You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: update the main platform SSO documentation (supabase#37705)
* feat: update the main platform SSO documentation
Update the main platform SSO documentation in preparation for the Self-Service SSO release (supabase#36732)
---------
Co-authored-by: Chris Stockton <[email protected]>
Co-authored-by: Charis <[email protected]>
Copy file name to clipboardExpand all lines: apps/docs/content/guides/platform/sso.mdx
+24-9Lines changed: 24 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,30 +13,45 @@ Supabase offers single sign-on (SSO) as a login option to provide additional acc
13
13
14
14
<Admonitiontype="note">
15
15
16
-
Supabase currently provides SAML SSO for [Team and Enterprise Plan customers](https://supabase.com/pricing). If you are an existing Team or Enterprise Plan customer, continue with the setup below. Once completed, [contact us](https://supabase.com/dashboard/support/new?category=Login_issues&subject=Enquiry%20about%20setting%20up%20SSO&message=I%20would%20like%20to%20set%20up%20SAML%20SSO%20for%20my%20team%20and%20have%20followed%20https://supabase.com/docs/guides/platform/sso%20and%20configured%20my%20provider%20%0A%0APlease%20attach%20the%20IDP%20metadata%20in%20the%20attachments%20below) to enable SSO for your team.
16
+
Supabase currently provides SAML SSO for [Team and Enterprise Plan customers](https://supabase.com/pricing). If you are an existing Team or Enterprise Plan customer, continue with the setup below.
17
17
18
18
</Admonition>
19
19
20
-
## Setup and limitations
20
+
## Supported providers
21
21
22
22
Supabase supports practically all identity providers that support the SAML 2.0 SSO protocol. We've prepared these guides for commonly used identity providers to help you get started. If you use a different provider, our support stands ready to support you.
23
23
24
24
-[Google Workspaces (formerly G Suite)](/docs/guides/platform/sso/gsuite)
25
25
-[Azure Active Directory](/docs/guides/platform/sso/azure)
26
26
-[Okta](/docs/guides/platform/sso/okta)
27
27
28
-
Accounts signing in with SSO have certain limitations.
29
-
The following sections outline the limitations when SSO is enabled or disabled for your team.
28
+
Once configured, you can update your settings anytime via the [SSO tab](https://supabase.com/dashboard/org/_/sso) under **Organization Settings**.
-**Multiple domains** - You can associate one or more email domains with your SSO provider. Users with email addresses matching these domains are eligible to sign in via SSO.
35
+
-**Auto-join** - Optionally allow users with a matching domain to be added to your organization automatically when they first sign in, without an invitation.
36
+
-**Default role for auto-joined users** - Choose the role (e.g., `Read-only`, `Developer`, `Administrator`, `Owner`) that automatically joined users receive. Refer to [access control](/docs/guides/platform/access-control) for more information about roles.
37
+
38
+
## How SSO works in Supabase
39
+
40
+
When SSO is enabled for an organization:
32
41
33
42
- Organization invites are restricted to company members belonging to the same identity provider.
34
43
- Every user has an organization created by default. They can create as many projects as they want.
35
44
- An SSO user will not be able to update or reset their password since the company administrator manages their access via the identity provider.
36
45
- If an SSO user with the following email of `[email protected]` attempts to sign in with a GitHub account that uses the same email, a separate Supabase account is created and will not be linked to the SSO user's account.
37
-
- An SSO user will not be able to see all organizations/projects created under the same identity provider. They will need to be invited to the Supabase organization first. Refer to [access control](/docs/guides/platform/access-control) for more information.
46
+
- SSO users will only see organizations/projects they've been invited to or auto-joined into. See [access control](/docs/guides/platform/access-control) for more details.
47
+
48
+
## Disabling SSO for an organization
49
+
50
+
If you disable the SSO provider for an organization, **all SSO users will immediately be unable to sign in**. Before disabling SSO, ensure you have at least one non-SSO owner account to prevent being locked out.
