Skip to content

Commit d06154a

Browse files
NimRegevNimRegev
authored
Sso sync multi accounts (#751)
* Add multi-account sync for okta Added multi-account sync for Okta and section to common config topic * Add multi-account integration for Okta Added new multi-account selection and integration for Okta and updated screenshot * Update oidc-okta.md Added Codefresh to additional accounts
1 parent bb37973 commit d06154a

File tree

4 files changed

+48
-35
lines changed

4 files changed

+48
-35
lines changed

‎_docs/single-sign-on/oidc/oidc-okta.md

Lines changed: 40 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -75,11 +75,12 @@ Set up OIDC SSO for Okta in Codefresh by:
7575
* App name (e.g. Codefresh).
7676
* App logo (optional). Feel free to download and add this [picture]({{site.baseurl}}/images/administration/sso/okta/codefresh-logo.png).
7777
* Login redirect URI: `https://g.codefresh.io/api/auth/<codefresh_client_name>/callback`
78-
where:
79-
<codefresh_client_name> is generated by Codefresh when you configure SSO settings.
80-
For now, use a temp value such as `https://g.codefresh.io/api/auth/temp/callback`.
78+
where:
79+
`<codefresh_client_name>` is generated by Codefresh when you configure SSO settings.
80+
For now, use a temp value such as `https://g.codefresh.io/api/auth/temp/callback`.
8181
* Select **Save**.
82-
{% include image.html
82+
83+
{% include image.html
8384
lightbox="true"
8485
file="/images/sso/okta/image4.png"
8586
url="/images/sso/okta/image4.png"
@@ -88,44 +89,51 @@ Set up OIDC SSO for Okta in Codefresh by:
8889
max-width="70%"
8990
%}
9091

92+
{:start="7"}
9193
1. Continue with [Step 2: Configure OIDC SSO settings for Okta in Codefresh](#step-2-configure-oidc-sso-settings-for-okta-in-codefresh).
9294

9395
## Step 2: Configure OIDC SSO settings for Okta in Codefresh
9496
To configure OIDC SSO settings for Okta in Codefresh, you need the Client ID, Client Secret, Access token, and the Codefresh application ID as defined in Okta.
9597

96-
**Before you begin**
97-
Copy the values from the following screens in Okta:
98+
### Before you begin
99+
1. Copy the values from the following screens in Okta:
100+
* Client ID and Client secret
101+
* The API token generated in OKTA from Security tab > API
102+
* Application ID assigned to the Codefresh application in Okta
98103

99104
{% include image.html
100105
lightbox="true"
101106
file="/images/sso/okta/image7.png"
102107
url="/images/sso/okta/image7.png"
103-
alt="Client ID and secret"
104-
caption="Client ID and secret"
105-
max-width="70%"
108+
alt="Client ID and Client secret"
109+
caption="Client ID and Client secret"
110+
max-width="60%"
106111
%}
107112

108-
The API token generated in OKTA from Security tab >API.
113+
109114
{% include image.html
110115
lightbox="true"
111116
file="/images/sso/okta/image2.png"
112117
url="/images/sso/okta/image2.png"
113118
alt="API token in Okta to use as Access token"
114119
caption="API token in Okta to use as Access token"
115-
max-width="70%"
120+
max-width="60%"
116121
%}
117122

118-
This Application ID assigned to the Codefresh application in Okta.
123+
119124
{% include image.html
120125
lightbox="true"
121126
file="/images/sso/okta/image3.png"
122127
url="/images/sso/okta/image3.png"
123-
alt="App ID"
124-
caption="App ID"
125-
max-width="70%"
128+
alt="Application ID"
129+
caption="Application ID"
130+
max-width="60%"
126131
%}
127132

128-
**How to**
133+
{:start="2"}
134+
1. The names of the accounts to sync to Codefresh through this integration. Verify that you have administrator access to each of the accounts.
135+
136+
### How to
129137

130138
1. In the Codefresh UI, from the toolbar click the **Settings** icon.
131139
1. In the sidebar, from Access & Collaboration, select [Single Sign-On](https://g.codefresh.io/2.0/account-settings/single-sign-on){:target="\_blank"}.
@@ -150,7 +158,10 @@ max-width="30%"
150158
* **Client Host**: The OKTA organization URL, for example, `https://<company>.okta.com`.
151159
Do not copy the URL from the admin view (e.g. `https://<company>-admin.okta.com`), as it will not work.
152160
* **Application ID**: The Codefresh application ID in your OKTA organization, that will be used to sync groups and user from OKTA to Codefresh.
153-
1. Optional. To automatically sync teams or groups in Okta to Codefresh, select **Auto group sync**.
161+
* **Additional accounts to sync**: Optional. The names of the additional Codefresh accounts to be synced from Okta.
162+
Codefresh validates if the user has both access to and administrator privileges for the selected accounts.
163+
See [How Okta syncing works](#how-okta-syncing-works) for team/group sync options with Okta.
164+
1. Optional. To automatically sync teams or groups in Okta to Codefresh via the UI, including additional Codefresh accounts selected if any, select **Auto-group sync**.
154165
This action syncs groups every 12 hours.
155166
> Though you can assign an Okta application to both groups and individual users, Codefresh _only syncs users who are part of teams_.
156167
New users in Okta, _not_ assigned to a team, are **NOT** synced with Codefresh. You should first assign the user to a team for the sync to work.
@@ -164,7 +175,7 @@ max-width="30%"
164175
url="/images/sso/okta/image6.png"
165176
alt="Client name"
166177
caption="Client name"
167-
max-width="70%"
178+
max-width="50%"
168179
%}
169180

