Connect SSO

After configuring the main parameters, set variables required for SSO connection.

For AUTH_METHOD = azure

  • AZURE_AUTHORIZATION_URL — authorization endpoint URL. Example: https://login.microsoftonline.com/HohLpGvI.../oauth2/v2.0/authorize

  • AZURE_TOKEN_URL — token endpoint URL. Example: https://login.microsoftonline.com/HohLpGvI.../oauth2/v2.0/token

  • AZURE_API_URL — API information endpoint URL. Example: https://graph.microsoft.com/v1.0

  • AZURE_CLIENT_ID — application ID in Azure. Example: 0FYSAWm1A-1x4k-e14H-0LHe-gf6qwElcYuz

  • AZURE_CLIENT_SECRET — application secret in Azure. Example: rY3yh*suIebMk^k0KGoi3azsIBP&FY@odQsgFVdc

For AUTH_METHOD = adfs

  • ADFS_CERT — certificate used for authentication in ADFS.

  • ADFS_ENTRYPOINT — authentication entry point. Example: https://adfs.gram.ax/adfs/ls/

  • ADFS_ISSUER — ADFS identifier. Example: https://adfs.gram.ax/

  • ADFS_CALLBACK_URL — callback URL after successful authentication. Example: https://app.gram.ax/auth/cb

For AUTH_METHOD = keycloak

  • KEYCLOAK_SERVER_URL — Keycloak server URL. Example: https://keycloak.gram.ax/auth/

  • KEYCLOAK_REALM — realm name in Keycloak. Example: gramax

  • KEYCLOAK_CLIENT_ID — Keycloak client ID.

  • KEYCLOAK_USE_ACCESS_TOKEN_INFO — whether to read user info from access_token. Example: KEYCLOAK_USE_ACCESS_TOKEN_INFO=true

For AUTH_METHOD = openid

  • OPEN_ID_SERVER_URL — OpenID server URL. Example: https://keycloak.gram.ax/auth/

  • OPEN_ID_REALM — realm name in OpenID. Example: gramax

  • OPEN_ID_CLIENT_ID — OpenID client ID.

  • OPEN_ID_CLIENT_SECRET — OpenID client secret.

For AUTH_METHOD = ldap

  • LDAP_URL — LDAP server URL. Example: ldap://ldap.example.com:389 or ldaps://ldap.example.com:636

  • LDAP_ADMIN_DN — DN of the administrative user with directory search permissions. Example: gramax@gramax.ru

  • LDAP_ADMIN_PASSWORD — password of the administrative user. Example: secretAdminPass

  • LDAP_USER_SEARCH_BASE — DN of the base user search point. Example: ou=users,dc=example,dc=com

  • LDAP_USERNAME_ATTRIBUTE — user attribute for search. Example: samaccountname, cn, mail

  • LDAP_USER_DN — DN of a specific user, if known directly. Example: OU=Enabled,OU=GRAMAX-USERS,DC=gramax,DC=local

  • LDAP_GROUP_SEARCH_BASE — DN of the base group search point. Example: ou=groups,dc=example,dc=com

  • LDAP_GROUP_CLASS — object class of the group entry. Example: groupOfNames

  • LDAP_GROUP_MEMBER_ATTRIBUTE — attribute in a group entry containing its members. Example: member

  • LDAP_GROUP_MEMBER_USER_ATTRIBUTE — user attribute matched with LDAP_GROUP_MEMBER_ATTRIBUTE. Example: dn

  • LDAP_ATTRIBUTES — comma-separated list of user attributes to return. If not specified, all are returned. Example: cn,sn,mail

For AUTH_METHOD = kerberos

  • KERBEROS_REALM — Kerberos realm (Active Directory domain). Must be in UPPERCASE. Example: COMPANY.LOCAL

  • KERBEROS_ALLOWED_REALMS — optional comma-separated list of allowed user realms. If omitted, only KERBEROS_REALM is allowed. Example: COMPANY.LOCAL,TRUSTED.COMPANY.LOCAL

  • KERBEROS_SERVICE_PRINCIPAL — Service Principal Name (SPN). Format: HTTP/hostname@REALM. Example: HTTP/gramax.company.local@COMPANY.LOCAL

  • KRB5_KTNAME — environment variable for the Kerberos library. Format: FILE:/path/to/keytab. Example: FILE:/opt/gramax/config/gramax.keytab

  • KERBEROS_REALM must exactly match the Active Directory domain in UPPERCASE

  • KERBEROS_SERVICE_PRINCIPAL must match the SPN registered in Active Directory

  • The path in KRB5_KTNAME must start with the FILE: prefix

  • Mount the keytab file into the container as :ro and make it readable by the container user with UID 10001. The :ro mode prevents writes but does not change file ownership or permissions. Recommended permissions are 400 for owner UID 10001, or 440 for an appropriate group

Authorization

Callback URL

When configuring Callback URL in your SSO provider, use the Enterprise service address with /sso/cb.

