Skip to content

Commit 164c741

Browse files
ldecarvalho-docldecarvalho-doc
authored
feat(iam): saml (#5463)
* feat(iam): saml * fix(iam): saml review * fix(iam): new log in docs * feat(iam): add to menu * feat(iam): reviews * feat(iam): add sentence * feat(iam): add sentece
1 parent db58acf commit 164c741

File tree

6 files changed

+221
-28
lines changed

6 files changed

+221
-28
lines changed

‎menu/navigation.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,10 @@
372372
"label": "Enforce security requirements for Members",
373373
"slug": "enforce-security-requirements-members"
374374
},
375+
{
376+
"label": "How to set up identity federation",
377+
"slug": "set-up-identity-federation"
378+
},
375379
{
376380
"label": "Create an application",
377381
"slug": "create-application"

‎pages/account/concepts.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ An active session begins when a computer or device signs into your account. To c
1818

1919
## Authentication code
2020

21-
An authentication code provides quick and secure access to your account without the hassle of remembering your [password](#login-information). When you choose to sign in with an authentication code, you receive a unique code sent directly to your email inbox that you can use one time only to [authenticate your login](/account/how-to/log-in-to-the-console/#how-to-log-in-with-an-authentication-code).
21+
An authentication code provides quick and secure access to your account without the hassle of remembering your [password](#login-information). When you choose to sign in with an authentication code, you receive a unique code sent directly to your email inbox that you can use one time only to [authenticate your login](/account/how-to/log-in-to-the-console/).
2222

2323
## Console
2424

‎pages/account/how-to/log-in-to-the-console.mdx‎

Lines changed: 80 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -11,43 +11,99 @@ import Requirements from '@macros/iam/requirements.mdx'
1111

1212
import image from './assets/scaleway-auth-code.webp'
1313

14+
You can use different methods to log in to the Scaleway console.
1415

15-
<Requirements />
16-
17-
- A [Scaleway](https://www.scaleway.com/en/) account
16+
Whether you are an Organization Owner or an IAM Member, Scaleway supports multiple authentication methods, including email and password, one-time authentication codes, and Single Sign-On (SSO) via Google, GitHub, or SAML. While many methods are similar across roles, availability depends on what user type you are and how your organization is configured.
1817

18+
An IAM user is a human user in an Organization. They can be of two types:
19+
- **Owner**: You are the Owner of the Organization that was created with your account. You manage the root account and log in directly.
20+
- **Member**: You are a Member when you are added to an Organization by an Owner or user with IAM Manager permissions. Members exist only within the specific Organizations in which they are created. They must identify their Organization ID before logging in.
1921

20-
## How to log in with an authentication code
21-
22-
Instead of your password, you can sign in to the Scaleway console with a one-time authentication code. The code is sent directly to your email inbox and can only be used once. This provides quick and secure access to your account without the hassle of remembering your password.
23-
24-
1. Open your web browser and go to the [Scaleway console](https://console.scaleway.com).
25-
2. Enter your email address in the form and click **Send authentication code**.
26-
A code will be sent to your email inbox.
27-
3. Check your email inbox for an email with the subject **Use the authentication code to access your account** and open it.
28-
4. Copy the code and enter it in the Scaleway console.
29-
<Lightbox image={image} alt="" />
22+
This page describes the different log in methods available, and what to consider based on your role.
3023

31-
You will be redirected to and logged into your management console.
32-
33-
<Message type="note">
34-
The authentication code expires 10 minutes after it is sent to you. It becomes invalid as soon as you use it. If you log out from the console and want to log in again without your password, you will need to request a new code by repeating the steps above.
35-
</Message>
24+
<Requirements />
3625

37-
## How to log in with SSO
26+
- A [Scaleway](https://www.scaleway.com/en/) account
27+
- Know your IAM user type: Owner or Member
3828

39-
Scaleway provides Single Sign-On (SSO) options for a seamless login experience. You can use your Google or Microsoft account to log in to the console. To do so, make sure the email address associated with your Scaleway account matches the email address of your Google or Microsoft account.
29+
## How to log in as an Organization Owner
4030

