team/docs/main/administration-guide/onboard/sso-saml-okta.mdx at release-11.10

hanzoai/team

Fork 0

mirror of https://github.com/hanzoai/team.git synced 2026-11-01 07:55:31 +00:00

Files

T

b5f007d35e docs: fix broken path links, anchors, and tab rendering from RST-to-MDX migration (#37433 )

* docs: resolve cross-file anchor mismatches from RST-to-MDX migration

The Sphinx-to-Docusaurus migration converted `:ref:`/`{ref}` links using
naive text-slugification, so anchors that pointed to headings in a
different file (e.g. release-summary tables linking into their
respective changelog pages) were emitted as same-page fragments and
silently resolved to nothing.

Built a label registry from the original Sphinx `.. _label:` / `(label)=`
targets to recover the true source file for each cross-reference, then
rewrote the affected links to point at the correct file + heading
anchor. Fixes 282 broken cross-file anchors, primarily in the mobile/
desktop/server release-summary pages, plus assorted same-page anchor
mismatches caught by re-auditing after the prior admonition/anchor fix.

* docs: manually resolve remaining anchor mismatches after cross-file audit

Hand-verified fixes for anchors that fuzzy-matching alone couldn't
safely resolve (confirmed against actual heading text/context, and in a
few cases against the original RST source, before applying):

- Typos and dropped words carried over from the original Sphinx docs
  (e.g. "bot-acocunts", "auto-follow-all-new-channel-threads" ->
  "follow-all-new-channel-threads").
- Sphinx auto-generated duplicate-heading IDs (#id1/#id3/#id4) resolved
  to their real target headings.
- Numbered-step TOC links in enterprise-roll-out-checklist.mdx that
  dropped the leading "N. " used in the actual heading slugs.
- Push-notification docs pointing at the wrong file entirely
  (environment-configuration-settings instead of
  push-notification-server-configuration-settings).
- SAML "saml-enterprise" label resolved to its true cross-file target
  (authentication-configuration-settings#saml-2-0), recovered from the
  original RST label definition that the automated registry missed
  because it sat after an RST transition marker.
- sso-saml-technical references converted from broken same-page/
  malformed-path anchors to correct page links.

* docs: fix SAML 2.0 anchor slug (saml-2-0 -> saml-20)

github-slugger strips periods rather than hyphenating them, so "SAML
2.0" slugifies to saml-20, not saml-2-0 as previously fixed.

* docs: fix broken path links found during docs/main migration cleanup

* docs: convert div.tab blocks to Docusaurus Tabs/TabItem components

* docs: restore missing Kubernetes deployment architecture diagrams

The RST-to-MDX migration never copied over the AWS/Azure/Oracle
architecture diagrams referenced by the deployment-architecture-at-scale
page, leaving broken images in each Tabs/TabItem.

* docs: fix 7 anchor mismatches from the fragment/heading audit

Covers three root causes from the anchor mismatch breakdown:
- Fragment repeated the target page's own title instead of a real
  heading, so the link is simplified to point at the bare page.
- Heading exists verbatim but lives on a sibling settings page
  (experimental-configuration-settings, push-notification-server-
  configuration-settings) rather than environment-configuration-settings.
- A page path was mistakenly pasted into a same-page #fragment instead
  of being used as a real cross-page link.

* docs: fix 8 anchor slugs that were close but didn't match the real heading

Repoints links whose fragment was a plausible guess (typo, reworded
heading, or wrong section) at the actual auto-generated slug of the
target heading, confirmed by inspecting each target page directly.

* docs: merge split Tabs blocks so tabs render horizontally

The div.tab conversion script split some sibling tab groups into
separate single-item Tabs blocks whenever a stray blockquote marker
sat between them, causing them to render stacked instead of as one
horizontal tab bar. Merges the MySQL/PostgreSQL and Team/Enterprise
Edition tab groups back into single Tabs blocks.

* docs: remove Azure tab and restore Kubernetes deploy content

The Mattermost Operator, Azure, and Oracle platform tabs on the
Kubernetes deployment guide were split across two separate Tabs
blocks (rendering stacked instead of as one tab bar) and all three
tab bodies were empty because the migration never flattened the
original RST include directives. Removes the unsupported Azure tab
and restores the Mattermost Operator and Oracle content from the
pre-migration RST sources as a single merged Tabs block.

* addresscoderabbitreview

* docs: unify Linux/Kubernetes/Containers deploy pages and fix FIPS/STIG placement

Kubernetes and Containers duplicated full install content across a top-level
page (Tabs) and orphaned sidebar subpages that nothing linked to. Reworked
both to follow the Linux page's pattern: shared content on the landing page,
platform-specific instructions live once in their own subpage.

