Repository navigation
SAML Audience config update - #313
Conversation
Rewrite the Okta guide around the current Okta Admin Console flow (create app integration, configure SAML, attribute statements, assignments, metadata details) and replace the Okta Classic and 2018-era NeuVector screenshots with current ones. Document the audience URI on all three SAML pages: NeuVector derives it from its SAML Redirect URI and does not expose it as a setting, so the Okta Audience URI (SP Entity ID), the Azure Identifier (Entity ID) and the AD FS relying party trust identifier all take that same value. Also update the Azure and AD FS pages to the current NeuVector SAML Settings screenshot and describe the Group Claim, Default Role and "Add to Top" group role map that replaced the old Admin/Reader/CI role map fields. The replaced screenshots exposed a console IP and port, an Okta org URL, an internal AD FS FQDN and a signing certificate. Addresses of consoles and IdP identifiers in the new screenshots are replaced with placeholders. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A user whose global role is none and who has no namespace role fails authorization after a successful authentication, so state on the Okta, Azure AD and AD FS pages that a role must come from either the default role or the group role map. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
sunilarjun
left a comment
sunilarjun
left a comment
There was a problem hiding this comment.
Thanks for updating @leotseng-suse! I've left review comments below but only in the docs next version pages, the same updates need to be applied to the respective counterpart pages in the versioned_docs/version-5.6 pages.
Also noting from the related issue comment the changes are also in the 5.5 and 5.4 versions, do the 5.5/5.4 docs versions also need the changes applied there?
Okta: shift the headings up one level so the page starts at H2, split the SAML Redirect URI prerequisite into a bullet with a sub-bullet, and merge the two Configure SAML notes into one. Azure AD and ADFS: switch the unordered lists to "-" bullets and bold the "Add to Top" button name.
The audience URI behaviour and the role requirement apply to 5.5 and 5.4 as well, so bring their Okta, Azure AD and ADFS pages in line with 5.6. Also retires the legacy screenshots that showed a real console address and signing certificate (azure6-8.png, nv_adfs1.png, okta.png, saml.png, saml1.png, setting.png) and fixes a "Kubernetess" typo in the ADFS page.
@sunilarjun Yes, I also updated the 5.5 and 5.4 versions. Please help review them. Thank you. |
Signed-off-by: Sunil Singh <sunil.singh@suse.com>
sunilarjun
left a comment
sunilarjun
left a comment
There was a problem hiding this comment.
@leotseng-suse Thank you for addressing the changes and updating v5.5/v5.4. I also did some updates to fix header levels, remove extra whitespace and extra line breaks in this reference commit. Noting I will update in product docs asap with the changes here.
No description provided.