Skip to content

Commit 65eede1

Browse files
jesp209ijesp209i
committed
wip Add organization ELP docs
1 parent 1b761be commit 65eede1

File tree

4 files changed

+233
-1
lines changed

4 files changed

+233
-1
lines changed

‎umbraco-cloud/.gitbook/assets/organization-external-login-provider.png‎

81.3 KB
Loading

‎umbraco-cloud/SUMMARY.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
* [The Cloud Portal](begin-your-cloud-journey/the-cloud-portal/README.md)
2121
* [Organizations](begin-your-cloud-journey/the-cloud-portal/organizations.md)
2222
* [Payments](begin-your-cloud-journey/the-cloud-portal/payments.md)
23+
* [External Login Providers](begin-your-cloud-journey/the-cloud-portal/login-providers/README.md)
2324
* [Project Features](begin-your-cloud-journey/project-features/README.md)
2425
* [Environments](begin-your-cloud-journey/project-features/environments.md)
2526
* [Flexible Environments](begin-your-cloud-journey/project-features/flexible-environments.md)

‎umbraco-cloud/begin-your-cloud-journey/the-cloud-portal/login-providers/README.md‎

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
# Organization Login Providers
2+
{% hint style="info" %}
3+
This is a Beta feature and currently only open to a few early testers. If you want to help test the feature, get in touch somehow [TODO: describe how]...
4+
{% endhint %}
5+
6+
The External Login Providers feature in Umbraco Cloud allows you to integrate third-party authentication systems to manage Portal user logins securely and efficiently. This functionality is especially useful for teams that want to simplify login management or use their existing identity systems.
7+
8+
Using OpenID Connect, Umbraco Cloud supports external login providers such as Microsoft Entra ID, Auth0, Google, and so on. This feature helps administrators manage backoffice access, assign user roles, and improve security.
9+
10+
{% hint style="info" %}
11+
This is exclusively for Cloud Portal access and access to Project features only available within the portal. [You can see how to set up External Login Providers for the Backoffice on Cloud Projects in this article](../../../project-features/external-login-providers.md).
12+
{% endhint %}
13+
14+
## External Login Providers
15+
16+
{% hint style="info" %}
17+
The Organization Areas and the Login Providers Section is only available for user logged in with Umbraco Id and who has Admin rights to the Organization.
18+
{% endhint %}
19+
20+
This guide shows you how to set up and configure external login providers for your Cloud projects. It includes the following steps:
21+
22+
- [Prepare your Login Provider](#prepare-your-login-provider)
23+
24+
- [Register the Login Provider in Cloud Portal](#register-the-login-provider-in-cloud-portal)
25+
26+
### Prepare your Login Provider
27+
28+
{% tabs %}
29+
{% tab title="Microsoft Entra ID" %}
30+
1. Access the Microsoft Azure Portal.
31+
2. Locate the Microsoft Entra ID and enter your tenant.
32+
3. Select **Add**.
33+
34+
![Select Add and then choose App Registration to start registering your app](../../../build-and-customize-your-solution/set-up-your-project/project-settings/images/elp-azure-2.png)
35+
36+
4. Choose **App registration**.
37+
5. Register your app.
38+
* Ignore the Redirect URI as that will be covered later in the guide.
39+
40+
<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeCPUN_bsq916FgXWRJCxmLvgvMfBZlfSFAS_7QZhFcJ8fCC388jLHgJRgg1zOJvCNdPW8EtUyNk86MlCo4dVtt1_oP-8oDuM3Eoq6rjAbQToN-pP2waheSCHDVtebrNTWa9ieBwg?key=SHa73yR2OEmkQib9bmYUbpLC" alt=""><figcaption></figcaption></figure>
41+
42+
6. Click **Register**.
43+
44+
Once the app has been registered, you must find and note down a series of keys. These keys will be used to set up the login provider on Umbraco Cloud.
45+
46+
Locate and note down the following keys:
47+
48+
* **Application (client) ID** - found on the **Overview** page for the app.
49+
* **Authority URL** - available from **Endpoints** on the **Overview** page.
50+
* **Secret ID** - needs to be generated on the **Certificates & Secrets** page.
51+
52+
{% hint style="info" %}
53+
### Enterprise or custom setup
54+
55+
If you're working with an enterprise or a custom setup, ensure the email claim is included in the ID token configuration.
56+
{% endhint %}
57+
{% endtab %}
58+
59+
{% tab title="Auth0" %}
60+
1. Access your Auth0 dashboard.
61+
2. Navigate to **Applications**.
62+
3. Select **Create Application**.
63+
64+
![Select Create Application to get started](../../../build-and-customize-your-solution/set-up-your-project/project-settings/images/elp-oauth-1.png)
65+
66+
4. Give the application a name and select **Regular Web Application**.
67+
5. Go to the **Settings** section.
68+
6. Identify and note down the following keys:
69+
1. **Domain URL** (Authority URL)
70+
2. **Client Id**
71+
3. **Client Secret**
72+
{% endtab %}
73+
74+
{% tab title="Google Authentication" %}
75+
1. Access the Google Developer Console.
76+
2. Select **Create Project** and give it a name.
77+
3. Go to the **OAuth consent screen** page.
78+
4. Select the **Internal** User Type and click **Create**.
79+
5. Fill in the required information.
80+
6. Add **Authorized domains** from where login should be allowed.
81+
7. Click **Save and continue**.
82+
8. Navigate to **Credentials**.
83+
9. Select **+ Create Credentials** and choose **OAuth client ID**.
84+
10. Choose **Web Application** as the application type.
85+
11. Fill in the required fields.
86+
12. Click **Save** to complete creating the credentials.
87+
88+
Before you move on, take note of the following keys:
89+
90+
* **Client ID** (generated through the steps above)
91+
* **Client Secret** (generated through the steps above)
