diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx index a0b299d51..7d4cbe2d7 100644 --- a/src/components/NavigationDocs.jsx +++ b/src/components/NavigationDocs.jsx @@ -350,12 +350,48 @@ export const docsNavigation = [ title: 'Single Sign-On', href: '/manage/team/single-sign-on', isOpen: false, - // links: [ - // { title: 'Authentik', href: '/manage/team/single-sign-on/authentik' }, - // { title: 'Keycloak', href: '/manage/team/single-sign-on/keycloak' }, - // { title: 'Auth0', href: '/manage/team/single-sign-on/auth0' }, - // { title: 'JumpCloud', href: '/manage/team/single-sign-on/jumpcloud' }, - // ] + links: [ + { + title: 'Authentik', + href: '/manage/team/single-sign-on/authentik', + }, + { + title: 'Keycloak', + href: '/manage/team/single-sign-on/keycloak', + }, + { + title: 'JumpCloud', + href: '/manage/team/single-sign-on/jumpcloud', + }, + { + title: 'Auth0', + href: '/manage/team/single-sign-on/auth0', + }, + { + title: 'Duo Security', + href: '/manage/team/single-sign-on/duo-security', + }, + { + title: 'Zitadel', + href: '/manage/team/single-sign-on/zitadel', + }, + { + title: 'cidaas', + href: '/manage/team/single-sign-on/cidaas', + }, + { + title: 'AWS Cognito', + href: '/manage/team/single-sign-on/aws-cognito', + }, + { + title: 'Zoho', + href: '/manage/team/single-sign-on/zoho', + }, + { + title: 'IIJ ID', + href: '/manage/team/single-sign-on/iij-id', + }, + ], }, ], }, diff --git a/src/pages/manage/team/add-users-to-your-network.mdx b/src/pages/manage/team/add-users-to-your-network.mdx index 426ae26fb..e77b7f6bc 100644 --- a/src/pages/manage/team/add-users-to-your-network.mdx +++ b/src/pages/manage/team/add-users-to-your-network.mdx @@ -25,9 +25,7 @@ The domains of the private category are the ones that are automatically grouped Public domains are the ones of the public email providers like Gmail. - It might happen (unlikely) that the domain classification system didn't classify your company's domain as private. - Our system was unsure about your domain and assigned an unclassified or public category to be on the safe side. - Just email us at [hello@netbird.io](mailto:hello@netbird.io) or ping us on [Slack](/slack-url) to fix this. + It might happen (unlikely) that the domain classification system didn't classify your company's domain as private. Our system was unsure about your domain and assigned an unclassified or public category to be on the safe side. Just email us at [hello@netbird.io](mailto:hello@netbird.io) or ping us on [Slack](/slack-url) to fix this. ## Direct user invites @@ -35,26 +33,25 @@ As the name stands, this way of inviting users is straightforward and works thro To invite a new user, proceed to `Team` then select the `Users` tab and click the button. A window will appear, allowing you to specify the name and email address of the user you want to invite. Optionally, you could select a set of groups with which you want this user to be associated. +On a self-hosted installation the same button reads `Add User`, and it only appears when [local user management](/selfhosted/identity-providers/local) is enabled. If you have [disabled local authentication](/selfhosted/identity-providers/disable-local-authentication), the button is disabled and users have to come from your IdP instead. + The invited users will receive an email invitation that they have to confirm. After logging in to the system, they will join your network automatically.

- high-level-dia + The Invite User dialog with name, email, and group fields

- If a user already has a NetBird account, you can't invite them. - This is a limitation that is likely to be removed in future versions. + If a user already has a NetBird account, you can't invite them. The invite is rejected with `can't invite a user with an existing NetBird account`. ## Identity Provider (IdP) Sync -NetBird's IdP-Sync automates user access management by integrating with your IdP and automatically -provisioning users and groups. You can enable this feature from the `Users` tab by clicking the `Identity Provider Sync` -button. +NetBird's IdP-Sync automates user access management by integrating with your IdP and automatically provisioning users and groups. You configure it from the `Integrations` page, on the `Identity Provider Sync` tab.

- idp-sync-reference + The Identity Provider Sync tab on the Integrations page

See the [Provision Users and Groups From Your Identity Provider](/manage/team/idp-sync) section for more details. diff --git a/src/pages/manage/team/approve-users.mdx b/src/pages/manage/team/approve-users.mdx index e96ed584f..24bdf8acf 100644 --- a/src/pages/manage/team/approve-users.mdx +++ b/src/pages/manage/team/approve-users.mdx @@ -1,26 +1,39 @@ import {Note} from "@/components/mdx"; # Approve users -The user approval feature enhances security by requiring manual administrator approval before a user can join your NetBird organization via domain matching. -New NetBird Cloud accounts have user approval enabled by default. + +NetBird groups people by email domain. When someone signs up with an address at your company's private domain, they land in your organization automatically, without anyone inviting them. That is [domain matching](/manage/team/add-users-to-your-network#indirect-user-invites), and it is convenient right up until a contractor, a former employee with a lingering mailbox, or anyone who can receive mail at your domain signs up and joins your network. + +User approval closes that gap. With it on, a user who arrives through domain matching is held until an administrator approves them. New NetBird Cloud accounts have it enabled by default, and leaving it on is the safer setting. ## Require user approval Navigate to the Dashboard's `Settings` page and the `Authentication` tab and enable or disable `User Approval Required`. -- **Enabled**: Require manual approval for new users joining via domain matching. Users will be blocked until approved. Learn how to approve or reject users in the section [below](#approve-or-reject-user). -- **Disabled**: Manual approval for new users is not required. Users joining via domain matching will be automatically added to the organization. +- **Enabled** (recommended): users arriving through domain matching are blocked until an administrator approves them. See [Approve or reject user](#approve-or-reject-user) for what to do with the queue. +- **Disabled**: anyone who signs up with an email address at your domain joins the organization immediately, with no review.

