initiative Japan. +It provides single sign-on (SSO), multi-factor authentication (MFA), and centralized user management to help organizations +secure and manage access to their resources. + +NetBird's IIJ ID integration enhances user management by allowing you to utilize IIJ ID as your identity provider. +This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management +to your applications and resources. + +## Prerequisites + +Before you begin the integration process, ensure you have an IIJ ID administrator account with permission to manage +applications, application users, and groups in the IIJ ID console. + +## Setting Up SSO with IIJ ID + +Before configuring SCIM provisioning, you must first set up Single Sign-On (SSO) with IIJ ID. Please follow the detailed setup instructions in our [Single Sign-On guide for IIJ ID](/manage/team/single-sign-on/iij-id). + +Once SSO is configured, and you can successfully log in to NetBird using your IIJ ID credentials, you can proceed with the SCIM setup below. + +## Enabling IIJ ID SCIM in NetBird + +To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Provider Sync` in your NetBird dashboard. + +

+ NetBird IIJ ID Integration +

+ +Click the `Connect Generic SCIM` button to begin the configuration process. + +

+ NetBird IIJ ID Getting Started +

+ +Click `Get Started` to launch the configuration wizard. You will be guided through several configuration options: + +**Groups to be synchronized** + +By default, all groups exported to the NetBird application in IIJ ID will be synchronized. If you want to synchronize only exported groups that start with a specific prefix, you can specify them in the filter. Keep in mind that the prefix matching is case-sensitive. + +

+ NetBird IIJ ID Group Filter +

+ +Click `Continue` to proceed to the next step. + +**Users to be synchronized** + +By default, all users from the groups exported to the NetBird application will be synchronized. If you want to further filter and synchronize only users from specific groups, you can specify those group names in the filter. The group name matching is case-sensitive. + +

+ NetBird IIJ ID User Group Filter +

+ +Click `Continue` to generate your SCIM credentials. + +**SCIM Credentials** + +NetBird will generate the SCIM credentials required to configure IIJ ID. Make note of both the **Base URL** and **Token Key** as you will need them in the next section to complete the IIJ ID configuration. + +

+ NetBird IIJ ID SCIM Credentials +

+ +Click `Finish Setup` to complete the NetBird SCIM configuration. + +

+ NetBird IIJ ID SCIM Enabled +

+ +You can now proceed to configure provisioning in IIJ ID using the credentials generated above. + +## Configure Provisioning in IIJ ID + +In your IIJ ID console, go to `Application` > `Application Management`, click `Edit` on your `NetBird` application, and select the `Provisioning` tab. + +Select `Export accounts` and enter the following details: + +* **The base URL for the SCIM server**: `https://api.netbird.io/api/scim/v2` +* **Access token**: Paste the Token Key you copied from NetBird + +

+ IIJ ID Provisioning Settings +

+ +Click `Update Provisioning Information` to save the configuration. + +The default IIJ ID attribute mapping is compatible with NetBird, so no attribute mapping changes are required. + +### Enable Export for Application Users + +In your IIJ ID console, open your `NetBird` application and select the `Application User` tab. Click `Edit` on the entry you +want to synchronize, then set: + +* **Export**: `Export` + +Click `Update Applications User Settings` to apply the change. + +

+ IIJ ID Enable Export +

+ +The `Export` column now shows `Export` for that entry. When you select a group as an Application User, its members become +Application Users as well, so IIJ ID exports those users to NetBird. + +### Add Groups to Export + +Exporting the users does not export the groups themselves. Still in your `NetBird` application, select the `Group` tab, +enter the groups you want to export to NetBird, and click `Add`. + +

+ IIJ ID Add Group +

+ +Once saved, IIJ ID will automatically export the selected users, groups, and their memberships to NetBird. + + + To synchronize additional users or groups later, add them as Application Users in your `NetBird` application, enable `Export` on them the same way, and add their groups on the `Group` tab. + + +## Verify Synchronization + +After configuring provisioning in IIJ ID, the synchronization will begin automatically. You can verify that users and groups +have been successfully synchronized by navigating to `Team > Users` in your NetBird dashboard. + +

