Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .vitepress/config.mts
Original file line number Diff line number Diff line change
Expand Up @@ -290,7 +290,7 @@ export default defineConfig({
link: "/zh_cn/ops/from_v9.md",
},
{
text: "Implementation of SSO",
text: "使用SSO登录",
link: "/zh_cn/ops/sso.md",
},
],
Expand Down
67 changes: 37 additions & 30 deletions zh_cn/ops/sso.md
Original file line number Diff line number Diff line change
@@ -1,18 +1,21 @@
# Setup SSO for MCSManager
# 使用SSO登录

> [!NOTE]
> Chinese Translation not yet available.
## 概述
单点登录 (SSO) 允许用户在一地注册,多地使用。
本文表述了在MCSManager上使用SSO的步骤。

## 开始前准备
- 确保你对此MCSManager实例拥有管理权限
- 你必须拥有一个SSO IdP,例如Keycloak或Authentik

## Overview
Single Sign-On (SSO) allows users to authenticate once and gain access to multiple applications.
This outlines the steps to set up SSO for MCSManager.
:::details 概念解释 - IdP
Identity Provider的缩写。

## Prerequisites
- Ensure you have administrative access to the MCSManager instance.
- You must have a valid SSO provider account (e.g., Authentik, Keycloak).
指在SAML/OIDC中,提供身份认证的一方。
:::

## Example Configuration
#### Example uses authentik as SSO Provider
## 示例配置
#### 使用 authentik 作为 SSO IdP
```json
{
[...]
Expand All @@ -22,10 +25,10 @@ This outlines the steps to set up SSO for MCSManager.
"ssoAutoRedirect": false,
"ssoProviderName": "Authentik",
"ssoIconUrl": "",
"ssoIssuer": "https://auth.example.de/application/o/mcsm/",
"ssoAuthorizeUrl": "https://auth.example.de/application/o/authorize/",
"ssoTokenUrl": "https://auth.example.de/application/o/token/",
"ssoUserinfoUrl": "https://auth.example.de/application/o/userinfo/",
"ssoIssuer": "https://auth.example.com/application/o/mcsm/",
"ssoAuthorizeUrl": "https://auth.example.com/application/o/authorize/",
"ssoTokenUrl": "https://auth.example.com/application/o/token/",
"ssoUserinfoUrl": "https://auth.example.com/application/o/userinfo/",
"ssoUserIdField": "sub",
"ssoScopes": "openid profile email",
"ssoClientId": "CLIENT-ID",
Expand All @@ -34,28 +37,32 @@ This outlines the steps to set up SSO for MCSManager.
}
```
```
"ssoEnabled" <- Enable SSO
"ssoType" <- Type must (oidc, oauth2)
"ssoOnlyMode" <- Disables Login Form
"ssoAutoRedirect" <- Skips Login Page and
"ssoProviderName" <- Name on Login Prompt
"ssoIconUrl" <- Icon URL on Login Prompt
"ssoEnabled" <- 启用SSO
"ssoType" <- SSO种类(OIDC/OAuth2)
"ssoOnlyMode" <- 仅使用SSO登录,禁用内置用户登录
"ssoAutoRedirect" <- 用户访问登录页面时立即重定向至IdP页面
"ssoProviderName" <- IdP在登录页面上的显示名称
"ssoIconUrl" <- IdP在登录页面上的图标
"ssoIssuer" <- Issuer URL
"ssoAuthorizeUrl" <- Authorize URL
"ssoTokenUrl" <- Token URL
"ssoUserinfoUrl" <- User Info URL
"ssoUserinfoUrl" <- 用户信息URL
"ssoUserIdField" <- User ID claim (May differ for each SSO Provider)
"ssoScopes" <- Scopes
"ssoClientId" <- Client ID
"ssoClientSecret" <- Client Secret
"ssoCallbackUrl" <- Callback URL
"ssoClientId" <- SSO Client ID
"ssoClientSecret" <- SSO Client Secret
"ssoCallbackUrl" <- 回调地址
```

## Testing
To test the SSO setup, attempt to log in to MCSManager using your SSO provider credentials.
> [!NOTE]
> 部分由于本人能力原因未能完全翻译,您可能需要自行查阅对应IdP/网络文档
>
> 请注意替换域名

You should be prompted to bind your Account to SSO.
## 测试
尝试使用您的身份验证登录MCSManager

## Troubleshooting
- Ensure that the redirect URIs are correctly configured in your SSO provider.
您应当被提示需要绑定一个SSO账户

## 问题解决
- 确保回调地址、重定向地址、允许的Origin等在IdP处配置完好