- netbird-authentication-settings-approval + The User Approval Required toggle on the Authentication tab of Settings

+## What a pending user sees +Until an administrator approves them, the user can sign in but can't reach the dashboard. They get a `User Approval Pending` screen telling them their account is pending approval from an administrator. They hold the `Pending` status in the `Users` table until you act on them. + ## Approve or reject user To approve a user, navigate to the [Users Page](https://app.netbird.io/team/users) and click the `Approve` or `Reject` button on the right side of the users table.

- netbird-user-approval + Approve and Reject buttons on a pending user row in the Users table

+When several people are waiting, the `Pending Approval` button above the table filters it down to just those users, and carries a badge with the number outstanding. The button only appears while at least one user is waiting. + + + `Reject` is permanent. It removes the user from the account and can't be undone. Use `Block` instead if you want to keep the user on the account but deny access. + + +The `Approve` and `Reject` buttons only render for roles that can update users, which means `Owner` and `Admin`. A `Network Admin` has read-only access to the `Team` tab and won't see them. See [User Roles](/manage/team/user-roles) for the full breakdown. + ## Get started
diff --git a/src/pages/manage/team/auto-offboard-users.mdx b/src/pages/manage/team/auto-offboard-users.mdx index e53541843..deda4789e 100644 --- a/src/pages/manage/team/auto-offboard-users.mdx +++ b/src/pages/manage/team/auto-offboard-users.mdx @@ -1,20 +1,17 @@ # Automatically Offboard Team Members from NetBird -[NetBird's IdP-Sync integration](https://docs.netbird.io/manage/team/idp-sync) simplifies offboarding team members, enhancing -security and efficiency. With this integration, you can automatically revoke access when users leave the company, when -temporary access for a freelancer ends after project completion, or when a seasonal employee's contract concludes. -Likewise, you can use this integration to restrict access to specific resources or environments when a project finishes. -For instance, you can limit network and resource access when a team member is removed from a group or when an entire group -is deleted from your Identity Provider. +Offboarding is where manual user management fails quietly. Someone leaves, their accounts get closed one by one, and the VPN is the one everybody forgets. [IdP-Sync](/manage/team/idp-sync) removes that step: delete the user in your identity provider and NetBird drops them too. + +The same applies to narrower changes. Remove someone from a group, or delete the group entirely, and any network access that depended on that group goes with it. That covers a freelancer whose project ended, a seasonal contract running out, or a team member moving off a system they no longer need. ## Removing Team Members In this tutorial, we will focus on `user_01`, `user_02`, and `user_03`. From NetBird's `Users` dashboard, you can see that `user_01` is part of the `IT Administrators` group, while `user_02` and `user_03` belong to the `Staging` group. -![NetBird Users](/docs-static/img/manage/team/auto-offboard-users/GT3eAeU.png) +![The NetBird Users table showing the three example users and their groups](/docs-static/img/manage/team/auto-offboard-users/GT3eAeU.png) -To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](https://docs.netbird.io/manage/team/idp-sync/microsoft-entra-id-sync). +To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](/manage/team/idp-sync/microsoft-entra-id-sync). Next, locate the user you want to offboard in your IdP's user management section. Let’s say you want to revoke access to `user_01`, in that case, you will need to select it and click the `Delete` button as shown below. @@ -25,7 +22,9 @@ After deletion, click the `Refresh` button to confirm that the user is no longer ![IdP Confirm Deletion](/docs-static/img/manage/team/auto-offboard-users/LJ6QHRV.png) -Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to the `Integrations` screen in the NetBird admin console and click the corresponding integration button to manually trigger the synchronization. +Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to `Integrations` in the NetBird dashboard, open the `Identity Provider Sync` tab, and trigger the synchronization manually. + +Manual sync is only available for the API-based integrations, Google Workspace and Microsoft Entra ID via API, because NetBird pulls from those providers. SCIM-based integrations such as Okta, JumpCloud, Keycloak, and IIJ ID are push-based: the provider sends changes to NetBird, so there is nothing to trigger from the NetBird side and deprovisioning lands as soon as your IdP pushes it. ![NetBird Integrations Force Sync](/docs-static/img/manage/team/auto-offboard-users/ogiiUeT.png) @@ -44,7 +43,6 @@ Let's say the current project is finished, and you no longer want members of the ![IdP Delete Group](/docs-static/img/manage/team/auto-offboard-users/TOZjFKC.png) -Once the changes synchronize in NetBird, users and their group memberships will be updated; therefore, -[network access associated with that group](https://docs.netbird.io/manage/access-control/manage-network-access) will automatically be revoked. +Once the changes synchronize in NetBird, users and their group memberships will be updated; therefore, [network access associated with that group](/manage/access-control/manage-network-access) will automatically be revoked. ![NetBird No Group](/docs-static/img/manage/team/auto-offboard-users/NKabmN6.png) \ No newline at end of file diff --git a/src/pages/manage/team/entra-id-app-enablement.mdx b/src/pages/manage/team/entra-id-app-enablement.mdx index f085576e6..b122188a2 100644 --- a/src/pages/manage/team/entra-id-app-enablement.mdx +++ b/src/pages/manage/team/entra-id-app-enablement.mdx @@ -2,29 +2,36 @@ import {Note} from "@/components/mdx"; # Enable NetBird for Microsoft Entra ID -Before your organization can use Microsoft Entra ID features with NetBird — such as user provisioning, group sync, or single sign-on — you need to enable the NetBird enterprise application in your Entra ID tenant and grant admin consent. +Before your organization can use Microsoft Entra ID features with NetBird, such as user provisioning, group sync, or single sign-on, you need to enable the NetBird enterprise application in your Entra ID tenant and grant admin consent. ## Prerequisites - A Microsoft Entra ID tenant -- An account with **Global Administrator** or **Cloud Application Administrator** role +- An account with the **Privileged Role Administrator** or **Global Administrator** role + + + **Cloud Application Administrator may not be enough.** Microsoft allows that role to grant consent for any API *except* Microsoft Graph application permissions. NetBird's provisioning and group sync read directory data through Microsoft Graph, so if the consent screen lists Graph application permissions, the grant has to come from a **Privileged Role Administrator** or a **Global Administrator**. + ## Step 1: Find the NetBird Enterprise Application -1. Sign in to the [Azure portal](https://portal.azure.com) -2. Navigate to **Home** → **Microsoft Entra ID** → **Enterprise Applications** +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) +2. Navigate to **Entra ID** → **Enterprise apps** → **All applications** 3. Search for the application with Application ID: `7a7538de-b7ed-4e49-befe-edbe74d5e0a1` 4. Select the **NetBird** application from the results +You can reach the same blade from the [Azure portal](https://portal.azure.com) under +**Microsoft Entra ID** → **Enterprise applications**. +

