|
| 1 | +--- |
| 2 | +title: OIDC and SAML |
| 3 | +sidebarTitle: Custom SSO |
| 4 | +--- |
| 5 | +Plane One enables custom SSO via any identity provider with an official and supported implementation of OIDC + SAML standards. This page cites examples from Okta, but we will soon publish provider-specific instructions in phases. |
| 6 | + |
| 7 | +## OIDC |
| 8 | + |
| 9 | +You will need to configure values on your IdP first and then on Plane later. |
| 10 | + |
| 11 | +### On your preferred IdP |
| 12 | + |
| 13 | +Create a Plane client or application per your IdP's documentation and configure ↓. |
| 14 | + |
| 15 | +<Tip> |
| 16 | + `domain.tld` is the domain that you have hosted your Plane app on. |
| 17 | +</Tip> |
| 18 | + |
| 19 | +| **Config** | **Key** | |
| 20 | +|----------------|-------------------------------------------------------| |
| 21 | +| Origin URL | `http(s)://domain.tld/auth/oidc/` | |
| 22 | +| Callback URL | `http(s)://domain.tld/auth/oidc/callback/` | |
| 23 | +| Logout URL | `http(s)://domain.tld/auth/oidc/logout/` | |
| 24 | + |
| 25 | +### On Plane |
| 26 | + |
| 27 | +Go to `/god-mode/authentication/oidc` on your Plane app and find the configs ↓. |
| 28 | + |
| 29 | +<Tip> |
| 30 | + Your IdP will generate some of the following configs for you. Others, you will specify yourself. Just copy them over to each field. |
| 31 | +</Tip> |
| 32 | + |
| 33 | +<Frame></Frame> |
| 34 | + |
| 35 | +- Copy the `CLIENT_ID` for the Plane client or app you just created over from your IdP and paste it in the field for it. |
| 36 | + |
| 37 | + With providers like Keycloak, you have to choose a unique ID per app your configure. With providers like Okta and Auth0, you copy over the generated ID over to Plane. Typically, you will find it on the Plane application Home or Settings page on your IdP. |
| 38 | + |
| 39 | +- Copy the `CLIENT_SECRET` for the Plane client or app you created over from your IdP and paste it in the field for it. |
| 40 | + |
| 41 | + The secret is usually auto-generated and you just need to copy it over from the Plane app or client's Home or Settings page. |
| 42 | + |
| 43 | +- Copy the `TOKEN URL` from your IdP and paste it into the field for it on `/god-mode/authentication/oidc/`.\ |
| 44 | + Typically used to maintain user authentication and to persist it with refreshes, this URL lives in the `.well-known/` directory for the Plane app or client on your IdP. |
| 45 | + |
| 46 | +- Copy the `User info URL` from your IdP and paste it into the field for it on `/god-mode/authentication/oidc/`. |
| 47 | + |
| 48 | + Used to get an authenticating user's `email`, `first_name` and the `last_name` values from the IdP, this too can be copied over from the `.well-known/` directory. |
| 49 | + |
| 50 | +- Copy the `Authorize URL` over from the `.well-known/` directory and paste it into the field for it on Plane's `/god-mode/authentication/oidc/`.\ |
| 51 | + This is the URL that Plane's login screen redirects to when your users click `Sign up with <name of IDP>` or `Login with <name of IdP>`. |
| 52 | + |
| 53 | + <Frame></Frame> |
| 54 | + |
| 55 | + To test if this URL is right, see if clicking the `Login with <name of your IdP>` button brings up your IdP's authentication screen. |
| 56 | + |
| 57 | + <Frame></Frame> |
| 58 | + |
| 59 | +- Finally, choose a name for your IdP on Plane so you can recognize this set of configs. |
| 60 | + |
| 61 | +## SAML |
| 62 | + |
| 63 | +You will need to configure values on your IdP first and then on Plane later. |
| 64 | +<Tip> |
| 65 | + `domain.tld` is the domain that you have hosted your Plane app on. |
| 66 | +</Tip> |
| 67 | + |
| 68 | +### On your preferred IdP |
