Skip to content

Document inferred SSO provider defaults #435

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
welteki wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Document inferred SSO provider defaults #435

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions docs/openfaas-pro/sso/google.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,11 +52,10 @@ This guide will cover how to configure Google as an identity provider for OpenFa
!!! note "SSO with the faas-cli"

Google does not support the Authorization Code flow with Proof Key of Code Exchange (PKCE).
To login with the faas-cli use the Implicit Id flow.
When the faas-cli detects a Google client ID, it automatically uses the Implicit Id flow and the authority `https://accounts.google.com`.
These defaults can be overridden with the `--grant` and `--authority` flags.

```sh
faas-cli pro auth \
--grant implicit-id \
--authority https://accounts.google.com \
--client-id CLIENT_ID
```
--client-id CLIENT_ID.apps.googleusercontent.com
```
8 changes: 4 additions & 4 deletions docs/openfaas-pro/sso/microsoft-entra.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,14 +68,14 @@ This guide covers how to configure [Microsoft Entra]() as an identity provider f

!!! Note "SSO with the faas-cli"

By default the faas-cli pro auth listens for OAuth callbacks on the address `http://127.0.0.1`. Entra does not support using the loopback address for redirect URIs. You need to explicitly set the flag `--redirect-host=http://localhost` to override the default value.
The faas-cli defaults to `--redirect-host=http://localhost` when a Microsoft Entra authority is configured because Entra does not support using a loopback IP address for redirect URIs.
The callback address can be overridden with the `--redirect-host` flag.

To login with the faas-cli when using Azure Entra as the identity provider we recommend using the Implicit Id flow.

```sh
faas-cli pro auth \
--grant=implicit-id \
--authority=https://login.microsoftonline.com/1fe3798478-5987-2564-b4aa-99e587365024/v2.0 \
--client-id=068cb5cb-8cc3-4d57-8263-d6c6ce52ddff \
--redirect-host=http://localhost
```
--client-id=068cb5cb-8cc3-4d57-8263-d6c6ce52ddff
```