Find NetBird in Enterprise Applications

## Step 2: Grant Admin Consent -1. In the NetBird application overview, click **Permissions** in the left menu -2. Click **Grant admin consent for Default Directory** -3. Review the requested permissions and confirm +1. In the NetBird application overview, select **Permissions** under **Security** +2. Review the requested permissions carefully, then click **Grant admin consent for ``** +3. Confirm the consent prompt

Grant admin consent for NetBird diff --git a/src/pages/manage/team/idp-sync/embedded/keycloak-sync.mdx b/src/pages/manage/team/idp-sync/embedded/keycloak-sync.mdx index f87b8e7cd..23754b730 100644 --- a/src/pages/manage/team/idp-sync/embedded/keycloak-sync.mdx +++ b/src/pages/manage/team/idp-sync/embedded/keycloak-sync.mdx @@ -2,17 +2,12 @@ import {Note} from "@/components/mdx"; # Provision Users and Groups From Keycloak (Embedded IdP) -Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO), -multi-factor authentication (MFA), user federation, and centralized identity management to help organizations -secure and manage access to their applications and resources. +Keycloak is an open source identity and access management solution that provides features like single sign-on (SSO), multi-factor authentication (MFA), user federation, and centralized identity management to help organizations secure and manage access to their applications and resources. -NetBird's Keycloak integration enhances user management by allowing you to utilize Keycloak as your identity provider. -This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management -to your applications and resources. +Connecting Keycloak to NetBird lets your existing Keycloak users and groups drive network access. Users sign in with the credentials they already have, including any MFA you enforce in Keycloak, and group membership flows into NetBird so your access policies follow it. - Before creating this integration, ensure you have a Keycloak connector configured in your embedded IdP. - If not, refer to the [Identity Providers](/selfhosted/identity-providers/keycloak) documentation to set it up. + Before creating this integration, ensure you have a Keycloak connector configured in your embedded IdP. If not, refer to the [Identity Providers](/selfhosted/identity-providers/keycloak) documentation to set it up. ## Prerequisites @@ -33,7 +28,7 @@ To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Select your **Keycloak** identity provider connector for this integration and click **Continue** to proceed.

- select-identity-provider + The connector picker with the Keycloak identity provider selected

This will open a pop-up window featuring a user-friendly wizard to guide you through the configuration process. @@ -200,8 +195,7 @@ After completing the initial sync, you can verify that users and groups have bee ![NetBird Verify Users](/docs-static/img/manage/team/idp-sync/keycloak-sync/netbird-verify-users.png) - SCIM provisioning will manage only resources that are created through Keycloak. Any resources created directly in - NetBird will not be managed by SCIM. + SCIM provisioning will manage only resources that are created through Keycloak. Any resources created directly in NetBird will not be managed by SCIM. diff --git a/src/pages/manage/team/idp-sync/google-workspace-sync.mdx b/src/pages/manage/team/idp-sync/google-workspace-sync.mdx index ecaa867e1..dfe556f76 100644 --- a/src/pages/manage/team/idp-sync/google-workspace-sync.mdx +++ b/src/pages/manage/team/idp-sync/google-workspace-sync.mdx @@ -4,10 +4,7 @@ communication. Notably, its [identity management](https://cloud.google.com/architecture/identity/overview-google-authentication) features streamline user authentication and access control, ensuring efficiency and security across your organization. -NetBird's Google Workspace integration enhances user management capabilities by synchronizing users and groups from -Google Workspace to NetBird. You can utilize these synchronized groups to configure your network, establish network -access policies, and automate onboarding and offboarding processes, adding significant value to your organizational -workflow and security posture. +Connecting Google Workspace to NetBird syncs your users and groups across, so the org chart you already maintain in Workspace becomes the basis for network access. Point a policy at a synced group and onboarding and offboarding stop being separate NetBird chores. The integration process involves two complementary services: Google Workspace and Google Cloud Platform (GCP). Google Workspace serves as your Identity Provider (IdP), managing user and group identities and providing Single Sign-On (SSO) @@ -110,7 +107,7 @@ Navigate to [https://console.cloud.google.com/apis/credentials](https://console. ![Google Workspace Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/rDU0Puv.png) Complete the form with the supplied values: -* `NerBird` for the service account name +* `NetBird` for the service account name * `netbird` for the service account ID Click `DONE` when ready. @@ -249,7 +246,7 @@ The next screen, should be similar the following one, verifying that the integra To verify the integration is working correctly, you can also navigate to `Team` > `Users`. Here, you should see your synchronized Google Workspace users listed. -![NetBird Users](/docs-static/img/manage/team/idp-sync/google-workspace-sync/5AcaIqW.png) +![The NetBird Users table listing users synced from Google Workspace](/docs-static/img/manage/team/idp-sync/google-workspace-sync/5AcaIqW.png) The users should be the same listed in Google Workspace Admin console: diff --git a/src/pages/manage/team/idp-sync/index.mdx b/src/pages/manage/team/idp-sync/index.mdx index b287902e6..020bf53f3 100644 --- a/src/pages/manage/team/idp-sync/index.mdx +++ b/src/pages/manage/team/idp-sync/index.mdx @@ -1,26 +1,18 @@ # Provision Users and Groups From Your Identity Provider

