mirror of
https://github.com/open-metadata/OpenMetadata.git
synced 2025-07-09 10:09:09 +00:00
6ca1ec6fbe
* Delete old docs and rename the openmetadata-docs-v1 to openmetadata-docs * Delete old docs and rename the openmetadata-docs-v1 to openmetadata-docs * Delete old docs and rename the openmetadata-docs-v1 to openmetadata-docs
166 lines
5.6 KiB
Markdown
166 lines
5.6 KiB
Markdown
---
|
|
title: Auth0 SSO
|
|
slug: /deployment/security/auth0
|
|
---
|
|
|
|
# Auth0 SSO
|
|
|
|
Follow the sections in this guide to set up Auth0 SSO.
|
|
|
|
{% note %}
|
|
|
|
Security requirements for your **production** environment:
|
|
|
|
- **DELETE** the admin default account shipped by OM in case you had [Basic Authentication](/deployment/security/basic-auth)
|
|
enabled before configuring the authentication with Auth0 SSO.
|
|
- **UPDATE** the Private / Public keys used for the [JWT Tokens](/deployment/security/enable-jwt-tokens). The keys we provide
|
|
by default are aimed only for quickstart and testing purposes. They should NEVER be used in a production installation.
|
|
|
|
{% /note %}
|
|
|
|
## Create Server Credentials
|
|
|
|
### Step 1: Create the Account
|
|
|
|
- If you don't have an account, [Sign up](https://auth0.com/signup) to create one.
|
|
- Select the Account Type, i.e., Company or Personal
|
|
- Click I need advanced settings and click next.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/create-account-1.png" alt="create-account" /%}
|
|
|
|
- Provide the Tenant Domain, select the region and click on Create Account.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/create-account-2.png" alt="create-account" /%}
|
|
|
|
- Once done, you will land on the dashboard page.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/create-account-3.png" alt="create-account" /%}
|
|
|
|
### Step 2: Create a New Application
|
|
|
|
- Once you are on the Dashboard page, click on `Applications > Applications` available on the left-hand side panel.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/create-new-app-1.png" alt="create-app" /%}
|
|
|
|
- Click on `Create Application`.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/create-new-app-2.png" alt="create-app" /%}
|
|
|
|
- Enter the Application name.
|
|
- Choose an application type and click on `Create`.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/create-new-app-3.png" alt="create-app" /%}
|
|
|
|
### Step 3: Where to Find the Credentials
|
|
|
|
- Navigate to the Settings tab.
|
|
- You will find your `Client ID`, `Client Secret` and `Domain`.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/credentials.png" alt="credentials" /%}
|
|
|
|
## Create Service Account (optional)
|
|
|
|
This is a guide to create ingestion bot service account. This step is optional if you configure the ingestion-bot with
|
|
the JWT Token, you can follow the documentation of [Enable JWT Tokens](/deployment/security/enable-jwt-tokens).
|
|
|
|
### Step 1: Enable Client-Credential
|
|
|
|
- Go to your project dashboard.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/enable-client-credential-1.png" alt="client" /%}
|
|
|
|
- Navigate to `Applications > Applications`
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/enable-client-credential-2.png" alt="client" /%}
|
|
|
|
- Select your application from the list.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/enable-client-credential-3.png" alt="client" /%}
|
|
|
|
- Once selected, scroll down until you see the `Application Properties` section.
|
|
- Change the Token Endpoint `Authentication Method` from `None` to `Basic`.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/enable-client-credential-4.png" alt="client" /%}
|
|
|
|
- Now scroll further down to the section on `Advanced Settings`.
|
|
- Click on it and select `Grant Types`.
|
|
- In the `Grant Types`, check the option for `Client Credentials`.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/enable-client-credential-5.png" alt="client" /%}
|
|
|
|
- Once done, click on `Save Changes`.
|
|
|
|
### Step 2: Authorize the API with our Application.
|
|
|
|
- Navigate to `Applications > APIs` from the left menu.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/authorize-api-1.png" alt="auth" /%}
|
|
|
|
- You will see the `Auth0 Management API`.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/authorize-api-2.png" alt="auth" /%}
|
|
|
|
- Click on the `Auth0 Management API`.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/authorize-api-3.png" alt="auth" /%}
|
|
|
|
- Click on the `Machine to Machine Applications` tab.
|
|
- You will find your application listed below.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/authorize-api-4.png" alt="auth" /%}
|
|
|
|
- Click on the toggle to authorize.
|
|
- Once done you will find a down arrow, click on it.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/authorize-api-5.png" alt="auth" /%}
|
|
|
|
- Select the permissions (scopes) that should be granted to the client.
|
|
- Click on `Update`.
|
|
|
|
{% image src="/images/v0.13.3/deployment/security/auth0/authorize-api-6.png" alt="auth" /%}
|
|
|
|
After the applying these steps, you can update the configuration of your deployment:
|
|
|
|
{%inlineCalloutContainer%}
|
|
|
|
{%inlineCallout
|
|
icon="celebration"
|
|
bold="Docker Security"
|
|
href="/deployment/security/auth0/docker" %}
|
|
Configure Auth0 SSO for your Docker Deployment.
|
|
{%/inlineCallout%}
|
|
|
|
{%inlineCallout
|
|
icon="storage"
|
|
bold="Bare Metal Security"
|
|
href="/deployment/security/auth0/bare-metal" %}
|
|
Configure Auth0 SSO for your Bare Metal Deployment.
|
|
{%/inlineCallout%}
|
|
|
|
{%inlineCallout
|
|
icon="fit_screen"
|
|
bold="Kubernetes Security"
|
|
href="/deployment/security/auth0/kubernetes" %}
|
|
Configure Auth0 SSO for your Kubernetes Deployment.
|
|
{%/inlineCallout%}
|
|
|
|
{%/inlineCalloutContainer%}
|
|
|
|
## Configure Ingestion
|
|
|
|
After everything has been set up, you will need to configure your workflows if you are running them via the
|
|
`metadata` CLI or with any custom scheduler.
|
|
|
|
When setting up the YAML config for the connector, update the `workflowConfig` as follows:
|
|
|
|
```yaml
|
|
workflowConfig:
|
|
openMetadataServerConfig:
|
|
hostPort: "http://localhost:8585/api"
|
|
authProvider: auth0
|
|
securityConfig:
|
|
clientId: "{your_client_id}"
|
|
secretKey: "{your_client_secret}"
|
|
domain: "{your_domain}"
|
|
```
|