mirror of
https://github.com/hanzoai/team.git
synced 2026-11-01 07:55:31 +00:00
bc56925599
* feat(docs): move docs-experimental content into monorepo docs/ * Remove plan related files and comments * Cleanup comments, remove generated files --------- Co-authored-by: Hanzo Dev <[email protected]>
38 lines
3.2 KiB
Plaintext
38 lines
3.2 KiB
Plaintext
---
|
||
title: "OpenID Connect Single Sign-On"
|
||
---
|
||
<PlanAvailability slug="all-commercial" />
|
||
|
||
Mattermost provides OpenID Connect support for [GitLab](/administration-guide/onboard/sso-gitlab), [Google Apps](/administration-guide/onboard/sso-google), and [Entra ID](/administration-guide/onboard/sso-entraid). With OpenID Connect, users can also use their login to Keycloak, Atlassian Crowd, Apple, Microsoft, Salesforce, Auth0, Ory.sh, Facebook, Okta, OneLogin, and Azure AD, as well as others, as a Single Sign-on (SSO) service for team creation, account creation, and user login.
|
||
|
||
Follow these steps to configure a service provider using OpenID Connect.
|
||
|
||
## Step 1: Create an OpenID Connect Application
|
||
|
||
1. Follow service provider documentation for creating an OpenID Connect application. Most OpenID Connect service providers require authorization of all redirect URIs.
|
||
2. In the appropriate field, enter `{your-mattermost-url}/signup/openid/complete` For example: `http://domain.com/signup/openid/complete`
|
||
3. Copy and paste values for the **Discovery Endpoint**, **Client ID**, and **Client Secret** values to a temporary location. You will enter these values when you configure Mattermost.
|
||
|
||
## Step 2: Configure Mattermost for an OpenID Connect SSO
|
||
|
||
1. Log in to Mattermost, then go to **System Console \> Authentication \> OpenID Connect**.
|
||
2. Select **OpenID Connect (Other)** as the service provider.
|
||
3. Enter the **Discovery Endpoint**.
|
||
4. Enter the **Client ID**.
|
||
5. Enter the **Client Secret**.
|
||
6. Specify a **Button Name** and **Button Color** for the OpenID Connect option on the Mattermost login page.
|
||
7. Select **Save**.
|
||
8. Restart your Mattermost server to see the changes take effect.
|
||
|
||
<Note>
|
||
|
||
\- When Mattermost is configured to use OpenID Connect for user authentication, the following user attribute changes can't be made through the Mattermost API: first name, last name, or username. OpenID Connect must be the authoritative source for these user attributes. - Admins can configure Mattermost to use the `preferred_username` claim from the OpenID token as the Mattermost username. Enable the **Use preferred username** option in the provider's settings under **System Console \> Authentication \> OpenID Connect**. See the [authentication configuration settings](/administration-guide/configure/authentication-configuration-settings#openid-connect) for details. - The **Discovery Endpoint** setting can be used to determine the connectivity and availability of arbitrary hosts. System admins concerned about this can use custom admin roles to limit access to modifying these settings. See the [delegated granular administration](/administration-guide/onboard/delegated-granular-administration#edit-privileges-of-admin-roles-advanced)) documentation for details.
|
||
|
||
</Note>
|
||
|
||
## Frequently Asked Questions
|
||
|
||
### How can I use LDAP attributes or Groups with OpenID?
|
||
|
||
At this time, LDAP data isn't compatible with OpenID. If you currently rely on LDAP to manage your users' teams, channels, groups, or attributes, you won't be able to do this automatically with users who have logged in with OpenID. If you need LDAP synced to each user, we suggest using SAML or LDAP as the login provider. Some OpenID providers can use SAML instead, like Keycloak.
|