feat: Dev Portal SAML SSO #8118

cloudjumpercat · 2024-11-04T21:59:34Z

Description

SAML SSO is being added to Dev Portal. This PR adds instructions for it and creates SSO includes so that org SSO and Dev Portal SSO content can be shared.

This PR also fixes some outdated Okta SSO language, see DOCU-4120 for more information.

DOCU-4135

Testing instructions

Preview links:

Checklist

Review label added
Conditional version tags added, if applicable.

Signed-off-by: Diana <[email protected]>

netlify · 2024-11-04T21:59:50Z

✅ Deploy Preview for kongdocs ready!

Name	Link
🔨 Latest commit	`95104ce`
🔍 Latest deploy log	https://app.netlify.com/sites/kongdocs/deploys/672e7dfbbef51f00082b091b
😎 Deploy Preview	https://deploy-preview-8118--kongdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	9 paths audited Performance: 92 (no change from production) Accessibility: 92 (no change from production) Best Practices: 98 (🟢 up 8 from production) SEO: 99 (no change from production) PWA: - View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

Signed-off-by: Diana <[email protected]>

…it since it was generic anyways Signed-off-by: Diana <[email protected]>

Signed-off-by: Diana <[email protected]>

cloudjumpercat · 2024-11-06T20:22:56Z

I'm still working on testing team mappings and Dev Portal SAML, but the draft docs are now ready for tech review!

Dev Portal Generic SSO how to and Konnect Generic SSO how to
- In the PR, the content for these pages now lives primarily in an include since the content for both generic SSO pages is so similar. As you look over these docs, I'd appreciate any feedback if I missed anything or need to fix any instructions that relates to one (ex. Konnect org) but not the other (ex. Dev Portal) that I missed on accident.
Konnect Okta SSO how to and Dev Portal Okta SSO how to
- Same comment here about how we're now using an include for the content because the two sets of instructions are very similar. This just makes it easier to keep the content consistent since the updates to one will show up in the other.
SSO attribute mapping reference
- This content already existed, I just moved it to it's own page. I still have an open question about what the Konnect values are and where in Konnect those values map to

cloudjumpercat · 2024-11-06T20:24:50Z

app/_includes/md/konnect/generic-sso.md

+## Set up SSO in {{site.konnect_short_name}}
+{% navtabs %}
+{% navtab OIDC%}
+{% if include.desc == "Konnect Org" %}


For reviewers: This label in the include file pulls the content from the {% if include.desc == "Konnect Org" %} to the next {% endif %} into only the Konnect org SSO docs, not the Dev Portal SSO docs. This lets us share most of the content and conditionally render content that is specific to one feature and not the other, like the UI instructions to get to the SSO settings in Konnect.

Very powerful! Thank you!

cloudjumpercat · 2024-11-06T20:25:30Z

app/_includes/md/konnect/generic-sso.md

+{% if include.desc == "Konnect Org" %}
+1. In [{{site.konnect_saas}}](https://cloud.konghq.com/login), click {% konnect_icon organizations %} **Organization** > **Settings**, and then click the **Authentication Scheme** tab.
+{% endif %}
+{% if include.desc == "Dev Portal" %}


Same comment here as the previous, but everything in this if tag is only pulled into the Dev Portal SSO docs, not the Konnect org SSO docs.

Very powerful! Thank you!

cloudjumpercat · 2024-11-06T21:21:59Z

app/_includes/md/konnect/okta-sso.md

+    * **Single Sign-On URL**: `https://global.api.konghq.com/v2/authenticate/login_path/saml/acs`
+    * **Audience URI (SP Entity ID)**: `https://cloud.konghq.com/sp/SP_ID`
+
+1. Optional: In the **Attribute Statements**, add the following three attributes:


This doesn't mention why a user would want to configure this and I'm not sure what the answer to that is.

cloudjumpercat · 2024-11-06T21:22:09Z

app/_includes/md/konnect/okta-sso.md

+
+1. [Add users to the Okta application](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-assign-apps.htm).
+
+1. [Generate a signing certificate](https://help.okta.com/en-us/content/topics/apps/manage-signing-certificates.htm) to use in {{site.konnect_short_name}}.


There's no place to put the cert in konnect, so I just need to generate it and activate it?

Signed-off-by: Diana <[email protected]>

smritikjaggi · 2024-11-07T20:28:04Z

app/_includes/md/konnect/generic-sso.md

+## Set up SSO in {{site.konnect_short_name}}
+{% navtabs %}
+{% navtab OIDC%}
+{% if include.desc == "Konnect Org" %}


Very powerful! Thank you!

smritikjaggi · 2024-11-07T20:28:13Z

app/_includes/md/konnect/generic-sso.md

+{% if include.desc == "Konnect Org" %}
+1. In [{{site.konnect_saas}}](https://cloud.konghq.com/login), click {% konnect_icon organizations %} **Organization** > **Settings**, and then click the **Authentication Scheme** tab.
+{% endif %}
+{% if include.desc == "Dev Portal" %}


Very powerful! Thank you!

smritikjaggi · 2024-11-07T20:46:38Z

app/_includes/md/konnect/generic-sso.md

+{% endnavtab %}
+{% navtab SAML %}
+
+The {{site.konnect_short_name}} SAML integration allows you to configure various identity providers. While technically any SAML-compliant provider can be used, the following have been verified:


Do we want to add a similar list for OIDC as well?

