Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OIDC sso topic updates #376

Merged
merged 7 commits into from
Feb 5, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,18 @@
[.task]
== Get Started with OIDC SSO

Prisma Cloud offers a Service Provider initiated SSO capability. Leveraging OpenID Connect https://openid.net/developers/how-connect-works/[OpenID Connect (OIDC)], this option enables Prisma Cloud System Administrators to allow users to sign in to Prisma Cloud with their Identity Provider (IdP) credentials using the *Sign in via SSO* button on the login page. Learn more about setting up SP-initiated SSO below.
Prisma Cloud offers a Service Provider (SP) initiated SSO capability. Leveraging OpenID Connect https://openid.net/developers/how-connect-works/[OpenID Connect (OIDC)], this option enables Prisma Cloud System Administrators to allow users to sign in to Prisma Cloud with their Identity Provider (IdP) credentials using the *Sign in via SSO* option on the login page. Learn more about setting up SP-initiated SSO below.

[CAUTION]
====
To avoid account lockout while making configuration changes, enable administrative users with both local authentication credentials on Prisma Cloud and SSO access. Ensure that each administrator has activated their Palo Alto Networks Customer Support Portal (CSP) account using the Welcome to Palo Alto Networks Support email and set a password to access the portal.
====

image::administration/oidc-sso.png[]

[CAUTION]
[NOTE]
====
To avoid account lockout while making configuration changes, you may enable administrative users with both local authentication credentials on Prisma Cloud and SSO access. Ensure that each administrator has activated their Palo Alto Networks Customer Support Portal (CSP) account using the Welcome to Palo Alto Networks Support email and set a password to access the portal.
The Sign in via SSO button enables login with a configured OIDC SSO provider. To sign in using third party Security Assertion Markup Language (SAML) SSO, use the Identity Provider defined for the SAML integration with the Prisma Cloud tenant.
====

Complete the steps below on the Prisma Cloud console and your IdP to set up OIDC:
Expand All @@ -20,7 +25,7 @@ Complete the steps below on the Prisma Cloud console and your IdP to set up OIDC
image::administration/oidc.png[]
.. Copy the *Audience URI* value. This is a read-only field in the format that uniquely identifies your instance of Prisma Cloud. This value is required to configure OIDC on your IdP.
+
NOTE: The Prisma ID of a tenant is displayed adjacent the OIDC configuration so that it can be shared with users that may have access to multiple tenants. If you have access to multiple tenants on a stack you will be required to enter the Prisma ID of the tenant you are logging into.
tt:[NOTE:] The Prisma ID of a tenant is displayed adjacent the OIDC configuration so that it can be shared with users that may have access to multiple tenants. If you have access to multiple tenants on a stack you will be required to enter the Prisma ID of the tenant you are logging into.

. Complete the setup on the IdP.
.. Review the workflow for your IdP.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,8 @@ You can enter the same *Account Name* as the one you had entered while onboardin
After successfully onboarding the account, you will see it onboarded as an *Organization* on the *Cloud Accounts* page.
//+image::connect/aws-accnt-to-org-0-6.png[]

[NOTE]
====
Updating from an individual account to an *Organization* is not supported for *Agentless* functions. If you previously onboarded a single account and now wish to switch to an *Organization* you will need to delete the single account on Prisma Cloud before proceeding with creating an *Organization*.
====
//[NOTE]
//====
//Updating from an individual account to an *Organization* is not supported for *Agentless* functions. If you previously onboarded a single account and now wish to switch to an *Organization* you will need to delete the single account on Prisma Cloud before proceeding with creating an *Organization*.
//====
//commenting out note till we reach consensus on CWP-54320