4131
1. Open your web browser and go to the [Scaleway console](https://console.scaleway.com).
42-
2. Click the **Log in with Google**, **Log in with Microsoft**, or **Log in with GitHub** button, depending on the account you want to use.
43-
3. You will be redirected to the respective login page of Google, Microsoft or GitHub.
44-
4. If multifactor authentication (MFA) is activated, enter the authentication code.
32+
<Tabs id="create-account">
33+
<TabsTab label="Log in with SSO">
34+
1. Click the **Google** or the **GitHub** logo, depending on the account you want to use.
35+
2. Log in through the respective Google or GitHub login pages.
36+
3. If multifactor authentication (MFA) is activated, enter the authentication code.
37+
</TabsTab>
38+
<TabsTab label="Authentication code">
39+
Instead of your password, you can sign in to the Scaleway console with a one-time authentication code. The code is sent directly to your email inbox and can only be used once. This provides quick and secure access to your account without the hassle of remembering your password.
40+
41+
1. Enter your email address in the form and click **Send authentication code**.
42+
A code will be sent to your email inbox.
43+
2. Check your email inbox for an email with the subject **Use the authentication code to access your account** and open it.
44+
3. Copy the code and enter it in the Scaleway console.
45+
<Lightbox image={image} alt="" />
46+
47+
You will be redirected to and logged into your management console.
48+
49+
<Message type="note">
50+
The authentication code expires 10 minutes after it is sent to you. It becomes invalid as soon as you use it. If you log out from the console and want to log in again without your password, you will need to request a new code by repeating the steps above.
51+
</Message>
52+
</TabsTab>
53+
<TabsTab label="Password">
54+
1. Click **Log in with password**.
55+
2. Enter your e-mail address and password.
56+
3. Click **Log in**.
57+
4. If multifactor authentication (MFA) is activated, enter the authentication code.
58+
</TabsTab>
59+
</Tabs>
4560

4661
## Log in as an IAM Member
4762

4863
If you were added to a Scaleway Organization as an [IAM Member](/iam/concepts#members), you must follow a dedicated login process.
4964

50-
<LoginMember />
65+
1. Open your web browser and go to the [Scaleway console](https://console.scaleway.com).
66+
2. Click [Log in as an IAM Member](https://account.scaleway.com/member-login).
67+
3. Enter the Organization ID or alias and click **Continue**.
68+
<Message type="important">
69+
- When you are added to an Organization as a Member, a Scaleway account is automatically created for you. An Organization administrator must provide a username, email and Organization ID for you to log in.
70+
- If your Organization admin provided a [link to connect directly](/organizations-and-projects/how-to/set-organization-alias) to your Organization, you can disregard step 3.
71+
</Message>
72+
4. Enter the username given to you by your Organization's Owner or administrator.
73+
5. Select an authentication method between **Log in with SSO**, **Send code** and **Enter password**.
74+
<Tabs id="create-account">
75+
<TabsTab label="Log in with SSO">
76+
Scaleway provides Single Sign-On (SSO) options for a seamless login experience. By default, you can use your Google or Github account to log in to the console. To do so, make sure the email address associated with your Scaleway account matches the email address of your Google or Github account.
77+
78+
<Message type="important">
79+
- If your Organization has [set up login via SAML](/iam/how-to/set-up-identity-federation), you must use the Identity Provider configured for your company to log in with SSO.
80+
- SAML SSO login is in Early Access. This means that currenttly, only a few Organizations can access and test the feature.
81+
</Message>
82+
83+
1. Click **Sign in with SSO**, if you are logging in with SAML SSO, and click the **Google** or the **GitHub** logo for OAuth2 SSO login.
84+
2. Follow the steps in the Identity Provider you were redirected to and log in.
85+
3. If multifactor authentication (MFA) is activated, enter the authentication code.
86+
</TabsTab>
87+
<TabsTab label="Authentication code">
88+
1. Click **Send code** to receive a login code in your email.
89+
2. Enter the code you received in your email.
90+
<Message type="tip">
91+
If you did not receive the email you can follow these steps, in order:
92+
- Make sure you check your spam folder
93+
- Click **Resend email**
94+
- Contact an Organization administrator to make sure your information was correctly registered
95+
- If none of the actions above work, ask an administrator to [contact the support](/account/how-to/open-a-support-ticket/#writing-an-effective-subject-and-description)
96+
</Message>
97+
3. Click **Continue**.
98+
4. If multifactor authentication (MFA) is activated, enter the authentication code.
99+
</TabsTab>
100+
<TabsTab label="Password">
101+
1. Click **Enter password**.
102+
2. Type your password in the box.
103+
3. Click **Continue**.
104+
4. If multifactor authentication (MFA) is activated, enter the authentication code.
105+
</TabsTab>
106+
</Tabs>
51107