Sure, I'll add that!

smritikjaggi · 2024-11-07T20:49:22Z

app/_includes/md/konnect/generic-sso.md

+
+## Troubleshooting
+
+<details><summary>Troubleshooting authentication issues with large numbers of groups</summary>


@Daniel2218 / @joshcman
Do we want to add a section similar to https://docs.konghq.com/konnect/org-management/sso/#reference for Dev Portal?

I moved that section to it's own page: https://deploy-preview-8118--kongdocs.netlify.app/konnect/reference/sso/ (trying to separate reference content from how to content). I can add to that reference page if we have mappings that are specific to Dev Portal.

smritikjaggi · 2024-11-07T20:54:21Z

app/konnect/dev-portal/access-and-approval/sso.md

+* [Configure generic SSO for a Konnect Org](/konnect/org-management/sso/)
+* [IdP SSO attribute mapping reference](/konnect/reference/sso)


Should we add this section for Dev Portal "Configure Okta" page as well: https://docs.konghq.com/konnect/org-management/okta-idp/#add-a-user-to-your-application?

Adding users to the application is one of the steps in this section (it's step 3 for OIDC and step 4 for SAML). That step is a link to the Okta doc because if we write out the steps ourselves like we did in the current Org Okta SSO doc, they quickly become out-dated. And I tested the flow with the Okta doc and thought it was accurate and helpful.

So, it is annoying as a user to have to go to yet another link for more instructions, but the instructions are more likely to be accurate this way if we use Okta's.

Signed-off-by: Diana <[email protected]>

cloudjumpercat · 2024-11-08T21:10:08Z

app/_includes/md/konnect/generic-sso.md

+{% endif %}
+{% if include.desc == "Konnect Org" %}
+1. Optional: To map existing teams from IdP groups to {{site.konnect_short_name}}, do the following:
+    1. Configure group claims in your IdP application. Be sure to add the following to the scope: `openid`, `email`, `profile`


I feel slightly unsure about this step. I needed to make it generic, and I think groups claim is the correct name.

Create includes for generic SSO, okta SSO

5bbc1de

Signed-off-by: Diana <[email protected]>

cloudjumpercat added the review:sme Request for SME review, external to the docs team. label Nov 4, 2024

cloudjumpercat added 7 commits November 5, 2024 11:14

Update Okta SSO include with more feature rendering

9c6891a

Signed-off-by: Diana <[email protected]>

Remove old content from generic SSO for Dev Portal, not going to use …

445c7b2

…it since it was generic anyways Signed-off-by: Diana <[email protected]>

Fix broken links

91b0614

Signed-off-by: Diana <[email protected]>

Make changes after testing portal OIDC, org OIDC, and org SAML

806bd67

Signed-off-by: Diana <[email protected]>

Fix wrong link in nav file

dde09f8

Signed-off-by: Diana <[email protected]>

Small updates to feature rendering

b0a5c78

Signed-off-by: Diana <[email protected]>

Apply revisions from format and grammar review

71ddf66

Signed-off-by: Diana <[email protected]>

cloudjumpercat commented Nov 6, 2024

View reviewed changes

Small fixes after testing Dev Portal SAML

1c1ff41

Signed-off-by: Diana <[email protected]>

smritikjaggi reviewed Nov 7, 2024

View reviewed changes

Apply SME feedback

95104ce

Signed-off-by: Diana <[email protected]>

cloudjumpercat commented Nov 8, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Dev Portal SAML SSO #8118

feat: Dev Portal SAML SSO #8118

cloudjumpercat commented Nov 4, 2024 •

edited

Loading

netlify bot commented Nov 4, 2024 •

edited

Loading

cloudjumpercat commented Nov 6, 2024

cloudjumpercat Nov 6, 2024

smritikjaggi Nov 7, 2024

cloudjumpercat Nov 6, 2024

smritikjaggi Nov 7, 2024

cloudjumpercat Nov 6, 2024

cloudjumpercat Nov 6, 2024

smritikjaggi Nov 7, 2024

smritikjaggi Nov 7, 2024

smritikjaggi Nov 7, 2024

cloudjumpercat Nov 8, 2024

smritikjaggi Nov 7, 2024

cloudjumpercat Nov 8, 2024

smritikjaggi Nov 7, 2024

cloudjumpercat Nov 8, 2024 •

edited

Loading

cloudjumpercat Nov 8, 2024


		1. [Add users to the Okta application](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-assign-apps.htm).

		1. [Generate a signing certificate](https://help.okta.com/en-us/content/topics/apps/manage-signing-certificates.htm) to use in {{site.konnect_short_name}}.


		## Troubleshooting

		<details><summary>Troubleshooting authentication issues with large numbers of groups</summary>

		* [Configure generic SSO for a Konnect Org](/konnect/org-management/sso/)
		* [IdP SSO attribute mapping reference](/konnect/reference/sso)

feat: Dev Portal SAML SSO #8118

Are you sure you want to change the base?

feat: Dev Portal SAML SSO #8118

Conversation

cloudjumpercat commented Nov 4, 2024 • edited Loading

Description

Testing instructions

Checklist

netlify bot commented Nov 4, 2024 • edited Loading

✅ Deploy Preview for kongdocs ready!

cloudjumpercat commented Nov 6, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cloudjumpercat Nov 8, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cloudjumpercat commented Nov 4, 2024 •

edited

Loading

netlify bot commented Nov 4, 2024 •

edited

Loading

cloudjumpercat Nov 8, 2024 •

edited

Loading