diff --git a/enterprise/integrations/saml-providers/authentik.mdx b/enterprise/integrations/saml-providers/authentik.mdx index cf53b483..d4f47251 100644 --- a/enterprise/integrations/saml-providers/authentik.mdx +++ b/enterprise/integrations/saml-providers/authentik.mdx @@ -79,6 +79,16 @@ OpenHands sign-in page. Choose **Next**. + + + Authentik New application wizard, Application step + + + ## Step 2: Choose a Provider Type Select **SAML Provider**, then choose **Next**. @@ -89,6 +99,16 @@ Select **SAML Provider**, then choose **Next**. what you want here. + + + Authentik wizard, Choose a Provider Type step with SAML Provider selected + + + ## Step 3: Configure the SAML Provider Fill in the provider details: @@ -107,6 +127,16 @@ Fill in the provider details: your Authentication hostname. + + + Authentik Configure SAML Provider, Protocol settings with ACS URL and Audience + + + Expand **Advanced protocol settings** and configure: | Field | Value | @@ -126,6 +156,16 @@ Expand **Advanced protocol settings** and configure: Authentik integration. + + + Authentik Advanced protocol settings, signing certificate and property mappings + + + Selecting a signing certificate reveals four signing toggles. Leave them at their defaults: @@ -143,6 +183,16 @@ their defaults: responses**; leave the other toggles off. + + + Authentik signing toggles with Sign assertions enabled by default + + + OpenHands provisions accounts from the SAML assertion and requires an email address. The default property mappings already include @@ -150,6 +200,19 @@ their defaults: you have customized it. +The remaining provider options include the Service Provider Binding, Default +NameID Policy, and digest and signature algorithms shown below. + + + + Authentik Service Provider Binding set to Post and Default NameID Policy set to Persistent + + + Choose **Next**. ## Step 4: Configure Bindings (Optional) @@ -161,10 +224,30 @@ policy/group/user** and bind the group(s) that should have access. Choose **Next**. + + + Authentik Configure Bindings step with no bound policies + + + ## Step 5: Review and Submit Review the application and provider details, then choose **Create Application**. + + + Authentik Review and Submit step showing application and provider details + + + ## Create a Test User SSO authenticates against Authentik, so you need at least one Authentik user diff --git a/enterprise/integrations/saml-providers/images/authentik-01-application.png b/enterprise/integrations/saml-providers/images/authentik-01-application.png new file mode 100644 index 00000000..17c3cd4f Binary files /dev/null and b/enterprise/integrations/saml-providers/images/authentik-01-application.png differ diff --git a/enterprise/integrations/saml-providers/images/authentik-02-provider-type.png b/enterprise/integrations/saml-providers/images/authentik-02-provider-type.png new file mode 100644 index 00000000..88d3f075 Binary files /dev/null and b/enterprise/integrations/saml-providers/images/authentik-02-provider-type.png differ diff --git a/enterprise/integrations/saml-providers/images/authentik-03-protocol-settings.png b/enterprise/integrations/saml-providers/images/authentik-03-protocol-settings.png new file mode 100644 index 00000000..a2df506c Binary files /dev/null and b/enterprise/integrations/saml-providers/images/authentik-03-protocol-settings.png differ diff --git a/enterprise/integrations/saml-providers/images/authentik-04-cert-mappings.png b/enterprise/integrations/saml-providers/images/authentik-04-cert-mappings.png new file mode 100644 index 00000000..ca8849bb Binary files /dev/null and b/enterprise/integrations/saml-providers/images/authentik-04-cert-mappings.png differ diff --git a/enterprise/integrations/saml-providers/images/authentik-05-signing-toggles.png b/enterprise/integrations/saml-providers/images/authentik-05-signing-toggles.png new file mode 100644 index 00000000..f633709d Binary files /dev/null and b/enterprise/integrations/saml-providers/images/authentik-05-signing-toggles.png differ diff --git a/enterprise/integrations/saml-providers/images/authentik-06-binding-nameid.png b/enterprise/integrations/saml-providers/images/authentik-06-binding-nameid.png new file mode 100644 index 00000000..e0a37fc0 Binary files /dev/null and b/enterprise/integrations/saml-providers/images/authentik-06-binding-nameid.png differ diff --git a/enterprise/integrations/saml-providers/images/authentik-07-bindings.png b/enterprise/integrations/saml-providers/images/authentik-07-bindings.png new file mode 100644 index 00000000..41aade53 Binary files /dev/null and b/enterprise/integrations/saml-providers/images/authentik-07-bindings.png differ diff --git a/enterprise/integrations/saml-providers/images/authentik-08-review.png b/enterprise/integrations/saml-providers/images/authentik-08-review.png new file mode 100644 index 00000000..5e44f8d7 Binary files /dev/null and b/enterprise/integrations/saml-providers/images/authentik-08-review.png differ