Skip to content

cloud: clarify SAML configuration flow #23842

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
qiancai wants to merge 1 commit into
base: release-8.5
Choose a base branch
from
+11 −4
Open

cloud: clarify SAML configuration flow #23842

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions tidb-cloud/tidb-cloud-org-sso-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,13 +186,20 @@ If you have an identity provider that uses the SAML identity protocol, you can e

In TiDB Cloud, the SAML authentication method is disabled by default. After enabling Cloud Organization SSO, you can enable and configure the SAML authentication method as follows:

1. Get the following information from your identity provider for TiDB Cloud Organization SSO:
1. On the **Authentication** page of your TiDB Cloud console, locate the row of SAML in the **Authentication Methods** area, and then click <svg width="16" height="16" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M12 20H21M3.00003 20H4.67457C5.16376 20 5.40835 20 5.63852 19.9447C5.84259 19.8957 6.03768 19.8149 6.21663 19.7053C6.41846 19.5816 6.59141 19.4086 6.93732 19.0627L19.5001 6.49998C20.3285 5.67156 20.3285 4.32841 19.5001 3.49998C18.6716 2.67156 17.3285 2.67156 16.5001 3.49998L3.93729 16.0627C3.59139 16.4086 3.41843 16.5816 3.29475 16.7834C3.18509 16.9624 3.10428 17.1574 3.05529 17.3615C3.00003 17.5917 3.00003 17.8363 3.00003 18.3255V20Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path></svg> to show the SAML method details.
2. From the **Authentication Method Details** pane, copy the following values provided by TiDB Cloud:

- **Entity ID**: it is the service provider (SP) entity ID for TiDB Cloud.
- **Postback URL**: it is the SAML endpoint (also known as the Assertion Consumer Service (ACS) URL or Reply URL) to which your identity provider sends SAML responses.

3. In your identity provider, use the **Entity ID** and **Postback URL** from the previous step to create or configure a SAML application for TiDB Cloud. If an SSO team manages your identity provider, provide these values to that team.

Then, get the following information from your identity provider:

- Sign on URL
- Signing Certificate

2. On the **Authentication** page of your TiDB Cloud console, locate the row of SAML in the **Authentication Methods** area, and then click <svg width="16" height="16" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M12 20H21M3.00003 20H4.67457C5.16376 20 5.40835 20 5.63852 19.9447C5.84259 19.8957 6.03768 19.8149 6.21663 19.7053C6.41846 19.5816 6.59141 19.4086 6.93732 19.0627L19.5001 6.49998C20.3285 5.67156 20.3285 4.32841 19.5001 3.49998C18.6716 2.67156 17.3285 2.67156 16.5001 3.49998L3.93729 16.0627C3.59139 16.4086 3.41843 16.5816 3.29475 16.7834C3.18509 16.9624 3.10428 17.1574 3.05529 17.3615C3.00003 17.5917 3.00003 17.8363 3.00003 18.3255V20Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path></svg> to show the SAML method details.
3. In the method details, you can configure the following:
4. Return to the **Authentication Method Details** pane in the TiDB Cloud console, and then configure the following:

- **Name**

Expand Down Expand Up @@ -226,7 +233,7 @@ In TiDB Cloud, the SAML authentication method is disabled by default. After enab

Before enabling **SCIM Provisioning Accounts**, add and verify the email domains for users to be provisioned, and configure them in the **Allowed Email Domains** field.

4. Click **Save**.
5. Click **Activate**.

#### Configure SCIM provisioning

Expand Down
Loading