52108
## How to log in using MFA
53109

‎pages/account/how-to/recover-a-lost-password.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ If you forget or lose the password to your [Scaleway account](https://console.sc
1717

1818
## Log in without a password using an authentication code
1919

20-
The [authentication code](/account/how-to/log-in-to-the-console/#how-to-log-in-with-an-authentication-code) allows you to access your account without a password.
20+
The [authentication code](/account/how-to/log-in-to-the-console/) allows you to access your account without a password.
2121

2222
Click **Send authentication code** on the login page of the Scaleway console.
2323

‎pages/account/troubleshooting/cannot-log-into-my-account.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ When logging into your Scaleway account, you may encounter the following message
1616

1717
<Lightbox image={image} alt="" />
1818

19-
This means you tried to log into your account from an unknown [IP address](/public-gateways/concepts/#ip-address). You may be logging in from a new device or location. As a security measure, we require you to use an [authentication code](/account/how-to/log-in-to-the-console/#how-to-log-in-with-an-authentication-code) to complete authentication.
19+
This means you tried to log into your account from an unknown [IP address](/public-gateways/concepts/#ip-address). You may be logging in from a new device or location. As a security measure, we require you to use an [authentication code](/account/how-to/log-in-to-the-console/) to complete authentication.
2020

2121
1. Check your inbox for the latest email sent by the Scaleway team.
2222
2. Click the **Authenticate myself** button in the email.
@@ -31,7 +31,7 @@ If [MFA](/account/concepts/#multifactor-authentication-mfa) is enforced for your
3131
## I have forgotten my password
3232

3333
If you forgot or lost your password, you need to reset it. There are several methods to recover it:
34-
- [Passwordless authentication using an authentication code](/account/how-to/log-in-to-the-console/#how-to-log-in-with-an-authentication-code)
34+
- [Passwordless authentication using an authentication code](/account/how-to/log-in-to-the-console/)
3535
- [Password reset using email validation](/account/how-to/recover-a-lost-password/#reset-your-password-using-email-validation)
3636
- [Password recovery in case of lost email account](/account/how-to/recover-a-lost-password/#recover-your-password-if-you-lost-access-to-your-email-account)
3737