- supported-identity-providers

-Managing private network access in a business environment is a critical yet often cumbersome task. -As companies grow and evolve, the manual process of granting access for new employees and revoking it for -departing ones becomes increasingly time-consuming and error-prone. This challenge strains IT resources, poses significant -security risks, and impacts productivity. +Every time someone joins your company you add them to NetBird by hand, and every time someone leaves you have to remember to remove them. Miss one and a former employee keeps network access. Your identity provider already knows who works here and which teams they belong to, so IdP-Sync makes it the source of truth and keeps NetBird in step with it. -NetBird's IdP-Sync automates user access management to private networks by integrating with your identity provider (IdP) -and automatically provisioning users and groups. This integration ensures that changes to groups and users are -synchronized from your identity provider to NetBird, granting appropriate network access to new users and immediately -revoking access for departing employees. +IdP-Sync copies users and groups from your identity provider (IdP) into NetBird and keeps them current. Those synced groups then drive the rest of your configuration: you can point [access control policies](/manage/access-control/manage-network-access#creating-policies) or [DNS distribution](/manage/dns#distribution-groups) at a group and let membership follow your IdP. -NetBird allows you to use synchronized groups to create [access control policies](/manage/access-control/manage-network-access#creating-policies), -or update network configurations like [DNS](/manage/dns#distribution-groups), -eliminating the need for manual grouping. +There are two things to understand before picking a provider: which direction the sync runs, and what IdP-Sync will and will not manage for you. Both are covered below, then you pick your provider from the table. - This feature is only available in the cloud version of NetBird in the [Team plan](https://netbird.io/pricing) and above. + IdP-Sync is available on NetBird Cloud in the [Team plan](https://netbird.io/pricing) and above. It is also available on self-hosted deployments running a [Commercial License](https://netbird.io/pricing#on-prem) with the embedded IdP, which use a separate set of setup guides listed under Self-hosted. This video guide walks you through an example integration with Microsoft Entra ID, covering both user onboarding and @@ -28,46 +20,58 @@ offboarding scenarios: -## Supported Identity Providers - -NetBird provides native support for syncing with the most popular identity providers. Pick yours below for detailed setup and configuration steps. - -### Entra ID (API) +## How syncing works -Provision users and groups from Microsoft Entra ID through the Graph API. See [Entra ID (API) setup](/manage/team/idp-sync/microsoft-entra-id-sync). +NetBird syncs in one of two directions, and which one you get depends on the provider. -### Entra ID (SCIM) +**Pull, over the provider's API.** NetBird holds credentials for your IdP and reads users and groups from it on a schedule. You can also trigger a sync by hand from the dashboard. Google Workspace and Entra ID (API) work this way. -Provision users and groups from Microsoft Entra ID over SCIM. See [Entra ID (SCIM) setup](/manage/team/idp-sync/microsoft-entra-id-scim-sync). +**Push, over SCIM.** SCIM, the System for Cross-domain Identity Management, is a standard protocol for provisioning users and groups between systems. Your IdP sends changes to NetBird as they happen, using a SCIM endpoint and token that NetBird issues. There is no manual sync to trigger, because NetBird is the receiver. Entra ID (SCIM), Okta, JumpCloud, and any generic SCIM provider work this way. -### Okta +The practical difference is timing and troubleshooting. A pull integration is late by at most one sync cycle and you can force it. A push integration is near-immediate, but when it stalls you fix it in your IdP's provisioning logs, not in NetBird. -Provision users and groups from Okta. See [Okta setup](/manage/team/idp-sync/okta-sync). +## Supported Identity Providers -### Google Workspace +NetBird supports the most common identity providers directly. Pick yours from the table for the full setup guide. -Provision users and groups from Google Workspace. See [Google Workspace setup](/manage/team/idp-sync/google-workspace-sync). +| Provider | Direction | Set up in NetBird with | +| --- | --- | --- | +| [Google Workspace](/manage/team/idp-sync/google-workspace-sync) | Pull (API) | `Connect Google Workspace` | +| [Entra ID (API)](/manage/team/idp-sync/microsoft-entra-id-sync) | Pull (API) | `Connect Entra ID (API)` | +| [Entra ID (SCIM)](/manage/team/idp-sync/microsoft-entra-id-scim-sync) | Push (SCIM) | `Connect Entra ID (SCIM)` | +| [Okta](/manage/team/idp-sync/okta-sync) | Push (SCIM) | `Connect Okta` | +| [JumpCloud](/manage/team/idp-sync/jumpcloud-sync) | Push (SCIM) | `Connect Jumpcloud` | +| [Keycloak](/manage/team/idp-sync/keycloak-sync) | Push (SCIM) | `Connect Generic SCIM` | +| [IIJ ID](/manage/team/idp-sync/iij-id-sync) | Push (SCIM) | `Connect Generic SCIM` | -### JumpCloud +Keycloak and IIJ ID have no dedicated card on the `Identity Provider Sync` tab. Both are set up through `Connect Generic SCIM`, and their linked guides walk through that path. -Provision users and groups from JumpCloud. See [JumpCloud setup](/manage/team/idp-sync/jumpcloud-sync). + + The dashboard configures one IdP-Sync integration at a time. While one is enabled, the setup buttons on every other card are disabled, so switching providers means disabling the current integration first. + -### Keycloak +## What IdP-Sync does not do -Provision users and groups from Keycloak. See [Keycloak setup](/manage/team/idp-sync/keycloak-sync). +IdP-Sync manages users and group membership. It does not manage anything else, and two boundaries surprise people: -### IIJ ID +- **Roles stay in NetBird.** A synced group never sets a user's NetBird role. If you move someone into an `Administrators` group in your IdP, they do not become a NetBird `Admin`. You assign roles in NetBird, as described in [User Roles](/manage/team/user-roles). +- **Access still comes from policies.** Syncing a group grants no access on its own. A group is only useful once a [policy](/manage/access-control/manage-network-access#creating-policies) references it. -Provision users and groups from IIJ ID over SCIM. See [IIJ ID setup](/manage/team/idp-sync/iij-id-sync). +If you have a handful of users and no group structure worth mirroring, IdP-Sync buys you little. Invite them directly instead, as described in [Add users to your network](/manage/team/add-users-to-your-network). IdP-Sync earns its setup cost when your IdP already carries the group structure you want access to follow. ## Generic SCIM -NetBird provides a way to sync users and groups from any identity provider that supports the SCIM (System for Cross-domain Identity Management) protocol. -SCIM is a standardized protocol that works with most modern identity providers, although configuration varies between providers. - -If your provider is not listed above, contact us at support@netbird.io for assistance with your specific IdP setup. +If your provider is not in the table, it can still work as long as it speaks SCIM. Set it up with `Connect Generic SCIM`, which is the same path the Keycloak and IIJ ID guides follow. Configuration details vary between providers, so contact us at support@netbird.io if you get stuck on yours.

