Skip to content

Commit

Permalink
Merge branch 'development' of github.com:FusionAuth/fusionauth-site i…
Browse files Browse the repository at this point in the history
…nto development
  • Loading branch information
johnjeffers committed Oct 26, 2023
2 parents 06ca13e + f590f8a commit f1be21e
Show file tree
Hide file tree
Showing 6 changed files with 17 additions and 17 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ Return to the Configure SAML Tab. This can be found by navigating as follows fro

* Set the value of the <InlineField>Single sign on URL</InlineField> to the value of the <InlineField>Callback URL (ACS)</InlineField> from the FusionAuth Identity Provider recorded above.
* Set the value of the <InlineField>Audience URI (SP Entity ID)</InlineField> to the value of the <InlineField>Issuer</InlineField> recorded above.
* Optionally set the value of <InlineField>Default RelayState</InlineField> if you want to provide a specific redirect URI. If this value is omitted, the first Authorized redirect URI found in the FusionAuth Application OAuth configuration will be used. This option is supported in FusionAuth version greater than or equal to `1.41.0`. In prior versions, append a query parameter `redirect_uri=` to the value specified in <InlineField>Single sign on URL</InlineField> to control the final redirect URI. Please note, the URL must be encoded. For more information [see section below](/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta#optional-adding-a-specific-redirect-after-saml-login).
* Optionally set the value of <InlineField>Default RelayState</InlineField> if you want to provide a specific redirect URI. If this value is omitted, the first Authorized redirect URI found in the FusionAuth Application OAuth configuration will be used. This option is supported in FusionAuth version greater than or equal to `1.41.0`. In prior versions, append a query parameter `redirect_uri=` to the value specified in <InlineField>Single sign on URL</InlineField> to control the final redirect URI. Please note, the URL must be encoded. For more information [see section below](/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-samlv2-idp-initiated#optional-adding-a-specific-redirect-after-saml-login).
* Set the <InlineField>Application username</InlineField> to be `Email`.

<img src="/img/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-sign-on-advanced-settings.png" alt="Configure Okta with the FusionAuth SP information" width="1200" />
Expand All @@ -139,7 +139,7 @@ If you want a user to return to a specific redirect url after SAML authenticatio

<img src="/img/docs/lifecycle/authenticate-users/identity-providers/enterprise/saml-acs-and-relay-state.png" alt="Showing Setting the Relay and ACS values" width="1200" role="bottom-cropped" />

The above values will need to be added to the [Authorized redirect URLs](/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta#configure-the-fusionauth-application-redirect-url) OAuth configuration of your application in FusionAuth. Additional information can be found [in our SAML. overview documentation](/docs/identity-providers/samlv2-idp-initiated/#saml-v2-integration-details).
The above values will need to be added to the [Authorized redirect URLs](/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-samlv2-idp-initiated#configure-the-fusionauth-application-redirect-url) OAuth configuration of your application in FusionAuth. Additional information can be found [in our SAML. overview documentation](/docs/identity-providers/samlv2-idp-initiated/#saml-v2-integration-details).

### Optional: Setting a Persistent Id and Sending Email as an Attribute

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ In contrast, during an identity provider initiated login, the third-party identi

We also provide specific examples for configuring SAML with some providers whose implementation requires unique configuration. If you'd like us to provide additional examples, please open a request on [GitHub](https://github.com/FusionAuth/fusionauth-site/issues).

* [Configure SAML v2 IdP Initiated SSO for Okta](/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta)
* [Configure SAML v2 IdP Initiated SSO for Okta](/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-samlv2-idp-initiated)

Once you have completed this configuration you will be able to log in to FusionAuth directly from a SAMLv2 IdP.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@ Adding a Login button for a third-party OpenID Connect provider to FusionAuth is
We also provide specific examples for configuring OpenID connect with some providers whose implementation requires unique configuration. If you'd like us to provide additional examples, please open a request on [GitHub](https://github.com/FusionAuth/fusionauth-site/issues).

* [Configure OpenID Connect with Amazon Cognito](/docs/lifecycle/authenticate-users/identity-providers/social/cognito)
* [Configure OpenID Connect with Azure Active Directory](/docs/lifecycle/authenticate-users/identity-providers/enterprise/azure-ad)
* [Configure OpenID Connect with Azure Active Directory](/docs/lifecycle/authenticate-users/identity-providers/enterprise/azure-ad-oidc)
* [Configure OpenID Connect with Discord](/docs/lifecycle/authenticate-users/identity-providers/gaming/discord)
* [Configure OpenID Connect with GitHub](/docs/lifecycle/authenticate-users/identity-providers/social/github)
* [Configure OpenID Connect with Okta](/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta)
* [Configure OpenID Connect with Okta](/docs/lifecycle/authenticate-users/identity-providers/enterprise/okta-oidc)

