[MGNLSSO-277] Support SSO for specific domains Created: 27/Apr/23 Updated: 22/Nov/23 |
|
| Status: | Open |
| Project: | Single Sign On |
| Component/s: | None |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | Improvement | Priority: | Neutral |
| Reporter: | Minh Nguyen | Assignee: | Unassigned |
| Resolution: | Unresolved | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Attachments: |
|
||||||||||||||||||||
| Issue Links: |
|
||||||||||||||||||||
| Template: |
|
||||||||||||||||||||
| Acceptance criteria: |
Empty
|
||||||||||||||||||||
| Task DoD: |
[ ]*
Doc/release notes changes? Comment present?
[ ]*
Downstream builds green?
[ ]*
Solution information and context easily available?
[ ]*
Tests
[ ]*
FixVersion filled and not yet released
[ ] 
Architecture Decision Record (ADR)
|
||||||||||||||||||||
| Date of First Response: | |||||||||||||||||||||
| Description |
|
We need to provide SSO config to configure domains-matching along with current path-matching. Example:
path: /partner-portal
callbackUrl: !env ${MAGNOLIA_PARTNER_SSO_CALLBACK_BASE_URL}/.auth
postLogoutRedirectUri: !env ${MAGNOLIA_PARTNER_SSO_CALLBACK_BASE_URL}
authorizationGenerators:
- name: fixedRoleAuthorization
fixed:
targetRoles:
- partner
- partner-extranet
- name: groupsAuthorization # not any longer the fixedRoleAuthorization!
groups:
mappings:
- name: magnolia-superusers # magnolia-superusers group in Okta
targetRoles:
- superuser
- rest-admin
clients:
oidc.id: !env ${MAGNOLIA_PARTNER_SSO_OIDCID}
oidc.secret: !env ${MAGNOLIA_PARTNER_SSO_OIDCSECRET}
oidc.clientAuthenticationMethod: client_secret_post
oidc.scope: openid profile email groups
oidc.discoveryUri: !env ${MAGNOLIA_PARTNER_SSO_DISCOVERY_URL}
oidc.preferredJwsAlgorithm: RS256
oidc.authorizationGenerators: fixedRoleAuthorization
userFieldMappings:
name: name
removeEmailDomainFromUserName: true
removeSpecialCharactersFromUserName: false
fullName: name
email: email
language: locale
Multisite config: If we hit, https://www.magnolia-cms.com/partner-portal => it's working properly Use-case: https://jira.magnolia-cms.com/browse/PTNRPRTL-40 Thank you so much. |