- generic-scim

+ +## In one breath + +- Your IdP already knows who works here and which teams they are on. IdP-Sync makes NetBird follow it. +- Google Workspace and Entra ID (API) **pull** on a schedule, and you can force a sync. Everything else **pushes** + over SCIM the moment your IdP sends a change. +- You get users and group membership. You do not get roles, and you do not get access. +- Point a policy at a synced group, and access follows your IdP from then on. diff --git a/src/pages/manage/team/idp-sync/keycloak-sync.mdx b/src/pages/manage/team/idp-sync/keycloak-sync.mdx index 3ec3df069..02d1c8a7a 100644 --- a/src/pages/manage/team/idp-sync/keycloak-sync.mdx +++ b/src/pages/manage/team/idp-sync/keycloak-sync.mdx @@ -1,12 +1,8 @@ # Provision Users and Groups From Keycloak -Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO), -multi-factor authentication (MFA), user federation, and centralized identity management to help organizations -secure and manage access to their applications and resources. +Keycloak is an open source identity and access management solution that provides features like single sign-on (SSO), multi-factor authentication (MFA), user federation, and centralized identity management to help organizations secure and manage access to their applications and resources. -NetBird's Keycloak integration enhances user management by allowing you to utilize Keycloak as your identity provider. -This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management -to your applications and resources. +Connecting Keycloak to NetBird lets your existing Keycloak users and groups drive network access. Users sign in with the credentials they already have, including any MFA you enforce in Keycloak, and group membership flows into NetBird so your access policies follow it. import {Note} from "@/components/mdx"; @@ -201,8 +197,7 @@ After completing the initial sync, you can verify that users and groups have bee ![NetBird Verify Users](/docs-static/img/manage/team/idp-sync/keycloak-sync/netbird-verify-users.png) - SCIM provisioning will manage only resources that are created through Keycloak. Any resources created directly in - NetBird will not be managed by SCIM. + SCIM provisioning will manage only resources that are created through Keycloak. Any resources created directly in NetBird will not be managed by SCIM. diff --git a/src/pages/manage/team/single-sign-on/auth0.mdx b/src/pages/manage/team/single-sign-on/auth0.mdx index fb7e315f3..ead7fa6b2 100644 --- a/src/pages/manage/team/single-sign-on/auth0.mdx +++ b/src/pages/manage/team/single-sign-on/auth0.mdx @@ -1,38 +1,46 @@ import {Note} from "@/components/mdx"; -# Auth0 on NetBird Cloud +# Auth0 on NetBird Cloud You can use Auth0 as your Identity Provider with NetBird, but it will require some additional configuration steps. Auth0 is a flexible, drop-in solution to add authentication and authorization services to your applications. It's a managed service that offers extensive customization options, developer-friendly APIs, universal login, social identity providers, and advanced security features like anomaly detection and breached password detection. + + Support for OIDC-compliant IdPs is available on the Team plan and higher. The Free plan supports Google, Microsoft, and social logins. + + 1. Access the [Auth0 console](https://manage.auth0.com/) and navigate to Applications > Applications 2. Click **+ Create Application** -3. Enter **NetBird** as the name, select **Single Page Web Applications** as the application type and click **Create** +3. Enter **NetBird** as the name, select **Regular Web Applications** as the application type and click **Create**

- auth0-application-create + The Auth0 Create Application dialog with Regular Web Applications selected

+ + The application type has to be **Regular Web Applications**. NetBird exchanges the authorization code server-side using a Client Secret, which makes this a confidential client. Auth0 treats single-page and native apps as public clients and does not show a Credentials tab for them, so those types never issue the Client Secret you record in step 5. + + 4. On the New Application screen, go to the Settings tab and under Application URIs set the following values: -- Application Login URI: https://app.netbird.io -- Allowed Callback URLs: https://login.netbird.io/login/callback -- Allowed Logout URLs: https://app.netbird.io -- Allowed Web Origins: https://app.netbird.io +- **Application Login URI**: `https://app.netbird.io` +- **Allowed Callback URLs**: `https://login.netbird.io/login/callback` +- **Allowed Logout URLs**: `https://app.netbird.io` +- **Allowed Web Origins**: `https://app.netbird.io`

- auth0-application-configure + The Auth0 Application URIs section filled in with the NetBird callback and logout URLs

-6. Record the **Client ID** and **Client Secret** that Auth0 generates for your application. +5. Record the **Client ID** and **Client Secret** that Auth0 generates for your application. -7. Retrieve Application's **Domain** from the **Basic Information** tab +6. Retrieve Application's **Domain** from the **Basic Information** tab

- auth0-application-domain + The Auth0 Basic Information tab showing the application Domain

-8. Share following with our team. Please use a secure method for sharing the sensitive parts of this information: +7. Share the following with our team. Please use a secure method for sharing the sensitive parts of this information: 1. Application's **Domain**, 2. (sensitive) **Client ID** and **Client Secret**, 3. list of email domains to be registered for this SSO configuration, diff --git a/src/pages/manage/team/single-sign-on/authentik.mdx b/src/pages/manage/team/single-sign-on/authentik.mdx index 03209c03b..a63b44811 100644 --- a/src/pages/manage/team/single-sign-on/authentik.mdx +++ b/src/pages/manage/team/single-sign-on/authentik.mdx @@ -1,65 +1,64 @@ import {Note} from "@/components/mdx"; -# Authentik on NetBird Cloud +# Authentik on NetBird Cloud -You can use Authentik as your Identity Provider with NetBird, but it will require some additional configuration steps. Authentik is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols. +You can use Authentik as your Identity Provider with NetBird, but it will require some additional configuration steps. Authentik is an open source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols. - Support for OIDC-compliant IdPs is available on the Team plan and higher. - The Free plan supports Google, Microsoft, and social logins. + Support for OIDC-compliant IdPs is available on the Team plan and higher. The Free plan supports Google, Microsoft, and social logins. 1. You need to create a new Application and Provider. - Browse to the Applications Administration menu, click on Application, and then click on Create with Provider:

