Kev nkag ib zaug thiab provisioning

Kev nkag ib zaug ntawm OpenID Connect lossis SAML, SCIM provisioning thiab LDAP.

Cia neeg nkag Quire nrog tus as khauj uas lawv twb muaj lawm, thiab khaws daim npe neeg siv Quire kom sib luag nrog koj directory.

Qhib /admin/security/auth, ces xaiv Identity providers and directories kom ntxiv kev txuas. Txhua kev txuas qhia chaw nyob uas koj tus provider xav tau.

OpenID Connect

Siv tau nrog Microsoft Entra ID, Google Workspace, Okta, Auth0, Keycloak thiab provider twg uas ua raws tus qauv.

Hauv koj tus provider, tsim web application. Teem redirect address ua callback address uas Quire qhia rau kev txuas: https://<organisation>.quirelms.com/api/auth/sso/callback/<connection>.
Hauv Quire, xaiv Add OpenID Connect thiab sau discovery address ntawm provider (xaus /.well-known/openid-configuration), client ID thiab client secret. Secret raug foob khaws; tom qab ntawd tsuas qhia plaub tus cim kawg.
Xaiv email domain uas qhov kev txuas pab. Tus neeg nkag nrog chaw nyob hauv domain ntawd yuav raug xa mus rau provider.

Lus qhia raws tus provider

Microsoft Entra ID: siv discovery address ntawm tenant nws tus kheej (https://login.microsoftonline.com/<directory id>/v2.0/.well-known/openid-configuration), tsis txhob siv common. Quire nkag neeg raws claim email, uas Entra tsuas xa rau tus as khauj muaj mail address. Yuav phim pawg rau luag haujlwm, ntxiv groups claim rau ID token thiab phim group object IDs. Yog muaj tshaj 200 pawg, Entra xa pointer es tsis xa daim npe thiab Quire yuav tsis muab group role; xaiv application rau tej pawg xwb lossis siv app roles.
Okta: siv https://<your-domain>/.well-known/openid-configuration (lossis chaw nyob /oauth2/<server> rau custom authorization server), ntxiv scope groups thiab groups claim, ces phim npe pawg. Sign-in page preset Okta (hauv social sign-in) tsuas xav tau koj lub Okta domain, xws li acme.okta.com, client ID thiab secret.
Google Workspace: siv https://accounts.google.com/.well-known/openid-configuration thiab teev koj domain hauv kev txuas kom tus as khauj ntawm lwm domain nkag tsis tau.

SAML 2.0

SAML single sign-on muaj nyob hauv phiaj xwm Business thiab siab dua (saib phiaj xwm thiab nqi). Phiaj xwm tsis muaj qhov no ntxiv tsis tau kev txuas. Yog phiaj xwm poob yam ntxwv no tom qab, kev txuas qub tseem nyeem tau tiam sis ploj ntawm txoj kev nkag; npaj lwm txoj kev nkag ua ntej txo phiaj xwm.

Hauv Quire, xaiv Add SAML 2.0. Muab cov ntaub ntawv no rau koj tus provider:
- Metadata: https://<organisation>.quirelms.com/api/auth/sso/saml2/sp/metadata
- Assertion consumer service (ACS): https://<organisation>.quirelms.com/api/auth/sso/saml2/sp/acs/<connection>
Ntawm provider, muab metadata address rau Quire, lossis paste nws metadata XML, lossis sau sign-in address thiab signing certificate.
Xa email ua name ID, thiab muab npe thiab xeem ua attributes.

Microsoft Entra ID xa email ua http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, npe ua http://schemas.microsoft.com/identity/claims/displayname thiab pawg ua http://schemas.microsoft.com/ws/2008/06/identity/claims/groups; sau cov npe ntawd hauv attribute mapping. Okta xa attribute statements raws li koj teeb; siv email, displayName thiab groups group attribute statement. Name ID format twg los tau, vim Quire nyeem email ntawm attribute.

Kuaj xyuas

Ua ntej qhia txhua tus, sim nkag ntawm private browser window nrog test account. Cia ib tug thawj coj uas nkag tau siv password nyob twj ywm txog thaum single sign-on kuaj tiav, kom kev teeb yuam kev tsis kaw txhua tus tawm.

Provisioning nrog SCIM

SCIM 2.0 cia koj directory tsim, hloov thiab ncua Quire users, thiab tswj kev koom pawg yam tsis tas upload daim xam zauv.

Ntawm /admin/security/auth, hauv User provisioning (SCIM), tsim token. Nws qhia ib zaug xwb.
Hauv chaw provisioning ntawm koj provider, teeb SCIM base address ua https://<organisation>.quirelms.com/scim/v2 thiab muab token ua bearer token.
Muab users thiab pawg tso rau application.

Rho ib tug hauv directory yuav ncua nws hauv Quire es tsis rho, kom nws cov qhab nia thiab daim ntawv pov thawj khaws cia. Txhua qhov hloov uas SCIM ua raug teev hauv audit log raws npe token.

LDAP

Rau directory hauv koj lub server uas tsis muaj SAML lossis OpenID Connect, ntxiv kev txuas LDAP directory nrog server address, bind account thiab base uas nrhiav users hauv. Ces neeg nkag siv lawv directory password; Quire kuaj nrog directory thiab yeej tsis khaws password.