[{"data":1,"prerenderedAt":893},["ShallowReactive",2],{"docs-navigation":3,"-docs-guides-security-single-sign-on":410,"-docs-guides-security-single-sign-on-surround":888},[4,19,166,319,333,397],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":18},"Overview","i-lucide-compass","\u002Fdocs\u002Foverview","docs\u002F1.overview",[10,14],{"title":11,"path":12,"stem":13},"Introduction","\u002Fdocs\u002Foverview\u002Fintroduction","docs\u002F1.overview\u002F1.introduction",{"title":15,"path":16,"stem":17},"JFrog compatibility","\u002Fdocs\u002Foverview\u002Fjfrog-compatibility","docs\u002F1.overview\u002F2.jfrog-compatibility",false,{"title":20,"icon":21,"path":22,"stem":23,"children":24,"page":18},"Installation","i-lucide-download","\u002Fdocs\u002Finstallation","docs\u002F2.installation",[25,29,43,68,108,112,116,162],{"title":26,"path":27,"stem":28},"Choosing a method","\u002Fdocs\u002Finstallation\u002Foverview","docs\u002F2.installation\u002F1.overview",{"title":30,"icon":31,"path":32,"stem":33,"children":34,"page":18},"Single binary","i-lucide-terminal","\u002Fdocs\u002Finstallation\u002Fsingle-binary","docs\u002F2.installation\u002F2.single-binary",[35,39],{"title":36,"path":37,"stem":38},"Quick start","\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Fquick-start","docs\u002F2.installation\u002F2.single-binary\u002F1.quick-start",{"title":40,"path":41,"stem":42},"Limits and backups","\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Foperations","docs\u002F2.installation\u002F2.single-binary\u002F2.operations",{"title":44,"icon":45,"path":46,"stem":47,"children":48,"page":18},"Docker","i-simple-icons-docker","\u002Fdocs\u002Finstallation\u002Fdocker","docs\u002F2.installation\u002F3.docker",[49,52,56,60,64],{"title":36,"path":50,"stem":51},"\u002Fdocs\u002Finstallation\u002Fdocker\u002Fquick-start","docs\u002F2.installation\u002F3.docker\u002F1.quick-start",{"title":53,"path":54,"stem":55},"PostgreSQL and S3","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fpostgresql-and-s3","docs\u002F2.installation\u002F3.docker\u002F2.postgresql-and-s3",{"title":57,"path":58,"stem":59},"Docker Compose","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose","docs\u002F2.installation\u002F3.docker\u002F3.compose",{"title":61,"path":62,"stem":63},"Compose settings","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose-settings","docs\u002F2.installation\u002F3.docker\u002F4.compose-settings",{"title":65,"path":66,"stem":67},"Compose with another object store","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose-other-object-storage","docs\u002F2.installation\u002F3.docker\u002F5.compose-other-object-storage",{"title":69,"icon":70,"path":71,"stem":72,"children":73,"page":18},"Kubernetes","i-simple-icons-kubernetes","\u002Fdocs\u002Finstallation\u002Fkubernetes","docs\u002F2.installation\u002F4.kubernetes",[74,77,80,84,88,92,96,100,104],{"title":5,"path":75,"stem":76},"\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Foverview","docs\u002F2.installation\u002F4.kubernetes\u002F1.overview",{"title":36,"path":78,"stem":79},"\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fquick-start","docs\u002F2.installation\u002F4.kubernetes\u002F2.quick-start",{"title":81,"path":82,"stem":83},"External PostgreSQL","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexternal-postgresql","docs\u002F2.installation\u002F4.kubernetes\u002F3.external-postgresql",{"title":85,"path":86,"stem":87},"External object storage","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexternal-object-storage","docs\u002F2.installation\u002F4.kubernetes\u002F4.external-object-storage",{"title":89,"path":90,"stem":91},"Exposing Relic","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexposing","docs\u002F2.installation\u002F4.kubernetes\u002F5.exposing",{"title":93,"path":94,"stem":95},"Values","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fvalues","docs\u002F2.installation\u002F4.kubernetes\u002F6.values",{"title":97,"path":98,"stem":99},"Upgrades