mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
93 lines
4.5 KiB
Plaintext
93 lines
4.5 KiB
Plaintext
---
|
||
title: "Auth0 OIDC"
|
||
description: "Learn how to configure Auth0 OIDC for KMS SSO."
|
||
---
|
||
|
||
<Info>
|
||
Auth0 OIDC SSO is a paid feature. If you're using KMS Cloud, then it is
|
||
available under the **Pro Tier**. If you're self-hosting KMS, then you
|
||
should contact [email protected] to purchase a self-hosted license to use
|
||
it.
|
||
</Info>
|
||
|
||
<Steps>
|
||
<Step title="Setup application in Auth0">
|
||
1.1. From the Application's Page, navigate to the settings tab of the Auth0 application you want to integrate with KMS.
|
||
|
||
|
||
1.2. In the Application URIs section, set the **Application Login URI** and **Allowed Web Origins** fields to `https://kms.hanzo.ai` and the **Allowed Callback URL** field to `https://kms.hanzo.ai/api/v1/sso/oidc/callback`.
|
||
|
||
|
||
<Info>
|
||
If you’re self-hosting KMS, then you will want to replace https://kms.hanzo.ai with your own domain.
|
||
</Info>
|
||
|
||
Once done, click **Save Changes**.
|
||
|
||
1.3. Proceed to the Connections Tab and enable desired connections.
|
||
|
||
|
||
</Step>
|
||
<Step title="Retrieve Identity Provider (IdP) Information from Auth0">
|
||
2.1. From the application settings page, retrieve the **Client ID** and **Client Secret**
|
||
|
||
|
||
2.2. In the advanced settings (bottom-most section), retrieve the **OpenID Configuration URL** from the Endpoints tab.
|
||
|
||
|
||
Keep these values handy as we will need them in the next steps.
|
||
|
||
</Step>
|
||
<Step title="Finish configuring OIDC in KMS">
|
||
3.1. Back in KMS, head to the **Single Sign-On (SSO)** page and select the **General** tab. Click **Connect** for **OIDC**.
|
||
|
||
|
||
3.2. For configuration type, select **Discovery URL**. Then, set **Discovery Document URL**, **JWT Signature Algorithm**, **Client ID**, and **Client Secret** from step 2.1 and 2.2.
|
||
|
||
|
||
<Info>
|
||
Currently, the following JWT signature algorithms are supported: RS256, RS512, HS256, and EdDSA
|
||
</Info>
|
||
|
||
Once you've done that, press **Update** to complete the required configuration.
|
||
|
||
</Step>
|
||
<Step title="Enable OIDC in KMS">
|
||
Enabling OIDC allows members in your organization to log into KMS via Auth0.
|
||
|
||
|
||
|
||
</Step>
|
||
<Step title="Enforce OIDC SSO in KMS">
|
||
Enforcing OIDC SSO ensures that members in your organization can only access KMS
|
||
by logging into the organization via Auth0.
|
||
|
||
To enforce OIDC SSO, you're required to test out the OpenID connection by successfully authenticating at least one Auth0 user with KMS.
|
||
Once you've completed this requirement, you can toggle the **Enforce OIDC SSO** button to enforce OIDC SSO.
|
||
|
||
<Warning>
|
||
We recommend ensuring that your account is provisioned using the application in Auth0
|
||
prior to enforcing OIDC SSO to prevent any unintended issues.
|
||
</Warning>
|
||
<Info>
|
||
In case of a lockout, an organization admin can use the [Admin Login Portal](https://kms.hanzo.ai/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://kms.hanzo.ai/login/admin.
|
||
</Info>
|
||
</Step>
|
||
</Steps>
|
||
|
||
<Tip>
|
||
If you are only using one organization on your KMS instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite OIDC login.
|
||
</Tip>
|
||
|
||
<Note>
|
||
If you're configuring OIDC SSO on a self-hosted instance of KMS, make
|
||
sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
|
||
work:
|
||
<div class="height:1px;"/>
|
||
- `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
|
||
can be a random 32-byte base64 string generated with `openssl rand -base64
|
||
32`.
|
||
<div class="height:1px;"/>
|
||
- `SITE_URL`: The absolute URL of your self-hosted instance of KMS including the protocol (e.g. https://kms.hanzo.ai)
|
||
</Note>
|