92+
* **Authority URL** (`https://accounts.google.com`)
93+
{% endtab %}
94+
{% endtabs %}
95+
96+
Once you have the keys from your login provider, you need to follow the next steps in the Umbraco Cloud Portal.
97+
98+
Keep the configuration for your login provider open, as you will come back to it later in the guide.
99+
### Register the login provider in the Cloud Portal
100+
101+
1. Access the Umbraco Cloud Portal.
102+
2. Navigate to your Organization
103+
2. Navigate to **External Login Providers** page under the **Login Provider** section.
104+
105+
<figure><img src="../../../.gitbook/assets/organization-external-login-provider.png" alt=""><figcaption></figcaption></figure>
106+
107+
3. Select **Add Configuration**.
108+
4. Fill out the fields.
109+
- [Learn how to fill out the form](#how-to-fill-in-the-external-login-provider-configuration).
110+
111+
<figure><img src="../../../.gitbook/assets/Screenshot 2025-01-14 103502.png" alt=""><figcaption></figcaption></figure>
112+
113+
{% hint style="info" %}
114+
The **alias** must be unique across different login providers in the same environment.
115+
{% endhint %}
116+
117+
6. Click **Create** to add the new configuration.
118+
7. Select **Redirect URIs**.
119+
8. Take note of the Redirect URI.
120+
9. Head back to the configuration for your external login provider.
121+
122+
{% tabs %}
123+
{% tab title="Microsoft Entra ID" %}
124+
1) Click on **Authentication**.
125+
2) Select **Add a platform**.
126+
3) Select **Web** and add the Redirect URI.
127+
4) Add more Redirects URIs if needed.
128+
5) Under **Implicit grant and hybrid flows** check the following options:
129+
1. Access Tokens (used for implicit flows)
130+
2. ID tokens (used for implicit and hybrid flows)
131+
6) Click **Configure** to complete the configuration.
132+
133+
<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdXI0M1HS5q9WCtLM15joakZD2ZmmwKgtkgRB9yeOfUMPhs61ZmitPoO5DRgD369Z-O6UDVwjhp5_rng3l1LHGgSpPXzD_2kOcTwxftkMRzB27bL67c8nRbmS9gdJNDlnVCVdHb_Q?key=SHa73yR2OEmkQib9bmYUbpLC" alt=""><figcaption></figcaption></figure>
134+
{% endtab %}
135+
136+
{% tab title="Auth0" %}
137+
1. Navigate to the **Settings** section.
138+
2. Scroll down to find the **Application URIs**.
139+
3. Add the Redirect URI to the **Allowed Callback URLs**.
140+
141+
![Add the Redirect URI to the Allowed Callback URLs](../../build-and-customize-your-solution/set-up-your-project/project-settings/images/elp-oauth-4.png)
142+
143+
13. Add more Redirect URIs if needed.
144+
{% endtab %}
145+
146+
{% tab title="Google Authentication" %}
147+
1. Open the **Credentials** created earlier through this guide.
148+
2. Select **Add URI**.
149+
3. Add the Redirect URI.
150+
4. Click **Save** to complete the configuration.
151+
{% endtab %}
152+
{% endtabs %}
153+
154+
### How to fill in the External Login Provider Configuration
155+
156+
157+
## Project Configurations
158+
159+
Here you will setup access to Project in the Portal while signed in with your Login Provider.
160+
161+
You will need to add a Project Configuration per Project and per Login Provider.
162+
163+
First select a Project in the left side of the screen. Next click on "+ Add" on the Login Provider you want to add a Project Configuration for.
164+
165+
The modal has the following fields:
166+
- Default Access Level (required)
167+
- No Claim Found Behavior (required)
168+
- User Mapping Claim Name
169+
- Project User Mappings
170+
- Consists of two fields: "Provider Role Value" and "Project Access Level"
171+
172+
### Default Access Level
173+
Select the level of access you want users signing in with the External Login Provider to get for this Project.
174+
The dropdown has two possible permissions:
175+
- Read Only
176+
- Read and Write
177+
178+
This value is meant to be a fallback value and can be overwritten by "Project User Mappings" setting.
179+
If there are no Mappings available for the user the "No Claim Found Behavior" setting will evaluate if this fallback Permissions is used or "NoAccess".
180+
181+
### No Claim Found Behavior
182+
Use this setting for more fine grained control.
183+
This will allow you to use the Role Claim in you Login Provider to assign Permissions to your users.
184+
185+
The setting has two Settings:
186+
- NoAccess
187+
- Use Default Access Level
188+
189+
When `NoAccess` is selected it will block the users access to the Project if they do not have the correct Role assigned.
190+
If you decide to use the more lenient option "Use Default Access Level", all users in your Login Provider will automatic get the permission you selected in "Default Access Level". Unless they have a hit on the Project User Mappings.
191+
192+
### User Mapping Claim Name
193+
Enter the name of your providers default or custom Role claim name.
194+
195+
### Project User Mappings
196+
Here you can set up mapping between the "Provider Role Value" and the Project Permission Level.
197+
198+
## Audit
199+
200+
Use Audit section to troubleshoot your Login Providers and keep an eye on user Sign-ins.
201+
202+
There is audit log for each Login Provider. Keep in mind that if you remove the Login Provider the audit log will also disappear.
203+
204+
We are listing the following types of audit:
205+
206+
| Type | Sub- Type | Description |
207+
|---|---|
208+
| User Sign-ins | - | See information about Project Permissions evaluated at the Sign-in. |
209+
| External Login Providers | Added and Updated | Entries includes the changed properties. The Client Secret is always redacted. |
210+
| Project Configuration | Added, Updated and Deleted | Shows information on the changed properties and stored Role mapping options |
211+