- create-with-provider + The Authentik Applications list with the Create with Provider button

- Name the Application and select a suitable explicit user flow. In the example below, we used NetBird:

- new-application + Naming the Authentik application and choosing an explicit user flow

- Click Next and select the OAuth2/OpenID Provider Type:

- new-application + Selecting OAuth2/OpenID Provider as the Authentik provider type

- Click Next and select an explicit user authorization flow, then take note of the Client ID and Client Secret:

- new-application + The Authentik provider screen showing the Client ID and Client Secret

- Add the following redirect URL and select a signing key:
URL: `https://login.netbird.io/login/callback`

- new-application + Entering the NetBird redirect URL and selecting a signing key in Authentik

- - Click on Advanced protocol settings and ensure that the email, opened, and profile scopes are selected and that Based on the User’s Hash ID is selected for Subject mode: + - Click on Advanced protocol settings and ensure that the `openid`, `email`, and `profile` scopes are selected and that Based on the User’s Hash ID is selected for Subject mode:

- new-application + Authentik Advanced protocol settings with the openid, email, and profile scopes selected

- Click Next on the following two screens and Submit to create the provider and application:

- new-application + The final Authentik confirmation screen before submitting the provider and application

- You should see an application listed as follow:

- list-applications + The new NetBird application listed in Authentik

2. We need to copy the OpenID Configuration URL for the new provider. You can do that by navigating to Providers in the left menu and then selecting the newly created provider. There you should see a windows similar to the following:

- list-providers + The Authentik Providers list showing the OpenID Configuration URL

- Copy the OpenID Configuration URL. diff --git a/src/pages/manage/team/single-sign-on/index.mdx b/src/pages/manage/team/single-sign-on/index.mdx index 53b15b02d..3bfc702e4 100644 --- a/src/pages/manage/team/single-sign-on/index.mdx +++ b/src/pages/manage/team/single-sign-on/index.mdx @@ -2,8 +2,7 @@ import { Note, Button } from '@/components/mdx' # Authenticate to NetBird with Single Sign On (SSO) -NetBird works out of the box with popular Identity Providers (IdPs) such as Google Workspace, Microsoft Entra ID, and Okta, -offering seamless Single Sign-On (SSO) for your users. +NetBird works out of the box with popular Identity Providers (IdPs) such as Google Workspace, Microsoft Entra ID, and Okta, so your users sign in with the credentials they already have. It also supports social logins including Google, GitHub, and Microsoft accounts. @@ -11,17 +10,15 @@ For other OIDC (OpenID Connect)-compliant IdPs like Authentik, Keycloak, JumpClo though some additional configuration is required to complete the integration. - This guide covers the setup for cloud-hosted NetBird. If you are using the self-hosted version, please refer - to the [self-hosted documentation](/selfhosted/identity-providers). + This guide covers the setup for cloud-hosted NetBird. If you are using the self-hosted version, please refer to the [self-hosted documentation](/selfhosted/identity-providers). ## Google, Microsoft, and GitHub -If you're using Google Workspace, Microsoft Entra ID, or a supported social login, you can simply sign in with no extra -setup—just click the appropriate button on the [login page](https://app.netbird.io/): +If you're using Google Workspace, Microsoft Entra ID, or a supported social login, you can simply sign in with no extra setup. Just click the appropriate button on the [login page](https://app.netbird.io/):

- netbird-login + The NetBird login page with Google, Microsoft, and GitHub sign-in buttons

## Okta @@ -32,7 +29,7 @@ setup—just click the appropriate button on the [login page](https://app.netbir The detailed setup steps for Okta integration, including SSO configuration and user/group provisioning, are available in our [Provision Users and Groups from Okta](/manage/team/idp-sync/okta-sync) documentation. -NetBird's Okta integration enhances user management by allowing you to utilize Okta as your identity provider. This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management to your applications and resources. +Connecting Okta to NetBird lets your existing Okta users sign in with the credentials they already have, including any MFA you enforce in Okta, and lets Okta group membership drive your NetBird access policies. @@ -42,19 +39,18 @@ For OIDC-compliant Identity Providers such as **Authentik**, **Keycloak**, **Jum to integrate with NetBird. Below are the steps to set up different OIDC-compliant IdPs with NetBird. - Support for OIDC-compliant IdPs is available on the Team plan and higher. - The Free plan supports Google, Microsoft, and social logins. + Support for OIDC-compliant IdPs is available on the Team plan and higher. The Free plan supports Google, Microsoft, and social logins. ### Authentik -[Authentik](https://goauthentik.io/) is an open-source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols. Authentik includes audit logging, password policies, and full API access for automation. +[Authentik](https://goauthentik.io/) is an open source identity provider focused on flexibility and security. It serves as a self-hosted alternative to commercial solutions like Okta and Auth0, providing single sign-on (SSO), multi-factor authentication (MFA), access policies, user management, and support for SAML and OIDC protocols. Authentik includes audit logging, password policies, and full API access for automation. ### Keycloak -[Keycloak](https://www.keycloak.org/) is an open-source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IDP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols. +[Keycloak](https://www.keycloak.org/) is an open source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IdP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols. @@ -72,13 +68,13 @@ to integrate with NetBird. Below are the steps to set up different OIDC-complian ### Duo Security -[Duo Security](https://duo.com/) is a cloud-based security platform that provides secure access through single sign-on (SSO), multi-factor authentication (MFA), and device trust. Duo offers comprehensive identity verification and access policies to protect applications and data, with a focus on zero trust security architecture. +[Duo Security](https://duo.com/) is a cloud-based security platform that provides secure access through single sign-on (SSO), multi-factor authentication (MFA), and device trust. Duo offers comprehensive identity verification and access policies to protect applications and data, with a focus on Zero Trust security architecture. ### Zitadel -[Zitadel](https://zitadel.com/) is an open-source, API-first identity infrastructure platform built with multi-tenancy at its core. It provides single sign-on, passwordless authentication, role-based access control, and supports OpenID Connect, OAuth 2.0, and SAML. +[Zitadel](https://zitadel.com/) is an open source, API-first identity infrastructure platform built with multi-tenancy at its core. It provides single sign-on, passwordless authentication, role-based access control, and supports OpenID Connect, OAuth 2.0, and SAML. diff --git a/src/pages/manage/team/single-sign-on/jumpcloud.mdx b/src/pages/manage/team/single-sign-on/jumpcloud.mdx index c714de202..8284ae731 100644 --- a/src/pages/manage/team/single-sign-on/jumpcloud.mdx +++ b/src/pages/manage/team/single-sign-on/jumpcloud.mdx @@ -1,17 +1,21 @@ import {Note} from "@/components/mdx"; -# JumpCloud on NetBird Cloud +# JumpCloud on NetBird Cloud You can use JumpCloud as your Identity Provider with NetBird, but it will require some additional configuration steps. JumpCloud is a cloud-based directory platform that provides identity, access, and device management in a unified solution. It offers single sign-on, multi-factor authentication, directory services, device management, and network access control, providing a comprehensive approach to managing users, devices, and applications from a single platform. -1. Access the JumpCloud and navigate to USER AUTHENTICATION > SSO Applications + + Support for OIDC-compliant IdPs is available on the Team plan and higher. The Free plan supports Google, Microsoft, and social logins. + + +1. In the JumpCloud Admin Console, navigate to **Access** > **SSO Applications** 2. Click + Add New Application, select Custom Application and click Next 3. Enable Manage Single Sign-On (SSO), select Configure SSO with OIDC and click Next