Once you have completed this configuration you will be able to enable the OpenID Connect login button for one or more FusionAuth Applications. Below is an example login page with an OpenID Connect Identity Provider enabled for PiedPiper.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,6 @@ You can manage the user by clicking on the <InlineUIElement>Manage</InlineUIElem

<p>After the test login, the user will be redirected to a URL like `https://fusionauth.io/?code=FlZF97WIYLNxt4SGD_22qvpRh4fZ6kg_N89ZbBAy1E4&locale=fr&userState=Authenticated`. This happens because you haven't set up a web application to handle the authorization code redirect.</p>

<p>That is an important next step but is beyond the scope of this document. Consult the <a href="/docs/quickstarts/5-minute-setup-guide) for an example of how to do this.">5 minute setup guide</a></p>
<p>That is an important next step but is beyond the scope of this document. Consult the <a href="/docs/quickstarts/5-minute-setup-guide">5 minute setup guide</a> for an example of how to do this.</p>
</div>
}
12 changes: 6 additions & 6 deletions astro/src/content/docs/lifecycle/migrate-users/bulk/general.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ However, before we do so, there are certain common steps. The first is getting f

### FusionAuth Core Concepts

The [Core Concepts section](/docs/v1/tech/core-concepts/) is worth reviewing to help you plan your migration and future FusionAuth usage. Important FusionAuth concepts are users, applications, roles, groups, registrations and tenants. Here's a short summary of how they relate:
The [Core Concepts section](/docs/core-concepts/) is worth reviewing to help you plan your migration and future FusionAuth usage. Important FusionAuth concepts are users, applications, roles, groups, registrations and tenants. Here's a short summary of how they relate:

* A tenant is a top level object that contains users, applications and groups.
* Applications have roles. Users authenticate and are authorized to access applications.
Expand All @@ -133,7 +133,7 @@ A POC is helpful in determining which [login method](/docs/get-started/core-conc

FusionAuth assigns users roles. A user's roles are available in API responses and in the [JWT (JSON Web Token)](/docs/lifecycle/authenticate-users/login-api/json-web-tokens) sent to client applications after successful user authentication. You may need to update your application to look at the `roles` claim to allow or disallow functionality within an application.

You may choose to use a language specific library to interface with FusionAuth's standards compliant SAML, OAuth and OIDC endpoints. There are [sample applications](/docs/v1/tech/example-apps/) you can review to see examples of such integrations. You may also choose to use one of FusionAuth's [client libraries](/docs/v1/tech/client-libraries/).
You may choose to use a language specific library to interface with FusionAuth's standards compliant SAML, OAuth and OIDC endpoints. There are [sample applications](/docs/example-apps/) you can review to see examples of such integrations. You may also choose to use one of FusionAuth's [client libraries](/docs/client-libraries/).

If you allow users to register with your application, modify your application to point to FusionAuth's registration form and make sure you're capturing the registration data you need.

Expand Down Expand Up @@ -225,7 +225,7 @@ Before you can migrate any user information into FusionAuth, ensure it is set up

Determine where your FusionAuth instances should be hosted. You can self host in any data center or cloud provider, or use the managed services offering from FusionAuth, [FusionAuth Cloud](/pricing). Decide on whether you need a [support plan](/pricing), with guaranteed response times. Evaluate if you need any of the [paid plan features](/pricing).

Consider your change management strategy. How will you capture your FusionAuth settings so that you can make configuration changes in the future in a measured, understandable way? You can use the [community supported Terraform provider](https://registry.terraform.io/providers/gpsinsight/fusionauth/latest) or script changes in your preferred language's [client library](/docs/v1/tech/client-libraries/).
Consider your change management strategy. How will you capture your FusionAuth settings so that you can make configuration changes in the future in a measured, understandable way? You can use the [community supported Terraform provider](https://registry.terraform.io/providers/gpsinsight/fusionauth/latest) or script changes in your preferred language's [client library](/docs/client-libraries/).

#### Configure FusionAuth

Expand Down Expand Up @@ -279,7 +279,7 @@ You'll also want to [create an API key](/docs/apis/authentication#managing-api-k

<img src="/img/docs/lifecycle/migrate-users/bulk/api-key-creation.png" alt="Adding an application." width="1200" />

You can write the migration scripts in shell, any of the supported [client library languages](/docs/v1/tech/client-libraries/), or against the [REST API](/docs/apis/users) in any language supporting HTTP requests. Iterate over all the users in the old system or systems. Build the JSON files. Add a registration for each application to which a user should have access.
You can write the migration scripts in shell, any of the supported [client library languages](/docs/client-libraries/), or against the [REST API](/docs/apis/users) in any language supporting HTTP requests. Iterate over all the users in the old system or systems. Build the JSON files. Add a registration for each application to which a user should have access.