51
+
52
+
## Removing an individual SSO user's access
38
53
39
-
### Disable SSO for your team [#disable-sso]
54
+
To revoke access for a specific SSO user without disabling the provider entirely you may:
40
55
41
-
-You can prevent a user's account from further access to Supabase by removing or disabling their account in your identity provider.
42
-
-You should also remove or downgrade their permissions from any organizations inside Supabase.
56
+
-Remove or disable the user's account in your identity provider
57
+
-Downgrade or remove their permissions for any organizations in Supabase.
Copy file name to clipboardExpand all lines: apps/docs/content/guides/platform/sso/azure.mdx
+62-13Lines changed: 62 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ description: 'Configure single sign-on with Azure AD (Microsoft Entra).'
5
5
6
6
<Admonitiontype="note">
7
7
8
-
This feature is only available on the [Team and Enterprise Plans](https://supabase.com/pricing). If you are an existing Team or Enterprise Plan customer, continue with the setup below. Once completed, [contact us](https://supabase.com/dashboard/support/new?category=Login_issues&subject=Enquiry%20about%20setting%20up%20SSO&message=I%20would%20like%20to%20set%20up%20SAML%20SSO%20for%20my%20team%20and%20have%20followed%20https://supabase.com/docs/guides/platform/sso%20and%20configured%20my%20provider%20%0A%0APlease%20attach%20the%20IDP%20metadata%20in%20the%20attachments%20below) to enable SSO for your team.
8
+
This feature is only available on the [Team and Enterprise Plans](https://supabase.com/pricing). If you are an existing Team or Enterprise Plan customer, continue with the setup below.
9
9
10
10
</Admonition>
11
11
@@ -33,7 +33,7 @@ You'll be using the custom enterprise application setup for Supabase.
33
33
34
34
## Step 3: Fill in application details [#add-application-details]
35
35
36
-
In the modal titled _Create your own application_, enter a display name for Supabase. This is the name your Azure AD users see when signing in to Supabase from Azure. `Supabase` works in most cases.
36
+
In the modal titled _Create your own application_, enter a display name for Supabase. This is the name your Azure AD users will see when signing in to Supabase from Azure. `Supabase` works in most cases.
37
37
38
38
Make sure to choose the third option: _Integrate any other application you
39
39
don't find in the gallery (Non-gallery)_.
@@ -81,24 +81,73 @@ All of the correct information should automatically populate the _Basic SAML Con
81
81
82
82
Finally, click the _Save_ button to save the configuration.
83
83
84
-
## Step 7: Obtain metadata URL and send to Supabase [#send-metadata-url]
Supabase needs to finalize enabling single sign-on with your Azure AD application. To do this, copy and send the link under **App Federation Metadata URL** in \*section 3 **SAML Certificates\*** to your support contact and await further instructions. If you're not clear who to send this link to or need further assistance, reach out to [Supabase Support](https://supabase.help).
87
-
88
-
**Do not test the login until you have heard back from the support contact.**
86
+
Save the link under **App Federation Metadata URL** in \*section 3 **SAML Certificates\***. You will need to enter this URL later in [Step 10](#dashboard-configure-metadata).
## Step 8: Enable SSO in the Dashboard [#dashboard-enable-sso]
91
+
92
+
1. Visit the [SSO tab](https://supabase.com/dashboard/org/_/sso) under the Organization Settings page. 
93
+
94
+
2. Toggle **Enable Single Sign-On** to begin configuration. Once enabled, the configuration form appears. 
If your organization uses more than one email domain - for example, `supabase.com` for staff and `supabase.io` for contractors - you can add multiple domains here. All listed domains will be authorized for SSO sign-in.
104
+
105
+
106
+
107
+
<Admonitiontype="note">
108
+
109
+
We do not permit use of public domains like `gmail.com`, `yahoo.com`.