and removal","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fupgrades","docs\u002F2.installation\u002F4.kubernetes\u002F7.upgrades",{"title":101,"path":102,"stem":103},"Hardening and probes","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fhardening","docs\u002F2.installation\u002F4.kubernetes\u002F8.hardening",{"title":105,"path":106,"stem":107},"Monitoring","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fmonitoring","docs\u002F2.installation\u002F4.kubernetes\u002F9.monitoring",{"title":109,"path":110,"stem":111},"Cloudflare","\u002Fdocs\u002Finstallation\u002Fcloudflare","docs\u002F2.installation\u002F5.cloudflare",{"title":113,"path":114,"stem":115},"Configuration reference","\u002Fdocs\u002Finstallation\u002Fconfiguration","docs\u002F2.installation\u002F6.configuration",{"title":117,"icon":118,"path":119,"stem":120,"children":121,"page":18},"Storage","i-lucide-hard-drive","\u002Fdocs\u002Finstallation\u002Fstorage","docs\u002F2.installation\u002F7.storage",[122,126,130,134,138,142,146,150,154,158],{"title":123,"path":124,"stem":125},"Storage overview","\u002Fdocs\u002Finstallation\u002Fstorage\u002Foverview","docs\u002F2.installation\u002F7.storage\u002F1.overview",{"title":127,"path":128,"stem":129},"Azure Blob Storage","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fazure-blob-storage","docs\u002F2.installation\u002F7.storage\u002F10.azure-blob-storage",{"title":131,"path":132,"stem":133},"SeaweedFS","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fseaweedfs","docs\u002F2.installation\u002F7.storage\u002F2.seaweedfs",{"title":135,"path":136,"stem":137},"Amazon S3","\u002Fdocs\u002Finstallation\u002Fstorage\u002Famazon-s3","docs\u002F2.installation\u002F7.storage\u002F3.amazon-s3",{"title":139,"path":140,"stem":141},"Cloudflare R2","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fcloudflare-r2","docs\u002F2.installation\u002F7.storage\u002F4.cloudflare-r2",{"title":143,"path":144,"stem":145},"MinIO","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fminio","docs\u002F2.installation\u002F7.storage\u002F5.minio",{"title":147,"path":148,"stem":149},"Google Cloud Storage","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fgoogle-cloud-storage","docs\u002F2.installation\u002F7.storage\u002F6.google-cloud-storage",{"title":151,"path":152,"stem":153},"Backblaze B2","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fbackblaze-b2","docs\u002F2.installation\u002F7.storage\u002F7.backblaze-b2",{"title":155,"path":156,"stem":157},"Other S3-compatible services","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fother","docs\u002F2.installation\u002F7.storage\u002F8.other",{"title":159,"path":160,"stem":161},"Filesystem","\u002Fdocs\u002Finstallation\u002Fstorage\u002Ffilesystem","docs\u002F2.installation\u002F7.storage\u002F9.filesystem",{"title":163,"path":164,"stem":165},"Development","\u002Fdocs\u002Finstallation\u002Fdevelopment","docs\u002F2.installation\u002F8.development",{"title":167,"icon":168,"path":169,"stem":170,"children":171,"page":18},"Guides","i-lucide-book-open","\u002Fdocs\u002Fguides","docs\u002F3.guides",[172,176,180,254,296,300,303,307,311,315],{"title":173,"path":174,"stem":175},"Repositories","\u002Fdocs\u002Fguides\u002Frepositories","docs\u002F3.guides\u002F1.repositories",{"title":177,"path":178,"stem":179},"Replication","\u002Fdocs\u002Fguides\u002Freplication","docs\u002F3.guides\u002F10.replication",{"title":181,"icon":182,"path":183,"stem":184,"children":185,"page":18},"Package types","i-lucide-package","\u002Fdocs\u002Fguides\u002Fpackage-types","docs\u002F3.guides\u002F2.package-types",[186,190,194,198,202,206,210,214,218,222,226,230,234,238,242,246,250],{"title":187,"path":188,"stem":189},"npm, yarn and