Skip to content

Commit fda2ca0

Browse files
rubenfiszelrubenfiszel
committed
update sso page
1 parent e0c5195 commit fda2ca0

File tree

4 files changed

+37
-160
lines changed

4 files changed

+37
-160
lines changed

‎docs/advanced/1_self_host/index.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ Windmill work with those providers using the docker containers and specific guid
6666

6767
Using Docker and Caddy, Windmill can be deployed using 4 files,
6868
([`docker-compose.yml`][windmill-docker-compose],
69-
[`Caddyfile`][windmill-caddyfile]), an .env and an empty oauth.json in a single command.
69+
[`Caddyfile`][windmill-caddyfile]) and an .env in a single command.
7070

7171
[Caddy][caddy] is the reverse proxy that will redirect traffic to both windmill (port 8000) and the lsp (the monaco assistant) service (port 3001) and multiplayer service (port 3002).
7272
Postgres holds the entire state of windmill, the rest is fully stateless, Windmill-LSP provides editor intellisense.
@@ -77,7 +77,6 @@ Make sure docker is started (Mac: `open /Applications/Docker.app`, Windows: `sta
7777
curl https://raw.githubusercontent.com/windmill-labs/windmill/main/docker-compose.yml -o docker-compose.yml
7878
curl https://raw.githubusercontent.com/windmill-labs/windmill/main/Caddyfile -o Caddyfile
7979
curl https://raw.githubusercontent.com/windmill-labs/windmill/main/.env -o .env
80-
echo '{}' > oauth.json
8180
8281
docker compose up -d
8382
```

‎docs/misc/2_setup_oauth/index.md

Lines changed: 36 additions & 158 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,12 @@
22

33
Windmill supports Single Sign-On for Microsoft, Google, GitHub, GitLab, Okta, and domain restriction.
44

5-
The oauth.json need to be mounted from your Windmill server and worker instances. On the docker-compose.yml, this would correspond to uncommenting these [2 lines](https://github.com/windmill-labs/windmill/blob/main/docker-compose.yml#L42-L43), and those [2 other lines](https://github.com/windmill-labs/windmill/blob/main/docker-compose.yml#L65-L66) and have an oauth.json file in the same folder as the docker-compose.yml.
6-
7-
The oauth.json has the following structure:
8-
9-
```json
10-
{
11-
"<integration>": {
12-
"id": "...",
13-
"secret": "..."
14-
},
15-
....
16-
}
17-
```
18-
19-
> `<integration>` code must match with the code that is setup in [oauth_connect.json](https://github.com/windmill-labs/windmill/blob/main/backend/oauth_connect.json)
20-
21-
<br/>
22-
23-
For environments that do not support mounting files or if not practical, you may also pass it base64 as env variable to the server: `OAUTH_JSON_AS_BASE64=$(base64 oauth.json | tr -d '\n')`
5+
OAuth configuration are set in the instance settings available from the superadmin settings.
246

257
## OAuth Resources
268

9+
![Setup OAuth](./setup_oauth.png)
10+
2711
### Slack
2812

2913
1. Create a new slack app at <https://api.slack.com/apps?new_app=1>
@@ -69,17 +53,9 @@ settings:
6953
token_rotation_enabled: false
7054
```
7155
72-
1.
56+
See screenshot above:
7357
74-
```json
75-
{
76-
...
77-
"slack": {
78-
"id": "<CLIENT_ID>",
79-
"secret": "<CLIENT_SECRET>"
80-
}
81-
}
82-
```
58+
Superadmin Settings -> Instance Settings -> Resources -> Toggle "slack" -> set client id and client secret
8359
8460
### Google Sheet
8561