Enter the metadata URL you obtained from [Step 7](#idp-metadata-url) into the Metadata URL field:
93
116
94
-
Wait for confirmation or further instructions from your support contact at Supabase before proceeding to the next step. It usually takes us 1 business day to configure SSO for you.
117
+
When auto-join is enabled, you can choose the **default role** for new users:
136
+
137
+
138
+
139
+
Choose a role that fits the level of access you want to grant to new members.
140
+
141
+
<Admonitiontype="note">
142
+
143
+
Visit [access-control](/docs/guides/platform/access-control) documentation for details about each role.
144
+
145
+
</Admonition>
97
146
98
-
_Testing sign-on before your Azure AD has been registered with Supabase will not work. Make sure you've received confirmation from your support contact at Supabase as laid out in the [confirmation](#confirmation) step._
147
+
## Step 13: Save changes and test single sign-on [#dashboard-configure-save]
99
148
100
-
Once you’ve received confirmation from your support contact at Supabase that SSO setup has been completed for your enterprise, you can ask some of your users to sign in via their Azure AD account.
149
+
When you click **Save changes**, your new SSO configuration is applied immediately. From that moment, any user with an email address matching one of your configured domains who visits your organization's sign-in URL will be routed through the SSO flow.
101
150
102
-
You ask them to enter their email address on the [Sign in with SSO](https://supabase.com/dashboard/sign-in-sso) page.
151
+
We recommend asking a few users to test signing in via their Azure AD account. They can do this by entering their email address on the [Sign in with SSO](https://supabase.com/dashboard/sign-in-sso) page.
103
152
104
-
If sign in is not working correctly, reach out to your support contact at Supabase for further guidance.
153
+
If SSO sign-in doesn't work as expected, contact your Supabase support representative for assistance.
Copy file name to clipboardExpand all lines: apps/docs/content/guides/platform/sso/gsuite.mdx
+74-19Lines changed: 74 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ description: 'Configure single sign-on with Google Workspace (G Suite).'
5
5
6
6
<Admonitiontype="note">
7
7
8
-
This feature is only available on the [Team and Enterprise Plans](https://supabase.com/pricing). If you are an existing Team or Enterprise Plan customer, continue with the setup below. Once completed, [contact us](https://supabase.com/dashboard/support/new?category=Login_issues&subject=Enquiry%20about%20setting%20up%20SSO&message=I%20would%20like%20to%20set%20up%20SAML%20SSO%20for%20my%20team%20and%20have%20followed%20https://supabase.com/docs/guides/platform/sso%20and%20configured%20my%20provider%20%0A%0APlease%20attach%20the%20IDP%20metadata%20in%20the%20attachments%20below) to enable SSO for your team.
8
+
This feature is only available on the [Team and Enterprise Plans](https://supabase.com/pricing). If you are an existing Team or Enterprise Plan customer, continue with the setup below.
9
9
10
10
</Admonition>
11
11
@@ -35,12 +35,10 @@ The information you enter here is for visibility into your Google Workspace. You
This is a very important step. Click on _DOWNLOAD METADATA_ and save the file that was downloaded.
38
+
This is a very important step. Click on _DOWNLOAD METADATA_ and save the file that was downloaded. You will need to upload this file later in [Step 10](#dashboard-configure-metadata).
39
39
40
40
41
41
42
-
It's very important to send this file to your support contact at Supabase to complete the SSO setup process. If you're not sure where to send this file, you can always reach out to [Supabase Support](https://supabase.help).
43
-
44
42
**Important: Make sure the certificate as shown on screen has at least 1 year before it expires. Mark down this date in your calendar so you will be reminded that you need to update the certificate without any downtime for your users.**
45
43
46
44
## Step 5: Add service provider details [#add-service-provider-details]
@@ -63,34 +61,91 @@ Attribute mappings allow Supabase to get information about your Google Workspace
63
61
64
62
**A _Primary email_ to `email` mapping is required.** Other mappings shown below are optional and configurable depending on your Google Workspace setup. If in doubt, replicate the same config as shown.