<Aside type="note">
Make sure you create all your groups, tenants and applications before you import your users. You can do that by specifying them in the Kickstart file or writing scripts to create them.
Expand Down Expand Up @@ -637,7 +637,7 @@ If profile data in your original system of record doesn't change, or you can saf

In this scenario, you place a custom proxy in front of both systems.
This proxy receives the login credentials.
The proxy checks FusionAuth first using the [Login API](/docs/v1/tech/apis/login/).
The proxy checks FusionAuth first using the [Login API](/docs/apis/login/).
If the user does not exist, the legacy system is called, using a similar API.
The user data is then added to FusionAuth.
A token is provided by the User API and can be returned to a client.
Expand Down Expand Up @@ -717,7 +717,7 @@ At a later time, request each SAML IdP update their configuration to point to th

## Additional Resources

If you have a single users table and want to walk through how a migration would work with that, review the [Migrate Users tutorial](/docs/v1/tech/migration-guide/).
If you have a single users table and want to walk through how a migration would work with that, review the [Migrate Users tutorial](/docs/migration-guide/).

If you are having issues importing users, review the [relevant troubleshooting section](/docs/operate/troubleshooting/troubleshooting#troubleshooting-user-import).

Expand Down
10 changes: 5 additions & 5 deletions astro/src/content/docs/lifecycle/migrate-users/scim/scim.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -46,18 +46,18 @@ FusionAuth is not a SCIM compatible client, but if you are interested in similar

This is an example of a basic interaction between an external SCIM client provisioning request to create a FusionAuth User:

1. The client would send a SCIM compliant request to the [SCIM User endpoint](/docs/apis/scim/SCIMUser) `/api/scim/resource/v2/Users`. Other [SCIM API endpoints](/docs/apis/scim/) are also available.
1. The client would send a SCIM compliant request to the [SCIM User endpoint](/docs/apis/scim/scim-user) `/api/scim/resource/v2/Users`. Other [SCIM API endpoints](/docs/apis/scim/) are also available.

<JSON title="Example User Create Request JSON" src="scim/user-create-request.json" />

2. FusionAuth will authenticate the incoming request to ensure the request is from a known SCIM client. Each SCIM client and server instance is represented as an Entity and will authenticate using a [Client Credentials Grant](/docs/apis/authentication#client-credentials). An example [client credentials grant using Entities](/docs/lifecycle/authenticate-users/oauth/#example-client-credentials-grant).
3. FusionAuth will call the assigned incoming request lambda, passing the SCIM request data and a FusionAuth User object. The lambda is responsible for converting the incoming SCIM request data into a FusionAuth User object. For example, the `name.givenName` property shown above could be mapped to `user.firstName`.
- [SCIM Group Request Converter Lambda](/docs/extend/code/lambdas/scim-group-request-converter)
- [SCIM User Request Converter Lambda](/docs/v1/tech/lambdas/scim-user-request-converter)
- [SCIM User Request Converter Lambda](/docs/lambdas/scim-user-request-converter)
4. FusionAuth will attempt to create the FusionAuth User using the mapped object from the incoming request lambda.
5. Upon successful creation of the User, FusionAuth will call the outgoing response lambda, passing the newly created FusionAuth User and the SCIM response. The outgoing lambda is responsible for mapping the FusionAuth User properties to the appropriate SCIM representation.
- [SCIM Group Response Converter Lambda](/docs/v1/tech/lambdas/scim-group-response-converter)
- [SCIM User Response Converter Lambda](/docs/v1/tech/lambdas/scim-user-response-converter)
- [SCIM Group Response Converter Lambda](/docs/lambdas/scim-group-response-converter)
- [SCIM User Response Converter Lambda](/docs/lambdas/scim-user-response-converter)

The lambdas will need to map the SCIM data to the appropriate FusionAuth object property. Below are some suggested strategies, but the data can be mapped in any way you choose.

Expand Down Expand Up @@ -120,7 +120,7 @@ With SCIM, users are provisioned. They are not registered for applications withi
Options to automatically add a registration to a new user include:

* Listen for the [user.create.complete](/docs/extend/events-and-webhooks/events/user-create-complete) webhook and add the registration using an API call on the receiver.
* Make an API call registering the user to an application from the [SCIM User Response Converter lambda](/docs/v1/tech/lambdas/scim-user-response-converter) which is called after the user is created. Ensure this idempotent as the lambda will be called any time the user is updated as well.
* Make an API call registering the user to an application from the [SCIM User Response Converter lambda](/docs/lambdas/scim-user-response-converter) which is called after the user is created. Ensure this idempotent as the lambda will be called any time the user is updated as well.
* If you enable self service registration for your application, and the user logs in to the application, they will be automatically registered for the application. [Learn more](/docs/get-started/core-concepts/registrations#registrations-and-self-service-registration).

## SCIM Client Authentication
Expand Down

0 comments on commit f1be21e

Please sign in to comment.