Skip to content

Commit 311c5d7

Browse files
igorlukaninigorlukanin
authored
docs: Add Microsoft Entra ID tutorial and update Cube's SP for Azure VPC (#7737)
* docs: Update Cube's SP for Azure VPC * docs: Add Microsoft Entra ID tutorial
1 parent b9fcc60 commit 311c5d7

File tree

4 files changed

+121
-3
lines changed

4 files changed

+121
-3
lines changed

‎docs/pages/product/configuration/vpc/azure.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ steps:
4949
3. The Cube Cloud service principal has specific credentials. Check that the
5050
following details match exactly what you see on the dialog box that pops up:
5151

52-
- Client ID: `0c5d0d4b-6cee-402e-9a08-e5b79f199481`
53-
- Name: `cube-dedicated-infra-sp`
52+
- Client ID: `7f3afcf3-e061-4e1b-8261-f396646d7fc7`
53+
- Name: `cube-dedicated-infra-peering-sp`
5454

5555
Once you have confirmed that all the information is correct,
5656
select&nbsp;<Btn>Consent on behalf of your organization</Btn> and
@@ -73,7 +73,7 @@ On the [Azure Portal][azure-console], go to&nbsp;<Btn>Virtual networks</Btn>
7373
in the following details:
7474

7575
- Role: `Network Contributor` or `cube-peering-role`
76-
- Members: `cube-dedicated-infra-sp`
76+
- Members: `cube-dedicated-infra-peering-sp`
7777

7878
### Firewall
7979

‎docs/pages/product/workspace/sso.mdx‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,11 @@ to get tool-specific instructions:
3737
imageUrl="https://static.cube.dev/icons/google-cloud.svg"
3838
title="Google Workspace"
3939
/>
40+
<GridItem
41+
url="sso/microsoft-entra-id"
42+
imageUrl="https://static.cube.dev/icons/azure.svg"
43+
title="Microsoft Entra ID"
44+
/>
4045
<GridItem
4146
url="sso/okta"
4247
imageUrl="https://static.cube.dev/icons/okta.svg"

‎docs/pages/product/workspace/sso/_meta.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
module.exports = {
22
"google-workspace": "Google Workspace",
3+
"microsoft-entra-id": "Microsoft Entra ID",
34
"okta": "Okta"
45
}