‎pages/iam/how-to/set-up-identity-federation.mdx‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
---
2+
title: How to set up identity federation
3+
description: This page shows you how to set up identity federation on your Organization
4+
dates:
5+
validation: 2025-09-21
6+
posted: 2025-08-21
7+
---
8+
import Requirements from '@macros/iam/requirements.mdx'
9+
10+
Scaleway supports Identity Federation to provide your teams with secure access to their accounts via Single Sign-On (SSO). Depending on your organization’s requirements, you can use either built-in OAuth2 providers or configure SAML for centralized identity management.
11+
12+
<Message type="important">
13+
SAML SSO login is in Early Access. This means that currenttly, only a few Organizations can access and test the feature.
14+
</Message>
15+
16+
| Feature | **OAuth2** | **SAML** |
17+
|--------|-------------------------------|--------|
18+
| **Availability** | Enabled by default for all organizations | Available, but requires setup |
19+
| **Supported Providers** | Google, GitHub | Any SAML-compatible Identity Provider |
20+
| **Setup Required** | No | Yes — must be configured by an IAM admin |
21+
| **User Access** | Any Scaleway member whose email is verified with Google or GitHub | Only users explicitly defined in the Identity Provider |
22+
| **Centralized Management** | No | Yes — manage users from your Identity Provider |
23+
24+
<Message type="important">
25+
Keep in mind that:
26+
- OAuth2 logins are automatically disabled when SAML is configured. If SAML is not set up, members can continue to use Google or GitHub for SSO.
27+
- SSO with SAML does not apply to an Organization's Owner. Owners can log in with SSO with OAuth2.
28+
</Message>
29+
30+
Follow the steps below to set up Identity Federation for your Organization through SAML at Scaleway.
31+
32+
<Requirements />
33+
34+
- A Scaleway account logged into the [console](https://console.scaleway.com)
35+
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
36+
- An Identity Provider (IdP) configured in your company, making sure it includes all users who need to access Scaleway. Some examples of IdPs:
37+
- Okta
38+
- OneLogin
39+
- Microsoft Entra ID (prev. Azure AD)
40+
- PingIdentity
41+
- Google Workspace
42+
43+
## How to set up a SAML connection
44+
45+
1. Go to your security settings.
46+
2. Scroll to the **Identity Federation** section.
47+
3. Click **Set up SSO**. A pop-up appears.
48+
4. Copy the URLs displayed in the pop-up.
49+
50+
The information in the first step are the URLs referring to Scaleway that will be requested by your Identity Provider to create a link between platforms. They are:
51+
- The assertion consumer service (ACS) URL, and
52+
- Scaleway's entity ID
53+
54+
5. Click **Next**.
55+
6. Enter the requested URLs in their respective boxes.
56+
57+
This is the information referring to your Identity Provider that Scaleway needs to confirm the connection. It can be found in your IdP's configuration page. They are:
58+
- **Single Sign-On URL** - This is the URL your members will be redirected to when logging in with SAML
59+
- **The Identity Provider's Entity ID**
60+
7. Click **Confirm**.
61+
8. Enter the signing certificate generated by your Identity Provider in the box.
62+
<Message type="important">
63+
Keep in mind that:
64+
- Only base64-encoded certificates are supported.
65+
- The certificate must have an expiration date.
66+
- Your certificate entry must start with:
67+
```
68+
-----BEGIN CERTIFICATE-----
69+
```
70+
And end with:
71+
```
72+
-----END CERTIFICATE-----
73+
```
74+
</Message>
75+
76+
<Message type="note">
77+
You can close the Identity Provider pop-up without adding the certificate right away. The certificate can [be added at a later time](#how-to-add-a-certificate). However, while the certificate is not added, the connection between Scaleway and your Identity Provider will not be complete and the SSO feature will not work for your Organization members.
78+
</Message>
79+
9. Click **Complete setup**.
80+
81+
Once setup is complete, members can log in via SAML.
82+
83+
<Message type="tip">
84+
You can test the connection by creating a member and logging in with the new member account.
85+
</Message>
86+
87+
<Message type="important">
88+
Keep in mind that:
89+
- Members need to already have been [created manually](/iam/how-to/manage-members/#how-to-create-a-member) in Scaleway to log in.
90+
- If you delete a user in the IdP, the corresponding Member is not automatically deleted in your Scaleway Organization. The [deletion must happen manually](/iam/how-to/manage-members/#how-to-delete-a-member).
91+
</Message>
92+
93+
## How to update the connection configuration
94+
95+
If you change your Identity Provider, you will need to re-configure your SAML connection.
96+
97+
1. Go to your security settings.
98+
2. Scroll to the **Identity Federation** section.
99+
3. Click **Edit configuration**. A pop-up appears.
100+
4. (Optional) Replace the Identity Provider's Single Sign-On URL and Entity ID with the information of your new one.
101+
5. Click **Confirm**.
102+
103+
## How to add a certificate
104+
105+
If you started the connection set up, but did not add a certificate right away, you can add it after. While the certificate is not added, the connection between Scaleway and your Identity Provider will not be complete and the SSO feature will not work for your Organization members.
106+
107+
1. Go to your security settings.
108+
2. Scroll to the **Identity Federation** section.
109+
3. Click **+ Add certificate**. A pop-up appears.
110+
4. Enter the signing certificate generated by your Identity Provider in the box.
111+
5. Click **Confirm**.
112+
113+
## How to renew a certificate
114+
115+
You must regularly update your signing certificate in the frequency set by your Identity Provider. To renew a certificate:
116+
117+
1. Go to your security settings.
118+
2. Scroll to the **Identity Federation** section.
119+
3. Click **Renew certificate**. A pop-up appears.
120+
4. Enter the signing certificate generated by your Identity Provider in the box.
121+
5. Click **Confirm**.
122+
123+
## How to delete a connection
124+
125+
1. Go to your security settings.
126+
2. Scroll to the **Identity Federation** section.
127+
3. Click **Delete SSO**.
128+
<Message type="important">
129+
A pop-up appears to warn you that:
130+
- Deleting the connection will also delete your identity federation configuration and disable SAML-based SSO connections, preventing Members from logging in via this method. You can reconfigure identity federation at any time.
131+
</Message>
132+
4. Type **DELETE** in the box to confirm.
133+
5. Click **Delete**.

0 commit comments

Comments
 (0)