mirror of
https://github.com/netbirdio/docs.git
synced 2026-08-25 01:01:27 +02:00
Add IIJ ID SSO and SCIM provisioning guides (#922)
This commit is contained in:
Bethuel Mmbaga
@@ -331,6 +331,10 @@ export const docsNavigation = [
|
||||
title: 'Keycloak',
|
||||
href: '/manage/team/idp-sync/keycloak-sync',
|
||||
},
|
||||
{
|
||||
title: 'IIJ ID',
|
||||
href: '/manage/team/idp-sync/iij-id-sync',
|
||||
},
|
||||
],
|
||||
},
|
||||
{
|
||||
|
||||
139
src/pages/manage/team/idp-sync/iij-id-sync.mdx
Normal file
139
src/pages/manage/team/idp-sync/iij-id-sync.mdx
Normal file
@@ -0,0 +1,139 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# Provision Users and Groups From IIJ ID
|
||||
|
||||
[IIJ ID](https://www.iij.ad.jp/biz/iid/) is a cloud-based identity and access management service (IDaaS) from Internet Initiative Japan.
|
||||
It provides single sign-on (SSO), multi-factor authentication (MFA), and centralized user management to help organizations
|
||||
secure and manage access to their resources.
|
||||
|
||||
NetBird's IIJ ID integration enhances user management by allowing you to utilize IIJ ID as your identity provider.
|
||||
This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management
|
||||
to your applications and resources.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before you begin the integration process, ensure you have an IIJ ID administrator account with permission to manage
|
||||
applications, application users, and groups in the IIJ ID console.
|
||||
|
||||
## Setting Up SSO with IIJ ID
|
||||
|
||||
Before configuring SCIM provisioning, you must first set up Single Sign-On (SSO) with IIJ ID. Please follow the detailed setup instructions in our [Single Sign-On guide for IIJ ID](/manage/team/single-sign-on/iij-id).
|
||||
|
||||
Once SSO is configured, and you can successfully log in to NetBird using your IIJ ID credentials, you can proceed with the SCIM setup below.
|
||||
|
||||
## Enabling IIJ ID SCIM in NetBird
|
||||
|
||||
To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Provider Sync` in your NetBird dashboard.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-connect.png" alt="NetBird IIJ ID Integration" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Click the `Connect Generic SCIM` button to begin the configuration process.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-getting-started.png" alt="NetBird IIJ ID Getting Started" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Click `Get Started` to launch the configuration wizard. You will be guided through several configuration options:
|
||||
|
||||
**Groups to be synchronized**
|
||||
|
||||
By default, all groups exported to the NetBird application in IIJ ID will be synchronized. If you want to synchronize only exported groups that start with a specific prefix, you can specify them in the filter. Keep in mind that the prefix matching is case-sensitive.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-group-filter.png" alt="NetBird IIJ ID Group Filter" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Click `Continue` to proceed to the next step.
|
||||
|
||||
**Users to be synchronized**
|
||||
|
||||
By default, all users from the groups exported to the NetBird application will be synchronized. If you want to further filter and synchronize only users from specific groups, you can specify those group names in the filter. The group name matching is case-sensitive.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-user-group-filter.png" alt="NetBird IIJ ID User Group Filter" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Click `Continue` to generate your SCIM credentials.
|
||||
|
||||
**SCIM Credentials**
|
||||
|
||||
NetBird will generate the SCIM credentials required to configure IIJ ID. Make note of both the **Base URL** and **Token Key** as you will need them in the next section to complete the IIJ ID configuration.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-credentials.png" alt="NetBird IIJ ID SCIM Credentials" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Click `Finish Setup` to complete the NetBird SCIM configuration.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-scim-enabled.png" alt="NetBird IIJ ID SCIM Enabled" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
You can now proceed to configure provisioning in IIJ ID using the credentials generated above.
|
||||
|
||||
## Configure Provisioning in IIJ ID
|
||||
|
||||
In your IIJ ID console, go to `Application` > `Application Management`, click `Edit` on your `NetBird` application, and select the `Provisioning` tab.