pnpm","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnpm","docs\u002F3.guides\u002F2.package-types\u002F01.npm",{"title":191,"path":192,"stem":193},"Maven and Gradle","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fmaven-gradle","docs\u002F3.guides\u002F2.package-types\u002F02.maven-gradle",{"title":195,"path":196,"stem":197},"Docker and OCI","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fdocker","docs\u002F3.guides\u002F2.package-types\u002F03.docker",{"title":199,"path":200,"stem":201},"Go","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fgo","docs\u002F3.guides\u002F2.package-types\u002F04.go",{"title":203,"path":204,"stem":205},"PyPI","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fpypi","docs\u002F3.guides\u002F2.package-types\u002F05.pypi",{"title":207,"path":208,"stem":209},"Helm","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fhelm","docs\u002F3.guides\u002F2.package-types\u002F06.helm",{"title":211,"path":212,"stem":213},"NuGet","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnuget","docs\u002F3.guides\u002F2.package-types\u002F07.nuget",{"title":215,"path":216,"stem":217},"RubyGems","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Frubygems","docs\u002F3.guides\u002F2.package-types\u002F08.rubygems",{"title":219,"path":220,"stem":221},"Cargo","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fcargo","docs\u002F3.guides\u002F2.package-types\u002F09.cargo",{"title":223,"path":224,"stem":225},"Conan","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fconan","docs\u002F3.guides\u002F2.package-types\u002F10.conan",{"title":227,"path":228,"stem":229},"Terraform and OpenTofu","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fterraform","docs\u002F3.guides\u002F2.package-types\u002F11.terraform",{"title":231,"path":232,"stem":233},"Hugging Face","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fhugging-face","docs\u002F3.guides\u002F2.package-types\u002F12.hugging-face",{"title":235,"path":236,"stem":237},"Generic files","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fgeneric","docs\u002F3.guides\u002F2.package-types\u002F13.generic",{"title":239,"path":240,"stem":241},"RPM","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Frpm","docs\u002F3.guides\u002F2.package-types\u002F14.rpm",{"title":243,"path":244,"stem":245},"Debian","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fdebian","docs\u002F3.guides\u002F2.package-types\u002F15.debian",{"title":247,"path":248,"stem":249},"Alpine","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Falpine","docs\u002F3.guides\u002F2.package-types\u002F16.alpine",{"title":251,"path":252,"stem":253},"Nix","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnix","docs\u002F3.guides\u002F2.package-types\u002F17.nix",{"title":255,"icon":256,"path":257,"stem":258,"children":259,"page":18},"Security","i-lucide-shield","\u002Fdocs\u002Fguides\u002Fsecurity","docs\u002F3.guides\u002F3.security",[260,264,268,272,276,280,284,288,292],{"title":261,"path":262,"stem":263},"Permissions","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fpermissions","docs\u002F3.guides\u002F3.security\u002F1.permissions",{"title":265,"path":266,"stem":267},"LDAP","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fldap","docs\u002F3.guides\u002F3.security\u002F2.ldap",{"title":269,"path":270,"stem":271},"Access tokens","\u002Fdocs\u002Fguides\u002Fsecurity\u002Ftokens","docs\u002F3.guides\u002F3.security\u002F3.tokens",{"title":273,"path":274,"stem":275},"Relic Scan","\u002Fdocs\u002Fguides\u002Fsecurity\u002Frelic-scan","docs\u002F3.guides\u002F3.security\u002F4.relic-scan",{"title":277,"path":278,"stem":279},"CVE intelligence","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fcve-intelligence","docs\u002F3.guides\u002F3.security\u002F5.cve-intelligence",{"title":281,"path":282,"stem":283},"Audit