- jumpcloud + The JumpCloud custom application dialog with Configure SSO with OIDC selected

4. Add NetBird as Display Label and click Next. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal. @@ -19,25 +23,30 @@ You can use JumpCloud as your Identity Provider with NetBird, but it will requir 5. Review the application setting and click Configure Application to proceed

- jumpcloud-idp + The JumpCloud application review screen before configuring the application

6. On the New Application screen, go to the SSO tab and under Endpoint Configuration set the following values: -- Redirect URIs: https://login.netbird.io/login/callback +- **Redirect URIs**: `https://login.netbird.io/login/callback` -- Login URL: https://app.netbird.io +- **Login URL**: `https://app.netbird.io` 7. Under Attribute Mapping enable Email and Profile scopes - Sometimes, the Jumpcloud application configuration will add duplicate attributes, like email and email_verified. The duplicates should be removed. + Sometimes the JumpCloud application configuration adds duplicate attribute mappings. Remove the duplicates so each claim is mapped only once. 8. Go to the User Groups and select the list of groups to which you want to give access to the application and then click activate 9. Record the Client ID and Client Secret that JumpCloud generates for your application. + + JumpCloud shows the Client ID and Secret only once, right after you click activate. Copy them before closing the window, otherwise you have to regenerate the secret. + + + 10. Share your Client ID and Client Secret with our team, along with the region your JumpCloud console is in (US, EU, or India). Please use a secure method for sharing this information. diff --git a/src/pages/manage/team/single-sign-on/keycloak.mdx b/src/pages/manage/team/single-sign-on/keycloak.mdx index a4dc95984..009591420 100644 --- a/src/pages/manage/team/single-sign-on/keycloak.mdx +++ b/src/pages/manage/team/single-sign-on/keycloak.mdx @@ -1,27 +1,31 @@ import {Note} from "@/components/mdx"; -# Keycloak on NetBird Cloud +# Keycloak on NetBird Cloud -You can use Keycloak as your Identity Provider with NetBird, but it will require some additional configuration steps. Keycloak is an open-source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IDP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols. +You can use Keycloak as your Identity Provider with NetBird, but it will require some additional configuration steps. Keycloak is an open source Identity and Access Management solution aimed at modern applications and services. It's one of the most popular self-hosted IdP solutions with extensive documentation and community support. Keycloak provides single sign-on, social login, user federation, fine-grained authorization, and supports OpenID Connect, OAuth 2.0, and SAML 2.0 protocols. + + + Support for OIDC-compliant IdPs is available on the Team plan and higher. The Free plan supports Google, Microsoft, and social logins. + 1. You need to create a new client - Browse to the clients Administration menu and then click in Create client:

- new-client + The Keycloak Clients screen with the Create client button

2. Create a client with the type OpenID Connect and add any client ID and name for the client:

- new-client + Creating a Keycloak client with type OpenID Connect

3. Click Next and enable the following options for Capability config:

- new-client + The Keycloak Capability config step with the required options enabled

4. Click Next and fill the following fields: @@ -30,7 +34,7 @@ You can use Keycloak as your Identity Provider with NetBird, but it will require Web origins: `+`

- new-client + The Keycloak client with the NetBird redirect URI and web origins set

5. Click Save. @@ -38,7 +42,7 @@ You can use Keycloak as your Identity Provider with NetBird, but it will require 6. Next we need to retrieve the secret for the client, you can get that in the Credentials tab for the client:

