yujunjun/OpenMetadata
1
0
Fork 0
mirror of https://github.com/open-metadata/OpenMetadata.git synced 2026-01-08 21:48:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
OpenMetadata/openmetadata-docs/content/deployment/security/one-login/index.md
Nahuel e152e734c2
Doc: Update security docs related to SSO and JWT configuration (#10002) 
* Doc: Update security docs related to SSO and JWT configuration

* Minor typo fix
2023-01-30 14:13:23 +01:00

3.4 KiB
Raw Blame History

title slug
OneLogin SSO /deployment/security/one-login

OneLogin SSO

Follow the sections in this guide to set up OneLogin SSO.

Create Server Credentials

Step 1: Configure a new Application

  • Login to OneLogin as an administrator and click on Applications
create-account
  • Click on the Add App button and search for openid connect
  • Select the OpenId Connect (OIDC) app
create-account
  • Change the Display Name of the app to Open Metadata and click Save
create-account
  • Configure the login Url (http(s)://<domain>/signin) and redirect URI (http(s)://<domain>/callback) as shown below
create-account
  • Configure the users in the organization that can access OpenMetadata app by clicking on the Users
create-account
  • Click on "SSO" and select None (PKCE) for Token Endpoint.
create-account

Step 2: Where to find the Credentials

  • Go to "SSO" and copy the Client ID
create-account
  • Copy the Issuer URL

Create Service Account (optional)

This step is optional if you configure the ingestion-bot with the JWT Token, you can follow the documentation of Enable JWT Tokens.

Create Secret Key

  • Navigate to "SSO" settings of the application and click on Show client secret to copy the secret key
create-account

After the applying these steps, you can update the configuration of your deployment:

Configure OneLogin SSO for your Docker Deployment. Configure OneLogin SSO for your Bare Metal Deployment. Configure OneLogin SSO for your Kubernetes Deployment.

Configure Ingestion

After everything has been set up, you will need to configure your workflows if you are running them via the metadata CLI or with any custom scheduler.

Note that OneLogin SSO is a layer on top of Custom OIDC.

When setting up the YAML config for the connector, update the workflowConfig as follows:

workflowConfig:
  openMetadataServerConfig:
    hostPort: 'http://localhost:8585/api'
    authProvider: custom-oidc
    securityConfig:
      clientId: '{your_client_id}'
      secretKey: '{your_client_secret}'
      domain: '{your_domain}'