@@ -96,21 +72,16 @@ settings:
9672
- Authorized Redirect URLs: https://<YOUR_INSTANCE>/oauth/callback/gsheets
9773
- Click Create.
9874
- Copy the **Client ID** and **Client Secret** from the "OAuth Client" modal.
99-
- Edit your `oauth.json` to look like:
100-
101-
```json
102-
{
103-
"gsheets": {
104-
"id": "<CLIENT_ID>",
105-
"secret": "<CLIENT_SECRET>"
106-
}
107-
}
108-
```
75+
- Superadmin Settings -> Instance Settings -> Resources -> Add OAuth "gsheet" -> set client id and client secret
10976
11077
The same steps apply to enable more APIs (**gmail**, **gdrive**, etc) on your Google Account to set up the resources in WindMill.
11178
11279
## OAuth SSO
11380
81+
![Setup SSO](./setup_sso.png)
82+
83+
We recommend using a private navigation tab to test the new settings as soon as they are saved by refreshing the login page as a non authed user.
84+
11485
### Google login
11586
11687
**Create Google OAuth keys**
@@ -125,41 +96,29 @@ First, you need to create a Google OAuth Client:
12596
- Authorized Redirect URLs: https://<YOUR_INSTANCE>/user/login_callback/google
12697
- Click Create.
12798
- Copy the **Client ID** and **Client Secret** from the "OAuth Client" modal.
128-
- Edit your `oauth.json` to look like:
129-
130-
```json
131-
{
132-
"google": {
133-
"id": "<CLIENT_ID>",
134-
"secret": "<CLIENT_SECRET>",
135-
"allowed_domains": ["youremaildomain.dev"]
136-
}
137-
}
138-
```
13999
140-
### Keycloak
100+
See screenshot above:
141101
142-
Setup your realm in Keycload then add the following to your `oauth.json`:
102+
Superadmin Settings -> Instance Settings -> SSO -> Toggle "google" -> set client id, org and client secret
143103
144-
```
145-
{
146-
"keycloak_<realm>": {
147-
"id": "...",
148-
"secret": "...",
149-
"connect_config": {
150-
"auth_url": "https://.../realms/<realm>/protocol/openid-connect/auth",
151-
"token_url": "https://.../realms/<realm>/protocol/openid-connect/token",
152-
"scopes": ["openid", "offline_access"]
153-
},
154-
"login_config": {
155-
"auth_url": "https://.../realms/<realm>/protocol/openid-connect/auth",
156-
"token_url": "https://.../realms/<realm>/protocol/openid-connect/token",
157-
"userinfo_url": "https://.../realms/<realm>/protocol/openid-connect/userinfo",
158-
"scopes": ["openid", "offline_access"]
159-
}
160-
}
161-
}
162-
```
104+
### Microsoft
105+
106+
Redirect URI: https://<YOUR_INSTANCE>/user/login_callback/microsoft
107+
Login: https://<YOUR_INSTANCE>/user/login
108+
109+
Create a new OAuth 2.0 Client [in microsoft portal](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade)
110+
111+
and in the "Authentication" tab, set the redirect URI to `BASE_URL/user/login_callback/microsoft`, the logout channel to
112+
`BASE_URL/auth/logout` where BASE_URL is what you configured as core BASE_URL.
113+
Also set "Accounts in any organizational directory (Any Microsoft Entra ID tenant -
114+
Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)", you can restrict the
115+
emails directly in windmill using the "allowed_domains" setting.
116+
117+
Superadmin Settings -> Instance Settings -> SSO -> Toggle "microsoft" -> set client id, org and client secret
118+
119+
### Keycloak
120+
121+
Setup your realm in Keycloak and set Keycloak in Superadmin Settings -> Instance Settings -> SSO -> Keycloak
163122