log","\u002Fdocs\u002Fguides\u002Fsecurity\u002Faudit-log","docs\u002F3.guides\u002F3.security\u002F6.audit-log",{"title":285,"path":286,"stem":287},"Single sign-on","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fsingle-sign-on","docs\u002F3.guides\u002F3.security\u002F7.single-sign-on",{"title":289,"path":290,"stem":291},"SCIM provisioning","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fscim","docs\u002F3.guides\u002F3.security\u002F8.scim",{"title":293,"path":294,"stem":295},"Workload identities","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fworkload-identities","docs\u002F3.guides\u002F3.security\u002F9.workload-identities",{"title":297,"path":298,"stem":299},"Operations","\u002Fdocs\u002Fguides\u002Foperations","docs\u002F3.guides\u002F4.operations",{"title":105,"path":301,"stem":302},"\u002Fdocs\u002Fguides\u002Fmonitoring","docs\u002F3.guides\u002F5.monitoring",{"title":304,"path":305,"stem":306},"Metrics reference","\u002Fdocs\u002Fguides\u002Fmetrics-reference","docs\u002F3.guides\u002F6.metrics-reference",{"title":308,"path":309,"stem":310},"Webhooks","\u002Fdocs\u002Fguides\u002Fwebhooks","docs\u002F3.guides\u002F7.webhooks",{"title":312,"path":313,"stem":314},"Projects","\u002Fdocs\u002Fguides\u002Fprojects","docs\u002F3.guides\u002F8.projects",{"title":316,"path":317,"stem":318},"AI agents","\u002Fdocs\u002Fguides\u002Fai-agents","docs\u002F3.guides\u002F9.ai-agents",{"title":320,"icon":321,"path":322,"stem":323,"children":324,"page":18},"API","i-lucide-braces","\u002Fdocs\u002Fapi","docs\u002F4.api",[325,329],{"title":326,"path":327,"stem":328},"API usage","\u002Fdocs\u002Fapi\u002Foverview","docs\u002F4.api\u002F1.overview",{"title":330,"path":331,"stem":332},"Relic API","\u002Fdocs\u002Fapi\u002Frelic-api","docs\u002F4.api\u002F2.relic-api",{"title":334,"icon":31,"path":335,"stem":336,"children":337,"page":18},"CLI","\u002Fdocs\u002Fcli","docs\u002F5.cli",[338,341,345,349,353,357,361,365,369,373,377,381,385,389,393],{"title":5,"path":339,"stem":340},"\u002Fdocs\u002Fcli\u002Foverview","docs\u002F5.cli\u002F01.overview",{"title":342,"path":343,"stem":344},"Sign in and contexts","\u002Fdocs\u002Fcli\u002Fsign-in","docs\u002F5.cli\u002F02.sign-in",{"title":346,"path":347,"stem":348},"Resources","\u002Fdocs\u002Fcli\u002Fresources","docs\u002F5.cli\u002F03.resources",{"title":350,"path":351,"stem":352},"apply, diff and delete","\u002Fdocs\u002Fcli\u002Fapply","docs\u002F5.cli\u002F04.apply",{"title":354,"path":355,"stem":356},"Artifacts","\u002Fdocs\u002Fcli\u002Ffiles","docs\u002F5.cli\u002F05.files",{"title":358,"path":359,"stem":360},"Server, API and tokens","\u002Fdocs\u002Fcli\u002Fplatform","docs\u002F5.cli\u002F06.platform",{"title":362,"path":363,"stem":364},"Builds and images","\u002Fdocs\u002Fcli\u002Fbuilds","docs\u002F5.cli\u002F07.builds",{"title":366,"path":367,"stem":368},"Scanning and auditing","\u002Fdocs\u002Fcli\u002Fsecurity","docs\u002F5.cli\u002F08.security",{"title":370,"path":371,"stem":372},"Releases","\u002Fdocs\u002Fcli\u002Freleases","docs\u002F5.cli\u002F09.releases",{"title":374,"path":375,"stem":376},"Evidence","\u002Fdocs\u002Fcli\u002Fevidence","docs\u002F5.cli\u002F10.evidence",{"title":378,"path":379,"stem":380},"Package managers","\u002Fdocs\u002Fcli\u002Fpackage-managers","docs\u002F5.cli\u002F11.package-managers",{"title":382,"path":383,"stem":384},"Scan reports and VEX","\u002Fdocs\u002Fcli\u002Freports-and-vex","docs\u002F5.cli\u002F12.reports-and-vex",{"title":386,"path":387,"stem":388},"Migrating from Artifactory","\u002Fdocs\u002Fcli\u002Fimport","docs\u002F5.cli\u002F13.import",{"title":390,"path":391,"stem":392},"Database","\u002Fdocs\u002Fcli\u002Fdatabase","docs\u002F5.cli\u002F14.database",{"title":394,"path":395,"stem":396},"Machine