+ NetBird Verify Users +

+ + + SCIM provisioning will manage only resources that are created through IIJ ID. Any resources created directly in NetBird will not be managed by SCIM. + + + + Synced groups will only be available for membership and will not change the role of user in NetBird + diff --git a/src/pages/manage/team/idp-sync/index.mdx b/src/pages/manage/team/idp-sync/index.mdx index 68090177..b287902e 100644 --- a/src/pages/manage/team/idp-sync/index.mdx +++ b/src/pages/manage/team/idp-sync/index.mdx @@ -56,6 +56,10 @@ Provision users and groups from JumpCloud. See [JumpCloud setup](/manage/team/id Provision users and groups from Keycloak. See [Keycloak setup](/manage/team/idp-sync/keycloak-sync). +### IIJ ID + +Provision users and groups from IIJ ID over SCIM. See [IIJ ID setup](/manage/team/idp-sync/iij-id-sync). + ## Generic SCIM NetBird provides a way to sync users and groups from any identity provider that supports the SCIM (System for Cross-domain Identity Management) protocol. diff --git a/src/pages/manage/team/single-sign-on/iij-id.mdx b/src/pages/manage/team/single-sign-on/iij-id.mdx new file mode 100644 index 00000000..d3e0cbce --- /dev/null +++ b/src/pages/manage/team/single-sign-on/iij-id.mdx @@ -0,0 +1,81 @@ +import {Note} from "@/components/mdx"; + +# IIJ ID on NetBird Cloud + +You can use IIJ ID as your Identity Provider with NetBird, but it will require some additional configuration steps. [IIJ ID](https://www.iij.ad.jp/biz/iid/) is a cloud-based identity and access management service (IDaaS) from Internet Initiative Japan that provides single sign-on, multi-factor authentication, and user lifecycle management, with support for OpenID Connect, SAML, and SCIM. + +NetBird integrates with IIJ ID as a custom OpenID Connect application. + + + Support for OIDC-compliant IdPs is available on the Team plan and higher. + The Free plan supports Google, Microsoft, and social logins. + + +## Step 1: Create a Custom OpenID Connect Application + +Log in to the IIJ ID console and navigate to `Application` > `Application Management`. Click `Add Application`, then `Add Custom Application`. + +Select `OpenID Connect Application` and click `Next`. + +

+ iij-id-create-custom-app +

+ +Fill out the application information: + +- **Application name**: `NetBird` +- **Application description**: An optional description for your administrators +- **Application logo**: An optional logo image (GIF, JPEG, PNG, or BMP, up to 10 MB) + +Click `Add Application`. + +

+ iij-id-application-information +

+ +## Step 2: Configure the Federation Settings + +Open the newly created application, click `Edit`, and select the `Federation` tab. Set the following: + +- **Default scopes**: Select `openid`, `profile`, and `email` +- **Application top page URL**: `https://app.netbird.io` +- **Redirect URLs**: `https://login.netbird.io/login/callback` + +Click `Update` to apply the configuration. + +

+ iij-id-federation-settings +

+ +## Step 3: Retrieve the Client Credentials + +The `Federation` tab also displays the OpenID Connect provider information NetBird needs. Copy and store the following securely: + +- **Client ID** +- **Client Secret** +- **Discovery endpoint** + +NetBird uses the Discovery endpoint to automatically resolve the Authorization, Token, and User Info endpoints of your IIJ ID tenant. + +## Step 4: Assign Users + +Assign access to the NetBird application so users can sign in to NetBird with IIJ ID. Open the application, select `Application User`, and click `Add Application User`. Select the users or groups that should have access, choose whether the application appears in **My Applications**, and click `Add Application User`. + +

+ iij-id-assign-users +

+ +## Step 5: Share Configuration with NetBird + +Send the following information to the NetBird support team at support@netbird.io: + +- **Client ID** +- **Client Secret** +- **Discovery endpoint** (the OpenID configuration URL you copied in Step 3) +- **Email domains for your users** + + +We recommend using a secure channel to share the Client Secret. You can send a separate email and use a secret sharing service like:
+- https://onetimesecret.com/en/
+- https://password.link/en
+ diff --git a/src/pages/manage/team/single-sign-on/index.mdx b/src/pages/manage/team/single-sign-on/index.mdx index 5c685c08..53b15b02 100644 --- a/src/pages/manage/team/single-sign-on/index.mdx +++ b/src/pages/manage/team/single-sign-on/index.mdx @@ -99,3 +99,9 @@ to integrate with NetBird. Below are the steps to set up different OIDC-complian [Zoho Directory](https://www.zoho.com/directory/) is a cloud-based identity and access management platform that provides single sign-on, multi-factor authentication, and user lifecycle management. It supports OpenID Connect, OAuth 2.0, and SAML, and lets you register NetBird as a custom OIDC application. + +### IIJ ID + +[IIJ ID](https://www.iij.ad.jp/biz/iid/) is a cloud-based identity and access management platform (IDaaS) from Internet Initiative Japan that provides single sign-on, multi-factor authentication, and user lifecycle management. It supports OpenID Connect, SAML, and SCIM, and lets you register NetBird as a custom OIDC application. + +