- new-client + The Keycloak Credentials tab showing the client secret

7. Then, share the following information with the NetBird support team at support@netbird.io: diff --git a/src/pages/manage/team/single-sign-on/zitadel.mdx b/src/pages/manage/team/single-sign-on/zitadel.mdx index ae374ec4c..56f98230d 100644 --- a/src/pages/manage/team/single-sign-on/zitadel.mdx +++ b/src/pages/manage/team/single-sign-on/zitadel.mdx @@ -2,11 +2,10 @@ import {Note} from "@/components/mdx"; # Zitadel on NetBird Cloud -You can use Zitadel as your Identity Provider with NetBird, but it will require some additional configuration steps. Zitadel is an open-source, API-first identity infrastructure platform built with multi-tenancy at its core. It provides single sign-on, passwordless authentication, role-based access control, and supports OpenID Connect, OAuth 2.0, and SAML. +You can use Zitadel as your Identity Provider with NetBird, but it will require some additional configuration steps. Zitadel is an open source, API-first identity infrastructure platform built with multi-tenancy at its core. It provides single sign-on, passwordless authentication, role-based access control, and supports OpenID Connect, OAuth 2.0, and SAML. - Support for OIDC-compliant IdPs is available on the Team plan and higher. - The Free plan supports Google, Microsoft, and social logins. + Support for OIDC-compliant IdPs is available on the Team plan and higher. The Free plan supports Google, Microsoft, and social logins. ## Step 1: Create a New Project (Optional) @@ -18,13 +17,13 @@ You can use Zitadel as your Identity Provider with NetBird, but it will require Log in to your Zitadel console at `https://.zitadel.cloud`. Navigate to **Projects** and click **+ Create New Project**. Enter `NetBird` as the project name and click **Continue**.

- zitadel-create-project + Creating a new project in the Zitadel console

You should see the project dashboard once the project is created.

- zitadel-project-created + The Zitadel project dashboard after the project is created

## Step 2: Create a New Application @@ -34,7 +33,7 @@ Inside your project, click **+ New** to create a new application. Configure the - **Type**: `Web`

- zitadel-create-application + Creating a Zitadel application with type Web

Click **Continue**. @@ -44,7 +43,7 @@ Click **Continue**. Select **Code** as the authentication method. This enables the Authorization Code flow with a client secret.

- zitadel-authentication-method + Selecting Code as the Zitadel authentication method

Click **Continue**. @@ -56,21 +55,21 @@ Set the following redirect settings: - **Post Logout URIs**: `https://app.netbird.io`

- zitadel-redirect-uris + The Zitadel redirect and post logout URIs set to the NetBird endpoints

Click **Continue** to proceed to the review stage. Verify your application settings and click **Create**.

- zitadel-review-application + The Zitadel review screen before creating the application

## Step 5: Copy the Client Credentials -After creation, Zitadel displays the **Client ID** and **Client Secret**. Copy and store these securely — the Client Secret is only shown once. +After creation, Zitadel displays the **Client ID** and **Client Secret**. Copy and store these securely. The Client Secret is only shown once.

- zitadel-client-credentials + Zitadel displaying the Client ID and Client Secret after creation

## Step 6: Share Configuration with NetBird diff --git a/src/pages/manage/team/user-roles.mdx b/src/pages/manage/team/user-roles.mdx index a9a31f1da..1b7143079 100644 --- a/src/pages/manage/team/user-roles.mdx +++ b/src/pages/manage/team/user-roles.mdx @@ -1,6 +1,6 @@ import {Note} from "@/components/mdx" -export const description = "Understand NetBird's user roles — Owner, Admin, Network Admin, Billing Admin, Auditor, and User — what each can access, and how to assign them." +export const description = "Understand NetBird's user roles: Owner, Admin, Network Admin, Billing Admin, Auditor, and User. What each can access, and how to assign them." # User Roles @@ -22,6 +22,7 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a | Activity | ✅ | ✅ | 📖 | ❌ | 📖 | ❌ | | Settings | ✅ | ✅ | 📖 | ✅2 | 📖 | ❌ | | Reverse Proxy | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ | +| Agent Network | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ | | Tenants | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ | | Integrations | ✅ | ✅ | ❌ | ❌ | 📖 | ❌ | @@ -29,7 +30,7 @@ Rows are grouped by what a `Network Admin` can do, from full access down to no a 1 A `User` can only see the peers they own and peers they're allowed to connect to. -2 A `Billing Admin`'s Settings access is limited to **Plans & Billing** and **Invoices**. +2 A `Billing Admin`'s Settings access is limited to `Plans & Billing` and `Invoices`. ## Owner The `Owner` has full access to the account and can manage every aspect of it. There can be only one account owner in NetBird. Owners are the only users who can delete the organization account - see [Delete NetBird account](/manage/settings/delete-account) for more. @@ -38,7 +39,7 @@ The `Owner` has full access to the account and can manage every aspect of it. Th An `Admin` has full access to the account, with two exceptions: administrators can't delete or change the role of the `Owner`, and they can't delete the organization account. ## Network Admin -A `Network Admin` fully manages network configuration - Control Center, Access Control, Network Routing, and DNS. They have read-only access to Peers, Setup Keys, Team, Activity, and Settings, and no access to Reverse Proxy, Tenants, or Integrations. A `Network Admin` can view setup keys but not create them, and can't invite users or create service users. +A `Network Admin` fully manages network configuration - Control Center, Access Control, Network Routing, and DNS. They have read-only access to Peers, Setup Keys, Team, Activity, and Settings, and no access to Reverse Proxy, Agent Network, Tenants, or Integrations. A `Network Admin` can view setup keys but not create them, and can't invite users or create service users. ## Billing Admin A `Billing Admin` manages billing only. They can access `Settings` → `Plans & Billing` and `Settings` → `Invoices`, and have no access to any other part of the account. @@ -50,7 +51,11 @@ An `Auditor` can read every configuration in the account but can't modify anythi A `User` has limited access: they can view the peers they own and other peers they're allowed to connect to. ## Roles and the API -Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role. Every role except `User` can create a personal access token that carries the same permissions as that user's role, so they can interact with the API programmatically. +Roles apply the same way whether a user works in the dashboard or through the [NetBird management API](/api) - a user's permissions over API resources match their role. + +`Owner`, `Admin`, and `Network Admin` can create personal access tokens, which carry the same permissions as the user who owns them. `Auditor` and `User` cannot create a token, not even for themselves, because token creation is a create operation and neither role is granted one. An `Auditor` that needs programmatic read access has to be issued a token by an admin on a service user instead. + +Token expiration must be between 1 and 365 days. ## Roles and identity provider sync