164123
### Jumpcloud
165124

@@ -175,46 +134,14 @@ Login: https://<YOUR_INSTANCE>/user/login
175134
Client Authentication Type: Client Secret Basic
176135
Attribute Mapping, Standard Scopes: Check Email
177136

178-
Add the proper groups then click save. You should see your Client ID and Client Secret on the next screen then add the following entry "jumpcloud" to your oauth.json:
137+
Add the proper groups then click save. You should see your Client ID and Client Secret on the next screen then add the following entry "jumpcloud":
179138

180-
```json
181-
{
182-
"jumpcloud": {
183-
"id": "<CLIENT_ID>",
184-
"secret": "<CLIENT_SECRET>",
185-
"allowed_domains": ["youremaildomain.dev"]
186-
}
187-
}
188-
```
139+
Superadmin Settings -> Instance Settings -> SSO -> Toggle "jumpcloud" -> set client id and client secret
189140

190141
![Jumpcloud](./jumpcloud.png.webp)
191142

192143
### Okta
193144

194-
Setup your `oauth.json` (e.g. via the `oauthConfig` in the values.yaml when using helm), using `okta` as the realm name, though
195-
you can provide whatever realm name you want here, if you know what you're doing. This is configured as though helm is being
196-
used for the deployment.
197-
198-
```
199-
{
200-
"okta": {
201-
"id": "<client credential from the client ID section of the okta service configuration>",
202-
"secret": "<from the CLIENT SECRETS section of the okta service configuration>",
203-
"login_config": {
204-
"auth_url": "https://<your org>.okta.com/oauth2/v1/authorize",
205-
"token_url": "https://<your org>.okta.com/oauth2/v1/token",
206-
"userinfo_url": "https://<your org>.okta.com/oauth2/v1/userinfo",
207-
"scopes": ["openid", "profile", "email"]
208-
},
209-
"connect_config": {
210-
"auth_url": "https://<your org>.okta.com/oauth2/v1/authorize",
211-
"token_url": "https://<your org>.okta.com/oauth2/v1/token",
212-
"scopes": ["openid", "profile", "email"]
213-
}
214-
}
215-
}
216-
```
217-
218145
From your Admin page, setup windmill using the service flow
219146

220147
1. `Create a new app integration`
@@ -236,39 +163,14 @@ From your Admin page, setup windmill using the service flow
236163
- "Login initiated by" `App Only`
237164
- "Initiate login URI" `https://<your windmill's public hostname as configured in values.yaml>/user/login`
238165

239-
### Microsoft
240-
241-
Redirect URI: https://<YOUR_INSTANCE>/user/login_callback/microsoft
242-
Login: https://<YOUR_INSTANCE>/user/login
243-
244-
Microsoft's Single Sign-On integration is supported by Windmill. Detailed steps for setting up Microsoft as an OAuth SSO provider will be provided in the upcoming documentation but the entry for the oauth.json is as following:
245-
246-
```json
247-
{
248-
"microsoft": {
249-
"id": "<CLIENT_ID>",
250-
"secret": "<CLIENT_SECRET>",
251-
"allowed_domains": ["youremaildomain.dev"]
252-
}
253-
}
254-
```
166+
Superadmin Settings -> Instance Settings -> SSO -> Toggle "okta" -> set client id, org and client secret
255167

256168
### GitHub
257169

258170
Redirect URI: https://<YOUR_INSTANCE>/user/login_callback/github
259171
Login: https://<YOUR_INSTANCE>/user/login
260172

261-
GitHub's Single Sign-On integration is supported by Windmill. Detailed steps for setting up GitHub as an OAuth SSO provider will be provided in the upcoming documentation but the entry for the oauth.json is as following:
262-
263-
```json
264-
{
265-
"github": {
266-
"id": "<CLIENT_ID>",
267-
"secret": "<CLIENT_SECRET>",
268-
"allowed_domains": ["youremaildomain.dev"]
269-
}
270-
}
271-
```
173+
Superadmin Settings -> Instance Settings -> SSO -> Toggle "github" -> set client id, org and client secret
272174

273175
### GitLab
274176

@@ -277,32 +179,8 @@ Login: https://<YOUR_INSTANCE>/user/login
277179

278180
GitLab's Single Sign-On integration is supported by Windmill. Detailed steps for setting up GitLab as an OAuth SSO provider will be provided in the upcoming documentation but the entry for the oauth.json is as following:
279181

280-
```json
281-
{
282-
"gitlab": {
283-
"id": "<CLIENT_ID>",
284-
"secret": "<CLIENT_SECRET>",
285-
"allowed_domains": ["youremaildomain.dev"]
286-
}
287-
}
288-
```
182+
Superadmin Settings -> Instance Settings -> SSO -> Toggle "gitlab" -> set client id, org and client secret
289183

290184
### Custom OAuth
291185

292-
You can add a completely custom oauth without requiring a dev setup. The item accepts an extra optional field: `connect_config` or `login_config` of type OAuthConfig:
293-
294-
```
295-
interface OAuthConfig {
296-
auth_url: string,
297-
token_url: string,
298-
userinfo_url?: string,
299-
scopes?: string[],
300-
extra_params?: Record<string, string>,
301-
extra_params_callback?: Record<string, string>,
302-
req_body_auth?: bool
303-
}
304-
```
305-
306-
`connect_config` is used for resources, and `login_config` for SSO.
307-
308-
Once you have validated your custom item, we would be greateful if you could open a PR. See [Contributor's guide](../4_contributing/index.md) for more details.
186+
You can use other custom OAuths as resources using the "Add OAuth" button in: Superadmin Settings -> Instance Settings -> Resources -> Add OAuth

‎docs/misc/2_setup_oauth/setup_oauth.png

142 KB
Loading

‎docs/misc/2_setup_oauth/setup_sso.png

160 KB
Loading

0 commit comments

Comments
 (0)