mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
69 lines
3.6 KiB
Plaintext
69 lines
3.6 KiB
Plaintext
---
|
|
title: "SSO Overview"
|
|
sidebarTitle: "Overview"
|
|
description: "Learn how to log in to KMS via SSO protocols."
|
|
---
|
|
|
|
<Info>
|
|
KMS offers Google SSO and GitHub SSO for free across both KMS
|
|
Cloud and KMS Self-hosted. KMS also offers SAML SSO authentication
|
|
and OpenID Connect (OIDC) but as paid features that can be unlocked on
|
|
KMS Cloud's **Pro** tier or via enterprise license on self-hosted
|
|
instances of KMS. On this front, we support industry-leading providers
|
|
including Okta, Azure AD, and JumpCloud; with any questions, please reach out
|
|
to [email protected].
|
|
</Info>
|
|
|
|
You can configure your organization in KMS to have members authenticate with the platform via protocols like [SAML 2.0](https://en.wikipedia.org/wiki/SAML_2.0) or [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html).
|
|
|
|
## Identity providers
|
|
|
|
KMS supports these and many other identity providers:
|
|
|
|
- [Google SSO](/documentation/platform/sso/google)
|
|
- [GitHub SSO](/documentation/platform/sso/github)
|
|
- [GitLab SSO](/documentation/platform/sso/gitlab)
|
|
- [Okta SAML](/documentation/platform/sso/okta)
|
|
- [Azure SAML](/documentation/platform/sso/azure)
|
|
- [JumpCloud SAML](/documentation/platform/sso/jumpcloud)
|
|
- [Keycloak SAML](/documentation/platform/sso/keycloak-saml)
|
|
- [Google SAML](/documentation/platform/sso/google-saml)
|
|
- [Auth0 SAML](/documentation/platform/sso/auth0-saml)
|
|
- [Keycloak OIDC](/documentation/platform/sso/keycloak-oidc)
|
|
- [Auth0 OIDC](/documentation/platform/sso/auth0-oidc)
|
|
- [General OIDC](/documentation/platform/sso/general-oidc)
|
|
|
|
If your required identity provider is not shown in the list above, please reach out to [[email protected]](mailto:[email protected]) for assistance.
|
|
|
|
<Info>
|
|
For enhanced security, KMS enforces PKCE (Proof Key for Code Exchange) with the OAuth 2.0-based SSO providers and OIDC. This provides additional protection against authorization code interception attacks and strengthens your authentication flow security.
|
|
</Info>
|
|
|
|
## SSO Break Glass
|
|
|
|
In the event your SSO provider experiences downtime, and you need to access KMS, Organization Admins can utilize the Admin Login Portal to bypass SSO enforcement.
|
|
|
|
This portal is accessible at `/login/admin` (e.g., https://kms.hanzo.ai/login/admin).
|
|
|
|
<Note>
|
|
To bypass SSO for an organization, you must be an **Organization Admin** for that specific organization. This **Organization Admin** role is independent of **Server Admin** status. Being a **Server Admin** alone does not grant permission to use this bypass feature.
|
|
</Note>
|
|
|
|
## FAQ
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Why does KMS require additional email verification for users connected via SAML?">
|
|
By default, KMS Cloud is configured to not trust emails from external
|
|
identity providers to prevent any malicious account takeover attempts via
|
|
email spoofing. Accordingly, KMS creates a new user for anyone provisioned
|
|
through an external identity provider and requires an additional email
|
|
verification step upon their first login.
|
|
|
|
If you're running a self-hosted instance of KMS and would like it to trust emails from external identity providers,
|
|
you can configure this behavior in the Server Admin Console.
|
|
</Accordion>
|
|
<Accordion title="Why do I get redirected to SSO when trying to use the Admin Login Portal?">
|
|
You are likely being redirected because you do not have email authentication mode enabled, or you're not an **Organization Admin**. This portal requires **Organization Admin** status and direct credential login (email and password). **Server Admin** status alone is insufficient.
|
|
</Accordion>
|
|
</AccordionGroup>
|