‎docs/pages/product/workspace/sso/microsoft-entra-id.mdx‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# Microsoft Entra ID
2+
3+
Cube Cloud supports authenticating users through [Microsoft Entra
4+
ID][ext-ms-entra-id] (formerly Azure Active Directory), which is
5+
useful when you want your users to access Cube Cloud using single sign-on.
6+
7+
This guide will walk you through the steps of configuring SAML authentication
8+
in Cube Cloud with Entra ID. You **must** have sufficient permissions in your
9+
Azure account to create a new Enterprise Application and configure SAML
10+
integration.
11+
12+
<SuccessBox>
13+
14+
Single sign-on with Microsoft Entra ID is available in Cube Cloud on
15+
[Enterprise](https://cube.dev/pricing) tier.
16+
[Contact us](https://cube.dev/contact) for details.
17+
18+
</SuccessBox>
19+
20+
## Enable SAML in Cube Cloud
21+
22+
First, we'll enable SAML 2.0 authentication in Cube Cloud:
23+
24+
1. Click your username from the top-right corner, then click <Btn>Team &
25+
Security</Btn>.
26+
27+
2. On the <Btn>Authentication & SSO</Btn> tab, ensure <Btn>SAML 2.0</Btn> is
28+
enabled:
29+
30+
<Screenshot
31+
alt="Cube Cloud Team Authentication and SSO tab"
32+
src="https://ucarecdn.com/f5ff1413-f37c-4476-afcc-0ff29e87e80a/"
33+
/>
34+
35+
Take note of the <Btn>Single Sign On URL</Btn> and <Btn>Service Provider Entity
36+
ID</Btn> values here, as we will need them in the next step when we configure
37+
the SAML integration in Entra ID.
38+
39+
## Create a new Enterprise Application in Azure
40+
41+
Go to [Enterprise Applications](https://portal.azure.com/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview)
42+
in your Azure account and click <Btn>New application</Btn>.
43+
44+
<Screenshot src="https://ucarecdn.com/57ed6718-5c4e-46e1-831b-f372153696bd/"/>
45+
46+
Select <Btn>Create your own application</Btn> at the top:
47+
48+
<Screenshot src="https://ucarecdn.com/06f40439-995a-4156-81b1-7d340b87e945/"/>
49+
50+
Give it a name and choose a *non-gallery application*:
51+
52+
<Screenshot src="https://ucarecdn.com/36f6c0c1-4d4d-460a-a640-0aba178490d8/"/>
53+
54+
Go to the <Btn>Single sign-on</Btn> section and select <Btn>SAML</Btn>:
55+
56+
<Screenshot src="https://ucarecdn.com/81d9df03-a08f-452f-b55a-574b2d4db875/"/>
57+
58+
Fill-in <Btn>Entity ID</Btn> and <Btn>Reply URL</Btn> from the [SAML
59+
configuration page](#enable-saml-in-cube-cloud) in Cube Cloud:
60+
61+
<Screenshot src="https://ucarecdn.com/266696dc-09ef-403f-a3e5-5ba913941875/"/>
62+
63+
Go to <Btn>Attributes & Claims → Edit → Advanced settings</Btn>:
64+
65+
<Screenshot src="https://ucarecdn.com/752b5a3a-29eb-4863-8ce8-8cc8a7caa0c2/"/>
66+
67+
Set the audience claim override to the value given you by the [SAML
68+
configuration page](#enable-saml-in-cube-cloud) in Cube Cloud:
69+
70+
<Screenshot src="https://ucarecdn.com/a2650781-be3a-48a1-8e79-7e1e7a8607a5/"/>
71+
72+
Go to <Btn>SAML Certificates → Edit</Btn> and select <Btn>Sign SAML response
73+
and assertion</Btn> for <Btn>Signing Option</Btn>:
74+
75+
<Screenshot src="https://ucarecdn.com/c81e7900-d448-4e8c-85be-99854ec1b582/"/>
76+
77+
Download <Btn>Federation Metadata XML</Btn>:
78+
79+
<Screenshot src="https://ucarecdn.com/d98970cf-a6ea-4206-be23-078e460515ff/"/>
80+
81+
## Complete configuration in Cube Cloud
82+
83+
Upload it to Cube Cloud through <Btn>Advanced Settings</Btn> tab on the [SAML
84+
configuration page](#enable-saml-in-cube-cloud) in Cube Cloud:
85+
86+
<Screenshot src="https://ucarecdn.com/3ae24797-bd0a-477c-9b9a-420602694616/"/>
87+
88+
Select <Btn>SHA-256</Btn> as <Btn>Signature Algorithm</Btn>:
89+
90+
<Screenshot src="https://ucarecdn.com/e0c8c608-9b1e-4b84-a51e-0613362c6aec/"/>
91+
92+
Enter “[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name)”
93+
or a preferred attribute to lookup email address in <Btn>Attributes → Email</Btn>:
94+
95+
<Screenshot src="https://ucarecdn.com/4fe50791-8203-49d4-9056-e5de6dc5643c/"/>
96+
97+
Save settings on the Cube Cloud side.
98+
99+
## Final steps
100+
101+
Make sure the new Azure application is assigned to some users or a group:
102+
103+
<Screenshot src="https://ucarecdn.com/05b7cd95-5afd-4b00-8946-5ab0c955365b/"/>
104+
105+
At the bottom of the <Btn>Single sign-on</Btn> section, select <Btn>Test</Btn>
106+
and verify that the SAML integration now works for your Cube Cloud account:
107+
108+
<Screenshot src="https://ucarecdn.com/f30f9416-64da-4cf6-ae45-e24ce678e001/"/>
109+
110+
Done! 🎉
111+
112+
[ext-ms-entra-id]: https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id

0 commit comments

Comments
 (0)