Skip to content

Commit d8aee26

Browse files
ericpaulsenericpaulsen
authored
docs: clean up OIDC duplicates (#6583)
* docs: clean up OIDC duplicates * make fmt * add: upgrade command
1 parent e1c755b commit d8aee26

File tree

1 file changed

+49
-49
lines changed

1 file changed

+49
-49
lines changed

‎docs/admin/auth.md

+49-49
Original file line numberDiff line numberDiff line change
@@ -50,88 +50,88 @@ CODER_OAUTH2_GITHUB_ALLOW_EVERYONE=true
5050

5151
Once complete, run `sudo service coder restart` to reboot Coder.
5252

53+
If deploying Coder via Helm, you can set the above environment variables in the
54+
`values.yaml` file as such:
55+
56+
```yaml
57+
coder:
58+
env:
59+
- name: CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS
60+
value: true
61+
- name: CODER_OAUTH2_GITHUB_ALLOWED_ORGS
62+
value: "your-org"
63+
- name: CODER_OAUTH2_GITHUB_CLIENT_ID
64+
value: "533...des"
65+
- name: CODER_OAUTH2_GITHUB_CLIENT_SECRET
66+
value: "G0CSP...7qSM"
67+
- name: CODER_OAUTH2_GITHUB_ALLOW_EVERYONE
68+
value: true
69+
```
70+
71+
To upgrade Coder, run:
72+
73+
```console
74+
helm upgrade <release-name> coder-v2/coder -n <namespace> -f values.yaml
75+
```
76+
5377
> We recommend requiring and auditing MFA usage for all users in your GitHub
5478
> organizations. This can be enforced from the organization settings page in the
5579
> "Authentication security" sidebar tab.
5680
57-
## GitLab
81+
## OpenID Connect
5882

59-
### Step 1: Configure the OAuth application in your GitLab instance
83+
The following steps through how to integrate any OpenID Connect provider (Okta, Active Directory, etc.) to Coder.
6084

61-
First, [register a GitLab OAuth application](https://docs.gitlab.com/ee/integration/oauth_provider.html). GitLab will ask you for the following parameter:
85+
### Step 1: Set Redirect URI with your OIDC provider
86+
87+
Your OIDC provider will ask you for the following parameter:
6288

6389
- **Redirect URI**: Set to `https://coder.domain.com/api/v2/users/oidc/callback`
6490

65-
### Step 2: Configure Coder with the Gitlab OpenID Connect credentials
91+
### Step 2: Configure Coder with the OpenID Connect credentials
6692

6793
Navigate to your Coder host and run the following command to start up the Coder
6894
server:
6995

7096
```console
71-
coder server --oidc-issuer-url="https://gitlab.com" --oidc-email-domain="your-domain-1,your-domain-2" --oidc-client-id="533...des" --oidc-client-secret="G0CSP...7qSM"
97+
coder server --oidc-issuer-url="https://issuer.corp.com" --oidc-email-domain="your-domain-1,your-domain-2" --oidc-client-id="533...des" --oidc-client-secret="G0CSP...7qSM"
7298
```
7399

74-
Alternatively, if you are running Coder as a system service, you can achieve the
100+
If you are running Coder as a system service, you can achieve the
75101
same result as the command above by adding the following environment variables
76102
to the `/etc/coder.d/coder.env` file:
77103

78104
```console
79-
CODER_OIDC_ISSUER_URL="https://gitlab.com"
105+
CODER_OIDC_ISSUER_URL="https://issuer.corp.com"
80106
CODER_OIDC_EMAIL_DOMAIN="your-domain-1,your-domain-2"
81107
CODER_OIDC_CLIENT_ID="533...des"
82108
CODER_OIDC_CLIENT_SECRET="G0CSP...7qSM"
83109
```
84110

85111
Once complete, run `sudo service coder restart` to reboot Coder.
86112

87-
> We recommend requiring and auditing MFA usage for all users in your GitLab
88-
> organizations or deployment. This can be enforced for an organization from the
89-
> organization settings page in the "Permissions and group features" section.
90-
> For deployments, this can be enforced in the Admin area, under the "Settings >
91-
> General" sidebar tab in the "Sign-in restrictions" section.
92-
93-
### Additional Notes
94-
95-
GitLab maintains configuration settings for OIDC applications at the following URL:
96-
97-
```console
98-
https://gitlab.com/.well-known/openid-configuration
113+
If deploying Coder via Helm, you can set the above environment variables in the
114+
`values.yaml` file as such:
115+
116+
```yaml
117+
coder:
118+
env:
119+
- name: CODER_OIDC_ISSUER_URL
120+
value: "https://issuer.corp.com"
121+
- name: CODER_OIDC_EMAIL_DOMAIN
122+
value: "your-domain-1,your-domain-2"
123+
- name: CODER_OIDC_CLIENT_ID
124+
value: "533...des"
125+
- name: CODER_OIDC_CLIENT_SECRET
126+
value: "G0CSP...7qSM"
99127
```
100128
101-
If you are using a self-hosted GitLab instance, replace `gitlab.com` in the above URL
102-
with your internal domain. The same will apply for the `OIDC_ISSUER_URL` variable.
103-
104-
## OpenID Connect with Google
105-
106-
### Step 1: Configure the OAuth application on Google Cloud
107-
108-
First, [register a Google OAuth application](https://support.google.com/cloud/answer/6158849?hl=en). Google will ask you for the following Coder parameters:
109-
110-
- **Authorized JavaScript origins**: Set to your Coder domain (e.g. `https://coder.domain.com`)
111-
- **Redirect URIs**: Set to `https://coder.domain.com/api/v2/users/oidc/callback`
112-
113-
### Step 2: Configure Coder with the Google OpenID Connect credentials
114-
115-
Navigate to your Coder host and run the following command to start up the Coder
116-
server:
129+
To upgrade Coder, run:
117130
118131
```console
119-
coder server --oidc-issuer-url="https://accounts.google.com" --oidc-email-domain="your-domain-1,your-domain-2" --oidc-client-id="533...ent.com" --oidc-client-secret="G0CSP...7qSM"
132+
helm upgrade <release-name> coder-v2/coder -n <namespace> -f values.yaml
120133
```
121134

122-
Alternatively, if you are running Coder as a system service, you can achieve the
123-
same result as the command above by adding the following environment variables
124-
to the `/etc/coder.d/coder.env` file:
125-
126-
```console
127-
CODER_OIDC_ISSUER_URL="https://accounts.google.com"
128-
CODER_OIDC_EMAIL_DOMAIN="your-domain-1,your-domain-2"
129-
CODER_OIDC_CLIENT_ID="533...ent.com"
130-
CODER_OIDC_CLIENT_SECRET="G0CSP...7qSM"
131-
```
132-
133-
Once complete, run `sudo service coder restart` to reboot Coder.
134-
135135
## OIDC Claims
136136

137137
Coder requires all OIDC email addresses to be verified by default. If the

0 commit comments

Comments
 (0)