Also removed configure-fips-at-install-time.mdx, which claimed FIPS is
available for native Linux installs — FIPS/STIG in Mattermost is a container
image property (Chainguard-based build), not available outside Docker/
Kubernetes. Consolidated all FIPS/STIG references onto
containers/fips-stig.mdx and pointed the Mattermost Operator subpage (not
Oracle OKE, which doesn't expose image selection) at it.

* docs: fix review findings — image alt text, Important callout markup, typo

- Replace generic alt="image" on scaling diagrams with descriptive text
  identifying cloud provider and user scale.
- Convert raw div.important markup in deploy-containers.mdx to the
  repo's <Important> component, matching usage elsewhere in the file.
- Fix "Matermost" typo in manage-your-display-options.mdx.

---------

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-10 14:50:13 +03:00

127 lines

8.8 KiB

Plaintext

Raw Permalink Blame History

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

 ---
 title: "Configure SAML with Okta"
 ---
 import Inc0_sso_saml_before_you_begin from './sso-saml-before-you-begin.mdx';
 import Inc1_sso_saml_ldapsync from './sso-saml-ldapsync.mdx';
 import Inc2_sso_saml_faq from './sso-saml-faq.mdx';
 <PlanAvailability slug="all-commercial" />
 The following process provides steps to configure SAML 2.0 with Okta for Mattermost.
 See the encryption options documentation for details on what [encryption methods](/deployment-guide/encryption-options#saml-encryption-support) Mattermost supports for SAML.
 <Inc0_sso_saml_before_you_begin />
 ## Set Up a connection app for Mattermost Single Sign-On
 .  Log in to Okta as an administrator.
 .  Switch to the **Classic UI**, using the drop-down in the upper left.
 .  Go to **Admin Dashboard \> Applications \> Add Application**.
 .  Select **Create New App**, then choose **SAML 2.0** as the Sign on method.
     > ![In Okta, switch to the Classic UI, then go to the Admin Dashboard \> Applications \> Add Application to create a new app. Choose SAML 2.0 as the Sign on method.](/images/okta_1_new_app.png)
 .  Enter **General Settings** for the application, including **App name** and **App logo** (optional). It's recommended to display the application icon to users, including in the Okta Mobile app. If you’d like to use a Mattermost logo for the application, you can download one [from our page](https://handbook.mattermost.com/operations/operations/publishing/publishing-guidelines/brand-and-visual-design-guidelines).
     > ![In Okta, under General Settings, enter an App name and an optional logo. Mattermost recommends displaying the application icon to users and within the Okta mobile app. Select Next to continue.](/images/okta_2_general_settings.png)
 .  Enter **SAML Settings**, including:
 > - **Single sign on URL:** `https://&lt;your-mattermost-url&gt;/login/sso/saml` where `https://&lt;your-mattermost-url&gt;` should typically match the [Mattermost Site URL](/administration-guide/configure/environment-configuration-settings#site-url).
 >
 > - **Audience URI:** For instance, `mattermost`
 >
 > - **Name ID format:** `unspecified`
 >
 > - **Application username:** `Email`
 >
 >   > ![In Okta, under Configure SAML, enter required SAML settings.](/images/okta_3_initial_saml_settings.png)
 .  To set up encryption for your SAML connection, select **Show Advanced Settings**.
     ![In Okta, under Configure SAML, set up encryption for your SAML connection by selecting Show Advanced Settings.](/images/okta_4_initial_saml_settings.png)
 .  Set **Assertion Encryption** as **Encrypted**, then upload the Service Provider Public Certificate you generated earlier to the **Encryption Certificate** field.
     > ![In Advanced Settings, set the Assertion Encryption as Encrypted, then upload the generated Service Provider Public Certificate to the Encryption Certificate field](/images/okta_5_advanced_saml_settings.png)
 .  Enter attribute statements used to map attributes between Okta and Mattermost. For more information on which attributes are configurable, see our [documentation on SAML configuration settings](/administration-guide/configure/authentication-configuration-settings#saml-20). Email and username attributes are required. For SAML with Okta, an [ID attribute](/administration-guide/configure/authentication-configuration-settings#id-attribute) is also required, and that ID must be mapped to `user.id`.
     > ![Enter attribute statements used to map attributes between Okta and Mattermost. Email and username attributes are required. Okta also requires an ID attribute that must be mapped to user.id.](/images/okta_6_attribute_statements.png)
 . Select **Next**. Then, set Okta support parameters for the application. Recommended settings:
 > - **I’m an Okta customer adding an internal app**
 >
 > - **This is an internal app that we have created**
 >
 >   > ![Set recommended Okta support parameters for the application, including I'm an Okta customer adding an internal app and This is an internal app that we have created.](/images/okta_7_support_configuration.png)