65
63
66
-
Share any changes, if any, from this screen with your Supabase support contact.
64
+
Any changes you make from this screen will be used later in [Step 10: Configure Attribute Mapping](#dashboard-configure-attributes).
67
65
68
66
69
67
70
-
## Step 7: Wait for confirmation[#confirmation]
68
+
## Step 7: Configure user access[#configure-user-access]
71
69
72
-
Once you’ve configured the Google Workspace app as shown above, make sure you send the [metadata file you downloaded](#download-idp-metadata) and information regarding the [attribute mapping](#configure-attribute-mappings) (if any changes are applicable) to your support contact at Supabase.
70
+
You can configure which Google Workspace user accounts will get access to Supabase. This is important if you wish to limit access to your software engineering teams.
73
71
74
-
This information needs to be entered into Supabase before SSO is activated end-to-end.
72
+
You can configure this access by clicking on the _User access_ card (or down-arrow). Follow the instructions on screen.
75
73
76
-
Wait for confirmation that this information has successfully been added to Supabase. It usually takes us 1 business day to configure this information for you.
74
+
77
75
78
-
## Step 8: Configure user access [#configure-user-access]
76
+
<Admonitiontype="note">
79
77
80
-
You can configure which Google Workspace user accounts will get access to Supabase. This is important if you wish to limit access to your software engineering teams.
78
+
Changes from this step sometimes take a while to propagate across Google's systems. Wait at least 15 minutes before testing your changes.
81
79
82
-
You can configure this access by clicking on the _User access_ card (or down-arrow). Follow the instructions on screen.
80
+
</Admonition>
83
81
84
-
Changes from this step sometimes take a while to propagate across Google’s systems. Wait at least 15 minutes before proceeding to the next step.
82
+
## Step 8: Enable SSO in the Dashboard [#dashboard-enable-sso]
85
83
86
-
84
+
1. Visit the [SSO tab](https://supabase.com/dashboard/org/_/sso) under the Organization Settings page. 
85
+
86
+
2. Toggle **Enable Single Sign-On** to begin configuration. Once enabled, the configuration form appears. 
If your organization uses more than one email domain - for example, `supabase.com` for staff and `supabase.io` for contractors - you can add multiple domains here. All listed domains will be authorized for SSO sign-in.
96
+
97
+
98
+
99
+
<Admonitiontype="note">
100
+
101
+
We do not permit use of public domains like `gmail.com`, `yahoo.com`.
When auto-join is enabled, you can choose the **default role** for new users:
134
+
135
+
136
+
137
+
Choose a role that fits the level of access you want to grant to new members.
138
+
139
+
<Admonitiontype="note">
140
+
141
+
Visit [access-control](/docs/guides/platform/access-control) documentation for details about each role.
142
+
143
+
</Admonition>
89
144
90
-
Once you’ve turned on access to Supabase for users in your organization, ask one of those users to help you out in testing the setup.
145
+
## Step 13: Save changes and test single sign-on [#dashboard-configure-save]
91
146
92
-
It often helps to ask them to log out of their Google account and log back in.
147
+
When you click **Save changes**, your new SSO configuration is applied immediately. From that moment, any user with an email address matching one of your configured domains who visits your organization's sign-in URL will be routed through the SSO flow.
93
148
94
-
Ask them to enter their email address in the [Sign in with SSO](https://supabase.com/dashboard/sign-in-sso) page.
149
+
We recommend asking a few users to test signing in via their Google Workspace account. They can do this by entering their email address on the [Sign in with SSO](https://supabase.com/dashboard/sign-in-sso) page.
95
150
96
-
If sign in is not working correctly, reach out to your support contact at Supabase.
151
+
If SSO sign-in doesn't work as expected, contact your Supabase support representative for assistance.
0 commit comments