|
||||
|
||||
Select `Export accounts` and enter the following details:
|
||||
|
||||
* **The base URL for the SCIM server**: `https://api.netbird.io/api/scim/v2`
|
||||
* **Access token**: Paste the Token Key you copied from NetBird
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-provisioning-settings.png" alt="IIJ ID Provisioning Settings" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Click `Update Provisioning Information` to save the configuration.
|
||||
|
||||
The default IIJ ID attribute mapping is compatible with NetBird, so no attribute mapping changes are required.
|
||||
|
||||
### Enable Export for Application Users
|
||||
|
||||
In your IIJ ID console, open your `NetBird` application and select the `Application User` tab. Click `Edit` on the entry you
|
||||
want to synchronize, then set:
|
||||
|
||||
* **Export**: `Export`
|
||||
|
||||
Click `Update Applications User Settings` to apply the change.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-enable-export.png" alt="IIJ ID Enable Export" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
The `Export` column now shows `Export` for that entry. When you select a group as an Application User, its members become
|
||||
Application Users as well, so IIJ ID exports those users to NetBird.
|
||||
|
||||
### Add Groups to Export
|
||||
|
||||
Exporting the users does not export the groups themselves. Still in your `NetBird` application, select the `Group` tab,
|
||||
enter the groups you want to export to NetBird, and click `Add`.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/iij-id-add-group.png" alt="IIJ ID Add Group" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Once saved, IIJ ID will automatically export the selected users, groups, and their memberships to NetBird.
|
||||
|
||||
<Note>
|
||||
To synchronize additional users or groups later, add them as Application Users in your `NetBird` application, enable `Export` on them the same way, and add their groups on the `Group` tab.
|
||||
</Note>
|
||||
|
||||
## Verify Synchronization
|
||||
|
||||
After configuring provisioning in IIJ ID, the synchronization will begin automatically. You can verify that users and groups
|
||||
have been successfully synchronized by navigating to `Team > Users` in your NetBird dashboard.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/idp-sync/iij-id-sync/netbird-verify-users.png" alt="NetBird Verify Users" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
<Note>
|
||||
SCIM provisioning will manage only resources that are created through IIJ ID. Any resources created directly in NetBird will not be managed by SCIM.
|
||||
</Note>
|
||||
|
||||
<Note>
|
||||
Synced groups will only be available for membership and will not change the role of user in NetBird
|
||||
</Note>
|
||||
@@ -56,6 +56,10 @@ Provision users and groups from JumpCloud. See [JumpCloud setup](/manage/team/id
|
||||
|
||||
Provision users and groups from Keycloak. See [Keycloak setup](/manage/team/idp-sync/keycloak-sync).
|
||||
|
||||
### IIJ ID
|
||||
|
||||
Provision users and groups from IIJ ID over SCIM. See [IIJ ID setup](/manage/team/idp-sync/iij-id-sync).
|
||||
|
||||
## Generic SCIM
|
||||
|
||||
NetBird provides a way to sync users and groups from any identity provider that supports the SCIM (System for Cross-domain Identity Management) protocol.
|
||||
|
||||
81
src/pages/manage/team/single-sign-on/iij-id.mdx
Normal file
81
src/pages/manage/team/single-sign-on/iij-id.mdx
Normal file
@@ -0,0 +1,81 @@
|
||||
import {Note} from "@/components/mdx";
|
||||
|
||||
# IIJ ID on NetBird Cloud
|
||||
|
||||
You can use IIJ ID as your Identity Provider with NetBird, but it will require some additional configuration steps. [IIJ ID](https://www.iij.ad.jp/biz/iid/) is a cloud-based identity and access management service (IDaaS) from Internet Initiative Japan that provides single sign-on, multi-factor authentication, and user lifecycle management, with support for OpenID Connect, SAML, and SCIM.
|
||||
|
||||
NetBird integrates with IIJ ID as a custom OpenID Connect application.
|
||||
|
||||
<Note>
|
||||
Support for OIDC-compliant IdPs is available on the Team plan and higher.