setup","\u002Fdocs\u002Fcli\u002Fsetup","docs\u002F5.cli\u002F15.setup",{"title":398,"icon":399,"path":400,"stem":401,"children":402,"page":18},"SDK","i-lucide-boxes","\u002Fdocs\u002Fsdk","docs\u002F6.sdk",[403,406],{"title":5,"path":404,"stem":405},"\u002Fdocs\u002Fsdk\u002Foverview","docs\u002F6.sdk\u002F1.overview",{"title":407,"path":408,"stem":409},"Relic API clients","\u002Fdocs\u002Fsdk\u002Frelic-api-clients","docs\u002F6.sdk\u002F2.relic-api-clients",{"id":411,"title":285,"body":412,"description":881,"extension":882,"links":883,"meta":884,"navigation":885,"path":286,"seo":886,"stem":287,"__hash__":887},"docs\u002Fdocs\u002F3.guides\u002F3.security\u002F7.single-sign-on.md",{"type":413,"value":414,"toc":876},"minimark",[415,432,440,445,471,482,485,635,638,661,668,672,691,706,790,793,797,855,862,872],[416,417,418,419,423,424,427,428,431],"p",{},"Users can sign in through Entra ID, Okta, Keycloak, Google, Auth0 or any OpenID Connect or\nSAML 2.0 provider; each enabled provider adds a button to the sign-in page.\n",[420,421,422],"code",{},"relic auth login \u003Curl>"," without ",[420,425,426],{},"--user",", and ",[420,429,430],{},"jf login"," (the JFrog® CLI), sign in through\nthe browser, so they use the same providers.",[416,433,434,435,439],{},"A provider signs in only its own accounts: those it or ",[436,437,438],"a",{"href":290},"SCIM","\ncreated (the first provider to sign in a SCIM account owns it). It never signs in another\nprovider's, a local or an LDAP account. A deleted provider's accounts go to the next provider\nthat signs them in.",[441,442,444],"h2",{"id":443},"openid-connect","OpenID Connect",[446,447,448,460],"ol",{},[449,450,451,452,455,456,459],"li",{},"At the provider, register a web application with the redirect URI\n",[420,453,454],{},"https:\u002F\u002Frelic.example.com\u002Fapi\u002Fv1\u002Fsso\u002F\u003Cname>\u002Fcallback",", where ",[420,457,458],{},"\u003Cname>"," is the provider's\nname in Relic.",[449,461,462,463,467,468,470],{},"In ",[464,465,466],"strong",{},"Administration → Single sign-on",", add an ",[464,469,444],{}," provider with the issuer\nURL, client ID and secret.",[416,472,473,474,477,478,481],{},"Relic uses the authorization-code flow with PKCE and checks the ID token's signature, audience\nand nonce. It must reach ",[420,475,476],{},"\u003Cissuer>\u002F.well-known\u002Fopenid-configuration",". Issuer and SAML metadata\nURLs must use ",[420,479,480],{},"https",", except on the Relic server's own machine.",[416,483,484],{},"Or declare the provider:",[486,487,492],"pre",{"className":488,"code":489,"language":490,"meta":491,"style":491},"language-yaml shiki shiki-themes material-theme-lighter github-light-default github-dark-default","apiVersion: relic.build\u002Fv1\nkind: IdentityProvider\nmetadata:\n  name: corp\nspec:\n  displayName: Corp account\n  enabled: true\n  autoCreateUsers: true\n  groupsClaim: groups\n  oidc:\n    issuer: https:\u002F\u002Flogin.example.com\n    clientId: relic\n    clientSecret: \u003Cclient secret>\n","yaml","",[420,493,494,511,522,531,542,550,561,573,583,594,602,613,624],{"__ignoreMap":491},[495,496,499,503,507],"span",{"class":497,"line":498},"line",1,[495,500,502],{"class":501},"smKOL","apiVersion",[495,504,506],{"class":505},"sWneD",":",[495,508,510],{"class":509},"sasMN"," relic.build\u002Fv1\n",[495,512,514,517,519],{"class":497,"line":513},2,[495,515,516],{"class":501},"kind",[495,518,506],{"class":505},[495,520,521],{"class":509}," IdentityProvider\n",[495,523,525,528],{"class":497,"line":524},3,[495,526,527],{"class":501},"metadata",[495,529,530],{"class":505},":\n",[495,532,534,537,539],{"class":497,"line":533},4,[495,535,536],{"class":501},"  name",[495,538,506],{"class":505},[495,540,541],{"class":509}," corp\n",[495,543,545,548],{"class":497,"line":544},5,[495,546,547],{"class":501},"spec",[495,549,530],{"class":505},[495,551,553,556,558],{"class":497,"line":552},6,[495,554,555],{"class":501},"  displayName",[495,557,506],{"class":505},[495,559,560],{"class":509}," Corp