| 69 | + |
| 70 | +Create a Plane client or application per your IdP's documentation and configure ↓. |
| 71 | + |
| 72 | +| **Config** | **Value** | |
| 73 | +|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------| |
| 74 | +| Entity ID <br/><br/> Metadata that identifies Plane as an authorized service on your IdP | `http(s)://domain.tld/auth/oidc/` | |
| 75 | +| ACS URL <br/><br/>Assertion Consumer service that your IdP will redirect to after successful authentication by a user <br/><br/>This is roughly the counterpart of the `Callback URL` in OIDC set-ups. | `http(s)://domain.tld/auth/oidc/callback/` <br/><br/> Plane supports HTTP-POST bindings. | |
| 76 | +| SLS URL <br/><br/>Single Logout Service that your IdP will recognize to end a Plane session when a user logs out <br/><br/>This is roughly the counterpart of the `Logout URL` in OIDC set-ups. | `http(s)://domain.tld/auth/oidc/logout/` | |
| 77 | + |
| 78 | +<Tip> |
| 79 | +When setting these values up on the IdP, it’s important to remember Plane does not need to provide a signing certificate like other service providers. |
| 80 | +</Tip> |
| 81 | + |
| 82 | +### Let your IdP identify your users on Plane. |
| 83 | + |
| 84 | +| **Config** | **Value** | |
| 85 | +|----------------------------|--------------------------------------------------------| |
| 86 | +| Name ID format | emailAddress <br/><br/> By default, your IdP should send back a username, but Plane recognizes email addresses as the username. Set the value to the above so Plane recognizes the user correctly. |
| 87 | +### Set additional attribute values. |
| 88 | + |
| 89 | +By default, your IdP will send the value listed under `Property`. You have to map it to the SAML attribute Plane recognizes. |
| 90 | + |
| 91 | +| **Default property value** | **Plane SAML attribute** | |
| 92 | +|----------------------------|--------------------------------------------| |
| 93 | +| user.firstName | first_name | |
| 94 | +| user.lastName | last_name | |
| 95 | +| user.email | email | |
| 96 | + |
| 97 | +<Tip> |
| 98 | + Depending on your IdP, you will have to find both the `Name ID format` and the three other user identification properties on different screens. Please refer to your IdP's documentation when configuring these up on your IdP. Additionally, you may have to configure the IdP to sign assertions. Irrespective of that, you have to copy the signing certificate from the IdP. |
| 99 | +</Tip> |
| 100 | + |
| 101 | +### On Plane |
| 102 | + |
| 103 | +<Frame></Frame> |
| 104 | + |
| 105 | +<Tip> |
| 106 | + You will find all of the values for the fields below in the `/metadata` endpoint your IdP generates for the Plane app or client. |
| 107 | +</Tip> |
| 108 | + |
| 109 | +- Copy the `ENTITY_ID` for the Plane client or app you just created over from your IdP and paste it in the field for it. |
| 110 | + |
| 111 | +- Copy the `SSO URL` for the Plane client or app from your IdP and paste it in the field for it. |
| 112 | + |
| 113 | + This will bring up the IdP's authentication screen for your users. |
| 114 | + |
| 115 | + <Frame></Frame> |
| 116 | + |
| 117 | +- Copy the `SLS URL` for the Plane client or app from your IdP and paste it in the `Logout URL` field on Plane's `/god-mode/authentication/saml/`. |
| 118 | + |
| 119 | +- Add the name of the IdP that you want to show on your Plane instance's log-in or sign-up screens. |
| 120 | + |
| 121 | + <Frame></Frame> |
| 122 | + |
| 123 | +- Finally, paste the signing certificate from your IdP that you got in the last step of setting up your Plane client or app on your IdP above and paste it in the field for it. |
0 commit comments