‎umbraco-cloud/begin-your-cloud-journey/the-cloud-portal/organizations.md‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,4 +114,24 @@ In the **Payment History** section, you can see the payment history for your org
114114

115115
### Sustainability
116116

117-
The Sustainability Dashboard is designed to help users monitor and improve the environmental impact of their websites on Umbraco Cloud. For more information, see the [Sustainability Dashboard](../../optimize-and-maintain-your-site/monitor-and-troubleshoot/sustainability-dashboard.md) article.
117+
{% hint style="info" %}
118+
This is a Beta feature and currently only open to a few early testers. If you want to help test the feature, get in touch somehow [TODO: describe how]...
119+
{% endhint %}
120+
121+
The Sustainability Dashboard is designed to help users monitor and improve the environmental impact of their websites on Umbraco Cloud. For more information, see the [Sustainability Dashboard](../../optimize-and-maintain-your-site/monitor-and-troubleshoot/sustainability-dashboard.md) article.
122+
123+
## Login Providers
124+
125+
This section will allow you to configure access to the Umbraco Cloud Portal and Projects for your Organizations via the Login Provider(s) you use.
126+
127+
### External Login Providers
128+
129+
This section will allow you to configure access to the Umbraco Cloud Portal for your Organizations via the Login Provider(s) you use.
130+
131+
### Project Configurations
132+
133+
Use this section to configure Project Permissions in the Portal when users are signing in with an Organization's Login Providers.
134+
135+
### Audit
136+
137+
Here you can keep an eye on all things related to your Login Providers. See User Sign-ins, Changes to Login Provider Configurations and changes to Project Configurations.

0 commit comments

Comments
 (0)