Single sign-on
Users can sign in through Entra ID, Okta, Keycloak, Google, Auth0 or any OpenID Connect or
SAML 2.0 provider; each enabled provider adds a button to the sign-in page.
relic auth login <url> without --user, and jf login (the JFrog® CLI), sign in through
the browser, so they use the same providers.
A provider signs in only its own accounts: those it or SCIM created (the first provider to sign in a SCIM account owns it). It never signs in another provider's, a local or an LDAP account. A deleted provider's accounts go to the next provider that signs them in.
OpenID Connect
- At the provider, register a web application with the redirect URI
https://relic.example.com/api/v1/sso/<name>/callback, where<name>is the provider's name in Relic. - In Administration → Single sign-on, add an OpenID Connect provider with the issuer URL, client ID and secret.
Relic uses the authorization-code flow with PKCE and checks the ID token's signature, audience
and nonce. It must reach <issuer>/.well-known/openid-configuration. Issuer and SAML metadata
URLs must use https, except on the Relic server's own machine.
Or declare the provider:
apiVersion: relic.build/v1
kind: IdentityProvider
metadata:
name: corp
spec:
displayName: Corp account
enabled: true
autoCreateUsers: true
groupsClaim: groups
oidc:
issuer: https://login.example.com
clientId: relic
clientSecret: <client secret>
Apply the file:
relic apply -f identity-provider.yaml
The client secret is never returned; an update without one keeps it. With
RELIC_ENCRYPTION_KEY set, it is stored encrypted.
SAML 2.0
- In Relic, add a SAML 2.0 provider with the identity provider's metadata URL, or paste its metadata XML.
- Give the identity provider Relic's metadata URL,
https://relic.example.com/api/v1/sso/<name>/metadata. It names Relic's entity ID (the same URL), the assertion consumer service (.../api/v1/sso/<name>/acs, HTTP-POST) and the certificate Relic generates for the provider.
Relic signs its requests and accepts only signed responses or assertions that answer one of
them: no replays, and no sign-ins the identity provider starts. It decrypts encrypted
assertions. The username is the NameID, or the Username attribute; the email comes from
email or mail.
apiVersion: relic.build/v1
kind: IdentityProvider
metadata:
name: adfs
spec:
displayName: Corp account
enabled: true
groupsClaim: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
saml:
metadataUrl: https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml
SAML needs Relic served over HTTPS.
Accounts and groups
| Setting | Effect |
|---|---|
Create users on their first sign-in (autoCreateUsers) | An unknown user gets an account, in the groups new users join. Otherwise only existing accounts sign in. |
Username claim (usernameClaim) | The username's claim or attribute; preferred_username (OIDC) or the NameID (SAML) when empty. |
Groups claim (groupsClaim) | The user's groups. Each sign-in sets membership to exactly the named Relic groups, ignoring case and unknown groups. Memberships an administrator set stay. |
An email that is not a single address, such as alice@example.com, is ignored and logged: a
new account gets no email, and an existing one keeps its own.
Make a group's members administrators or viewers in Administration → Groups. Every sign-in
through a provider, refused or not, is audited as sso.sign-in.