170181
{:start="6"}
@@ -178,26 +189,21 @@ max-width="30%"
178189

179190
You have now completed SSO setup for Okta.
180191

181-
## How Okta syncing works
182-
[Syncing with Okta]({{site.baseurl}}/docs/single-sign-on/team-sync/)
183-
only affects teams/groups, and not individual users.
192+
## CLI/UI-based team/group sync for Okta
193+
Syncing with Okta _only affects teams/groups_, and not individual users.
184194

195+
After initial SSO setup, you can activate automatic syncing of teams for the integration account or for both the integration and additional accounts via the CLI and the UI.
185196

197+
* CLI
198+
You can select multiple Codefresh accounts to sync through the **Additional accounts to sync** option in the UI, and then either create a Codefresh pipeline with the CLI command or run the CLI command when required.
199+
The pipeline should run the CLI command `codefresh synchronize teams my-okta-client-name -t okta`.
200+
See [Syncing teams in IdPs with Codefresh]({{site.baseurl}}//docs/single-sign-on/team-sync/#syncing-teams-in-idps-with-codefresh).
186201

187-
### Sync teams after initial SSO setup
188-
There are two ways to set up automatic syncing of teams:
189-
190-
* Pipeline running a CLI command: Create a Codefresh pipeline the runs the CLI command `codefresh synchronize teams my-okta-client-name -t okta` as explained in the [pipeline sync page]({{site.baseurl}}/docs/single-sign-on/team-sync).
191-
* Turn on the auto-sync toggle as part of the SSO configuration settings.:
192-
{% include image.html
193-
lightbox="true"
194-
file="/images/administration/sso/okta/auto-group-sync.png"
195-
url="/images/administration/sso/okta/auto-group-sync.png"
196-
alt="Automatic team syncing"
197-
caption="Automatic team syncing"
198-
max-width="50%"
199-
%}
202+
* UI
203+
Select the Codefresh accounts to sync to through the **Additional accounts to sync** option in the UI, and turn on **Auto-group sync** in the SSO configuration settings.
200204

205+
206+
201207
## Related articles
202208
[Federated Single Sign-On (SSO) overview]({{site.baseurl}}/docs/single-sign-on/single-sign-on/)
203209
[Common configuration for SSO providers]({{site.baseurl}}/docs/single-sign-on/team-sync)

‎_docs/single-sign-on/saml/saml-okta.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ SAML SSO settings for Okta include auto-syncing teams and groups in OKta with Co
4141
* **Access Token**: Optional. The OKTA API token that you generated in Okta, used to sync groups and their users from OKTA to Codefresh.
4242
* **Client Host**: The OKTA organization URL, for example, `https://<company>.okta.com`.
4343
* **Application ID**: The Codefresh application ID in your OKTA organization, that will be used to sync groups and user from OKTA to Codefresh.
44-
4544
1. Click **Add**.
4645
The SAML integration for Okta is added and appears in the list of SSOs.
4746
1. In the Single Sign-On page, click the **Edit** icon for the Okta SAML integration you created.

‎_docs/single-sign-on/team-sync.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,16 @@ In Codefresh you can sync users and teams either automatically or manually:
1818
* Automatically, in the Codefresh UI if the option is supported for your SSO provider
1919
* Manually, either on-demand through the Codefresh CLI, or through a Codefresh pipeline
2020

21+
<!---
22+
### Multi-account team-sync in Codefresh for SSO providers
23+
SSO providers can sync users from multiple accounts, in addition to the primary account associated with the specific SSO integration.
24+
This functionality benfits enterprises that manage multiple accounts for a single customer, as it streamlines the sync process through a single operation.
25+
If a customer has dev and prod accounts in Codefresh, they can set up an SSO integration for one of the accounts, and then specificy the ID of the second account to sync.
2126
27+
Codefresh validates if the user has access to the accounts specified, and during team-sync retrieives the accounts and invites users in teams/groups for those accounts.
2228
29+
30+
-->
2331
### Team-sync support in Codefresh for SSO providers
2432
The table lists the SSO providers supported in Codefresh and the team-sync option available for them.
2533

‎images/sso/okta/sso-codefresh-settings.png

5.55 KB
Loading

0 commit comments

Comments
 (0)