account\n",[495,562,564,567,569],{"class":497,"line":563},7,[495,565,566],{"class":501},"  enabled",[495,568,506],{"class":505},[495,570,572],{"class":571},"sH4kE"," true\n",[495,574,576,579,581],{"class":497,"line":575},8,[495,577,578],{"class":501},"  autoCreateUsers",[495,580,506],{"class":505},[495,582,572],{"class":571},[495,584,586,589,591],{"class":497,"line":585},9,[495,587,588],{"class":501},"  groupsClaim",[495,590,506],{"class":505},[495,592,593],{"class":509}," groups\n",[495,595,597,600],{"class":497,"line":596},10,[495,598,599],{"class":501},"  oidc",[495,601,530],{"class":505},[495,603,605,608,610],{"class":497,"line":604},11,[495,606,607],{"class":501},"    issuer",[495,609,506],{"class":505},[495,611,612],{"class":509}," https:\u002F\u002Flogin.example.com\n",[495,614,616,619,621],{"class":497,"line":615},12,[495,617,618],{"class":501},"    clientId",[495,620,506],{"class":505},[495,622,623],{"class":509}," relic\n",[495,625,627,630,632],{"class":497,"line":626},13,[495,628,629],{"class":501},"    clientSecret",[495,631,506],{"class":505},[495,633,634],{"class":509}," \u003Cclient secret>\n",[416,636,637],{},"Apply the file:",[486,639,643],{"className":640,"code":641,"language":642,"meta":491,"style":491},"language-bash shiki shiki-themes material-theme-lighter github-light-default github-dark-default","relic apply -f identity-provider.yaml\n","bash",[420,644,645],{"__ignoreMap":491},[495,646,647,651,654,658],{"class":497,"line":498},[495,648,650],{"class":649},"seIyd","relic",[495,652,653],{"class":509}," apply",[495,655,657],{"class":656},"smky3"," -f",[495,659,660],{"class":509}," identity-provider.yaml\n",[416,662,663,664,667],{},"The client secret is never returned; an update without one keeps it. With\n",[420,665,666],{},"RELIC_ENCRYPTION_KEY"," set, it is stored encrypted.",[441,669,671],{"id":670},"saml-20","SAML 2.0",[446,673,674,680],{},[449,675,676,677,679],{},"In Relic, add a ",[464,678,671],{}," provider with the identity provider's metadata URL, or paste\nits metadata XML.",[449,681,682,683,686,687,690],{},"Give the identity provider Relic's metadata URL,\n",[420,684,685],{},"https:\u002F\u002Frelic.example.com\u002Fapi\u002Fv1\u002Fsso\u002F\u003Cname>\u002Fmetadata",". It names Relic's entity ID (the\nsame URL), the assertion consumer service (",[420,688,689],{},"...\u002Fapi\u002Fv1\u002Fsso\u002F\u003Cname>\u002Facs",", HTTP-POST) and the\ncertificate Relic generates for the provider.",[416,692,693,694,697,698,701,702,705],{},"Relic signs its requests and accepts only signed responses or assertions that answer one of\nthem: no replays, and no sign-ins the identity provider starts. It decrypts encrypted\nassertions. The username is the NameID, or the ",[464,695,696],{},"Username attribute","; the email comes from\n",[420,699,700],{},"email"," or ",[420,703,704],{},"mail",".",[486,707,709],{"className":488,"code":708,"language":490,"meta":491,"style":491},"apiVersion: relic.build\u002Fv1\nkind: IdentityProvider\nmetadata:\n  name: adfs\nspec:\n  displayName: Corp account\n  enabled: true\n  groupsClaim: http:\u002F\u002Fschemas.microsoft.com\u002Fws\u002F2008\u002F06\u002Fidentity\u002Fclaims\u002Fgroups\n  saml:\n    metadataUrl: https:\u002F\u002Fadfs.example.com\u002FFederationMetadata\u002F2007-06\u002FFederationMetadata.xml\n",[420,710,711,719,727,733,742,748,756,764,773,780],{"__ignoreMap":491},[495,712,713,715,717],{"class":497,"line":498},[495,714,502],{"class":501},[495,716,506],{"class":505},[495,718,510],{"class":509},[495,720,721,723,725],{"class":497,"line":513},[495,722,516],{"class":501},[495,724,506],{"class":505},[495,726,521],{"class":509},[495,728,729,731],{"class":497,"line":524},[495,730,527],{"class":501},[495,732,530],{"class":505},[495,734,735,737,739],{"class":497,"line":533},[495,736,536],{"class":501},[495,738,506],{"class":505},[495,740,741],{"class":509}," adfs\n",[495,743,744,746],{"class