Single sign-on (SSO) is an authentication method that allows users to log in with a single identity to several related, but independent, software systems. You can add SSO identity providers (IdPs) to Reunite to allow users to use them for logging into Reunite as well as individual projects. After you add an IdP to Reunite, the IdP can then be configured in the redocly.yaml configuration file for individual projects.
When users log in with an IdP, the default team and organization role assigned in the IdP override the organization role assigned on the People page in Reunite.
You can add one or more identity providers in each of the two categories in Reunite:
- Corporate: used to authenticate internal users into Reunite and projects.
- Guest: used to authenticate external users into projects.
For each Reunite category, you can connect to your identity provider using either the SAML 2 or OpenID Connect protocol.
When configuring the redocly.yaml configuration file for individual projects, you can add one or all of the three possible identity provider categories:
REDOCLY: This value represents credentials managed by Redocly and allows users to log in with their Redocly password or social login providers, like Google.CORPORATE: This value represents credentials for IdPs you added as Corporate identity providers in Reunite.GUEST: This value represents credentials for IdPs you added as Guest identity providers in Reunite.
The values listed are the identity providers (IdPs), if added in Reunite, users can use to log in to the project. To combine identity provider categories, configure sso in the redocly.yaml file of the project. To target specific identity providers by their unique ID, configure idps instead. sso and idps are mutually exclusive.
Identity provider configuration in redocly.yaml is not required for users to be able to use IdPs to log in. If you did NOT configure sso or idps in your project, users can log in to the project using IdPs you have added in Reunite with the following default priority order:
GUEST: If you added GUEST IdPs in Reunite, users must log in to the project using GUEST IdPs.CORPORATE: If you added CORPORATE IdPs in Reunite and no GUEST IdPs, users must log in to the project using CORPORATE IdPs.REDOCLY: If you didn't add either GUEST or CORPORATE IdPs in Reunite, users must use their Redocly credentials or social login providers like Google.
Verified domains are a way for you to connect users with a given organization. They only apply to corporate identity providers when logging into Reunite, not logging in to projects. You can add a Verified domain on the SSO and login page in Reunite.
When you add a Verified domain to your organization, users logging in to Reunite with the verified domain email are automatically directed to corporate identity providers, with the option to use Redocly credentials or social logins. If you also select to require SSO authentication, users logging in to Reunite with the verified domain email domain can only log in using corporate identity providers.
Team mapping is an option when you add a Corporate or Guest IdP. The option name differs depending on the protocol you are using to connect:
- For OpenID Connect, the option is referred to as team claim mapping.
- For SAML 2, the option is referred to as team attribute mapping.
In both instances, team mapping is a way to specify what you want your IdP groups to be labeled as in Reunite.
You can also use team mapping to assign users in your IdP groups different project's RBAC teams or organization roles than the default team and role.
When users log in with an IdP, the groups assigned in the IdP override the RBAC teams assigned in Reunite.
You can disable SSO for individual projects. When you disable SSO for a project, there is no log in page for that project. Disabling SSO is only necessary if you have rbac configured, but you don't want to require login to your project. Disabling SSO removes the login page, but does not disable rbac.
When a user logs out of a project, the session ends. For OpenID Connect IdPs, users are not automatically logged back in after logout and must re-authenticate at the identity provider the next time they access the project. When a session expires without a logout, users are re-authenticated without a prompt.
Logout does not end the session at the identity provider itself, so users stay logged in to other applications that use the same IdP.
- Add an identity provider - Step-by-step guide to add identity providers in Reunite for seamless user authentication across projects
- Configure SSO - Set up single sign-on to allow users to authenticate using multiple identity providers for flexible access control
- Okta SAML integration video - Watch a step-by-step tutorial for integrating Okta with Redocly using SAML for single sign-on
- SSO configuration reference - Complete technical reference for all SSO configuration options and settings in your redocly.yaml file
- Logout return URL - Configure the page users are redirected to after they log out of a project
- Multi-tenant SSO: Federated identity management - Implement federated identity management for organizations with multiple tenants and complex authentication requirements
- Configure SCIM - Enable SCIM 2.0 directory provisioning for an identity provider (early access on request)