 . Select **Finish**.
 . In the Mattermost System Console, go to **Authentication \> SAML 2.0**, then set **Override SAML bind data with AD/LDAP information** to **false** if currently set to **true**. You can re-enable [this configuration setting](/administration-guide/configure/authentication-configuration-settings#override-saml-bind-data-with-adldap-information) later when once setup is complete.
 . On the next screen, select the **Sign On** tab, then select **View Setup Instructions**.
 . Select the **Identity Provider metadata** link, then copy the link from the browser URL field. This will be used during the SAML configuration steps in the next section.
     ![In the Mattermost System Console, after disabling the Override SAML bind data with AD/LDAP information setting, select the Sign On tab, then select View Setup Instructions. Select the Identity Provider metadata link, then copy the link from the browser URL field to a convenient location.](/images/okta_8_view_instructions.png)
 . Take note of **Identity Provider Single Sign-On URL** (also known as **SAML SSO URL**), and the Identity Provider Issuer, as both may be needed to configure SAML for Mattermost.
 . Download the X.509 Certificate file and save it. You may need to upload it to Mattermost in a later step.
     ![Download the X.509 certificate file and save it. You'll upload this certificate file to Mattermost later.](/images/okta_9_view_instructions.png)
 ## Configure SAML Sign-On for Mattermost
 Start the Mattermost server and log in to Mattermost as a system admin. Go to **System Console \> Authentication \> SAML 2.0**, then paste the copied Identity Provider Metadata URL in the **Identity Provider Metadata URL** field and select **Get SAML Metadata from IdP**.
 This populates the **SAML SSO URL** and the **Identity Provider Issuer URL** fields automatically. The Identity Provider Public Certificate is also downloaded from the server and set locally.
 Alternatively you can enter the following fields manually:
 - **SAML SSO URL:** `Identity Provider Single Sign-On URL` from Okta, specified earlier.
 - **Identity Provider Issuer URL:** `Identity Provider Issuer` from Okta, specified earlier.
 - **Identity Provider Public Certificate:** X.509 Public Certificate file you downloaded from Okta earlier.
   > ![In the Mattermost System Console, go to Authentication \> SAML 2.0 to manually enter the SAML SSO URL and Identity Provider Issuer URL, and upload the Identity Provider Public Certificate manually.](/images/okta_10_mattermost_basics.png)
 .  Configure Mattermost to verify the signature. The **Service Provider Login URL** is the `Single sign on URL` you specified in Okta earlier.
     > ![On the SAML 2.0 page, configure Mattermost to verify the signature, and set the Service Provider Login ULR as the Single sign on URL configured in Okta.](/images/okta_11_mattermost_verification.png)
 .  Enable encryption based on the parameters provided earlier.
     > ![On the SAML 2.0 page, enable encryption and upload both the Service Provider Private Key and the Service Provider Public Certificate.](/images/okta_12_mattermost_encryption.png)
 .  Configure Mattermost to sign SAML requests using the Service Provider Private Key.
 .  Set attributes for the SAML Assertions used to update user information in Mattermost.
     - Attributes for Email, Username, and Id are required and should match the values you entered in Okta earlier.
     ![Set attributes for the SAML Assertions used to update user information in Mattermost.  Attributes for Email, Username, and Id are required and should match the values set in Okta.](/images/okta_13_mattermost_attributes.png)
 .  (Optional) Customize the login button text.
     > ![You can customize the login button text. By default, the text displays as "With SAML".](/images/okta_14_mattermost_login_button.png)
 .  Select **Save**.
 .  (Optional) If you configured `First Name` Attribute and `Last Name` Attribute, go to **System Console \> Site Configuration \> Users and Teams**, then set **Teammate Name Display** to **Show first and last name**. This is recommended for a better user experience.
 Once complete, and to confirm SAML SSO is successfully enabled, switch your system admin account from email to SAML-based authentication from your profile picture via **Profile \> Security \> Sign-in Method \> Switch to SAML SSO**, then log in with your SAML credentials to complete the switch.
 We also recommend that you post an announcement for your users to explain how the migration will work.
 You may also configure SAML for Okta by editing the `config.json` file to enable SAML based on [SAML configuration settings](/administration-guide/configure/authentication-configuration-settings#saml-20). You must restart the Mattermost server for the changes to take effect.
 <Inc1_sso_saml_ldapsync />
 <Inc2_sso_saml_faq />

127 lines 8.8 KiB Plaintext Raw Permalink Blame History Unescape Escape

127 lines

8.8 KiB

Plaintext

Raw Permalink Blame History