|
||||
The Free plan supports Google, Microsoft, and social logins.
|
||||
</Note>
|
||||
|
||||
## Step 1: Create a Custom OpenID Connect Application
|
||||
|
||||
Log in to the IIJ ID console and navigate to `Application` > `Application Management`. Click `Add Application`, then `Add Custom Application`.
|
||||
|
||||
Select `OpenID Connect Application` and click `Next`.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/iij-id-idp/create-custom-app.png" alt="iij-id-create-custom-app" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
Fill out the application information:
|
||||
|
||||
- **Application name**: `NetBird`
|
||||
- **Application description**: An optional description for your administrators
|
||||
- **Application logo**: An optional logo image (GIF, JPEG, PNG, or BMP, up to 10 MB)
|
||||
|
||||
Click `Add Application`.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/iij-id-idp/application-information.png" alt="iij-id-application-information" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
## Step 2: Configure the Federation Settings
|
||||
|
||||
Open the newly created application, click `Edit`, and select the `Federation` tab. Set the following:
|
||||
|
||||
- **Default scopes**: Select `openid`, `profile`, and `email`
|
||||
- **Application top page URL**: `https://app.netbird.io`
|
||||
- **Redirect URLs**: `https://login.netbird.io/login/callback`
|
||||
|
||||
Click `Update` to apply the configuration.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/iij-id-idp/federation-settings.png" alt="iij-id-federation-settings" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
## Step 3: Retrieve the Client Credentials
|
||||
|
||||
The `Federation` tab also displays the OpenID Connect provider information NetBird needs. Copy and store the following securely:
|
||||
|
||||
- **Client ID**
|
||||
- **Client Secret**
|
||||
- **Discovery endpoint**
|
||||
|
||||
NetBird uses the Discovery endpoint to automatically resolve the Authorization, Token, and User Info endpoints of your IIJ ID tenant.
|
||||
|
||||
## Step 4: Assign Users
|
||||
|
||||
Assign access to the NetBird application so users can sign in to NetBird with IIJ ID. Open the application, select `Application User`, and click `Add Application User`. Select the users or groups that should have access, choose whether the application appears in **My Applications**, and click `Add Application User`.
|
||||
|
||||
<p>
|
||||
<img src="/docs-static/img/manage/team/single-sign-on/iij-id-idp/assign-users.png" alt="iij-id-assign-users" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
## Step 5: Share Configuration with NetBird
|
||||
|
||||
Send the following information to the NetBird support team at support@netbird.io:
|
||||
|
||||
- **Client ID**
|
||||
- **Client Secret**
|
||||
- **Discovery endpoint** (the OpenID configuration URL you copied in Step 3)
|
||||
- **Email domains for your users**
|
||||
|
||||
<Note>
|
||||
We recommend using a secure channel to share the Client Secret. You can send a separate email and use a secret sharing service like: <br/>
|
||||
- https://onetimesecret.com/en/ <br/>
|
||||
- https://password.link/en <br/>
|
||||
</Note>
|
||||
@@ -99,3 +99,9 @@ to integrate with NetBird. Below are the steps to set up different OIDC-complian
|
||||
[Zoho Directory](https://www.zoho.com/directory/) is a cloud-based identity and access management platform that provides single sign-on, multi-factor authentication, and user lifecycle management. It supports OpenID Connect, OAuth 2.0, and SAML, and lets you register NetBird as a custom OIDC application.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/zoho" variant="outline">Setup Zoho</Button>
|
||||
|
||||
### IIJ ID
|
||||
|
||||
[IIJ ID](https://www.iij.ad.jp/biz/iid/) is a cloud-based identity and access management platform (IDaaS) from Internet Initiative Japan that provides single sign-on, multi-factor authentication, and user lifecycle management. It supports OpenID Connect, SAML, and SCIM, and lets you register NetBird as a custom OIDC application.
|
||||
|
||||
<Button href="/manage/team/single-sign-on/iij-id" variant="outline">Setup IIJ ID</Button>
|
||||
|
||||
Reference in New Issue
Block a user