":497,"line":544},[495,745,547],{"class":501},[495,747,530],{"class":505},[495,749,750,752,754],{"class":497,"line":552},[495,751,555],{"class":501},[495,753,506],{"class":505},[495,755,560],{"class":509},[495,757,758,760,762],{"class":497,"line":563},[495,759,566],{"class":501},[495,761,506],{"class":505},[495,763,572],{"class":571},[495,765,766,768,770],{"class":497,"line":575},[495,767,588],{"class":501},[495,769,506],{"class":505},[495,771,772],{"class":509}," http:\u002F\u002Fschemas.microsoft.com\u002Fws\u002F2008\u002F06\u002Fidentity\u002Fclaims\u002Fgroups\n",[495,774,775,778],{"class":497,"line":585},[495,776,777],{"class":501},"  saml",[495,779,530],{"class":505},[495,781,782,785,787],{"class":497,"line":596},[495,783,784],{"class":501},"    metadataUrl",[495,786,506],{"class":505},[495,788,789],{"class":509}," https:\u002F\u002Fadfs.example.com\u002FFederationMetadata\u002F2007-06\u002FFederationMetadata.xml\n",[416,791,792],{},"SAML needs Relic served over HTTPS.",[441,794,796],{"id":795},"accounts-and-groups","Accounts and groups",[798,799,800,813],"table",{},[801,802,803],"thead",{},[804,805,806,810],"tr",{},[807,808,809],"th",{},"Setting",[807,811,812],{},"Effect",[814,815,816,829,844],"tbody",{},[804,817,818,826],{},[819,820,821,822,825],"td",{},"Create users on their first sign-in (",[420,823,824],{},"autoCreateUsers",")",[819,827,828],{},"An unknown user gets an account, in the groups new users join. Otherwise only existing accounts sign in.",[804,830,831,837],{},[819,832,833,834,825],{},"Username claim (",[420,835,836],{},"usernameClaim",[819,838,839,840,843],{},"The username's claim or attribute; ",[420,841,842],{},"preferred_username"," (OIDC) or the NameID (SAML) when empty.",[804,845,846,852],{},[819,847,848,849,825],{},"Groups claim (",[420,850,851],{},"groupsClaim",[819,853,854],{},"The user's groups. Each sign-in sets membership to exactly the named Relic groups, ignoring case and unknown groups. Memberships an administrator set stay.",[416,856,857,858,861],{},"An email that is not a single address, such as ",[420,859,860],{},"alice@example.com",", is ignored and logged: a\nnew account gets no email, and an existing one keeps its own.",[416,863,864,865,868,869,705],{},"Make a group's members administrators or viewers in ",[464,866,867],{},"Administration → Groups",". Every sign-in\nthrough a provider, refused or not, is audited as ",[420,870,871],{},"sso.sign-in",[873,874,875],"style",{},"html pre.shiki code .smKOL, html code.shiki .smKOL{--shiki-light:#E53935;--shiki-default:#116329;--shiki-dark:#7EE787}html pre.shiki code .sWneD, html code.shiki .sWneD{--shiki-light:#39ADB5;--shiki-default:#1F2328;--shiki-dark:#E6EDF3}html pre.shiki code .sasMN, html code.shiki .sasMN{--shiki-light:#91B859;--shiki-default:#0A3069;--shiki-dark:#A5D6FF}html pre.shiki code .sH4kE, html code.shiki .sH4kE{--shiki-light:#FF5370;--shiki-default:#0550AE;--shiki-dark:#79C0FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .seIyd, html code.shiki .seIyd{--shiki-light:#E2931D;--shiki-default:#953800;--shiki-dark:#FFA657}html pre.shiki code .smky3, html code.shiki .smky3{--shiki-light:#91B859;--shiki-default:#0550AE;--shiki-dark:#79C0FF}",{"title":491,"searchDepth":513,"depth":513,"links":877},[878,879,880],{"id":443,"depth":513,"text":444},{"id":670,"depth":513,"text":671},{"id":795,"depth":513,"text":796},"Users sign in with their identity provider's account, through OpenID Connect or SAML.","md",null,{},true,{"title":285,"description":881},"jrlL9ISnoqNoQZJKgF2mKtfYGkFtgc9tm8JYOZkrAAo",[889,891],{"title":281,"path":282,"stem":283,"description":890,"children":-1},"A record of setting changes, sign-ins, tokens and blocked downloads, with who acted.",{"title":289,"path":290,"stem":291,"description":892,"children":-1},"Let your identity provider manage Relic's single sign-on users and groups through SCIM 2.0.",1793857358697]