Example: https://ges-gram.ax/sso/cb

For AUTH_METHOD = azure

  • AZURE_AUTHORIZATION_URL — authorization endpoint URL. Example: https://login.microsoftonline.com/HohLpGvI.../oauth2/v2.0/authorize

  • AZURE_TOKEN_URL — token endpoint URL. Example: https://login.microsoftonline.com/HohLpGvI.../oauth2/v2.0/token

  • AZURE_API_URL — API information endpoint URL. Example: https://graph.microsoft.com/v1.0

  • AZURE_CLIENT_ID — application ID in Azure. Example: 0FYSAWm1A-1x4k-e14H-0LHe-gf6qwElcYuz

  • AZURE_CLIENT_SECRET — application secret in Azure. Example: rY3yh*suIebMk^k0KGoi3azsIBP&FY@odQsgFVdc

For AUTH_METHOD = adfs

  • ADFS_CERT — certificate used for authentication in ADFS.

  • ADFS_ENTRYPOINT — authentication entry point. Example: https://adfs.gram.ax/adfs/ls/

  • ADFS_ISSUER — ADFS identifier. Example: https://adfs.gram.ax/

  • ADFS_CALLBACK_URL — callback URL after successful authentication. Example: https://app.gram.ax/auth/cb

For AUTH_METHOD = keycloak

  • KEYCLOAK_SERVER_URL — Keycloak server URL. Example: https://keycloak.gram.ax/auth/

  • KEYCLOAK_REALM — realm name in Keycloak. Example: gramax

  • KEYCLOAK_CLIENT_ID — Keycloak client ID.

  • KEYCLOAK_USE_ACCESS_TOKEN_INFO — whether to read user info from access_token. Example: KEYCLOAK_USE_ACCESS_TOKEN_INFO=true

For AUTH_METHOD = openid

  • OPEN_ID_SERVER_URL — OpenID server URL. Example: https://keycloak.gram.ax/auth/

  • OPEN_ID_REALM — realm name in OpenID. Example: gramax

  • OPEN_ID_CLIENT_ID — OpenID client ID.

  • OPEN_ID_CLIENT_SECRET — OpenID client secret.

For AUTH_METHOD = ldap

  • LDAP_URL — LDAP server URL. Example: ldap://ldap.example.com:389 or ldaps://ldap.example.com:636

  • LDAP_ADMIN_DN — DN of the administrative user with directory search permissions. Example: gramax@gramax.ru

  • LDAP_ADMIN_PASSWORD — password of the administrative user. Example: secretAdminPass

  • LDAP_USER_SEARCH_BASE — DN of the base user search point. Example: ou=users,dc=example,dc=com

  • LDAP_USERNAME_ATTRIBUTE — user attribute for search. Example: samaccountname, cn, mail

  • LDAP_USER_DN — DN of a specific user, if known directly. Example: OU=Enabled,OU=GRAMAX-USERS,DC=gramax,DC=local

  • LDAP_GROUP_SEARCH_BASE — DN of the base group search point. Example: ou=groups,dc=example,dc=com

  • LDAP_GROUP_CLASS — object class of the group entry. Example: groupOfNames

  • LDAP_GROUP_MEMBER_ATTRIBUTE — attribute in a group entry containing its members. Example: member

  • LDAP_GROUP_MEMBER_USER_ATTRIBUTE — user attribute matched with LDAP_GROUP_MEMBER_ATTRIBUTE. Example: dn

  • LDAP_ATTRIBUTES — comma-separated list of user attributes to return. If not specified, all are returned. Example: cn,sn,mail

For AUTH_METHOD = kerberos

  • KERBEROS_REALM — Kerberos realm (Active Directory domain). Must be in UPPERCASE. Example: COMPANY.LOCAL

  • KERBEROS_ALLOWED_REALMS — optional comma-separated list of allowed user realms. If omitted, only KERBEROS_REALM is allowed. Example: COMPANY.LOCAL,TRUSTED.COMPANY.LOCAL

  • KERBEROS_SERVICE_PRINCIPAL — Service Principal Name (SPN). Format: HTTP/hostname@REALM. Example: HTTP/gramax.company.local@COMPANY.LOCAL

  • KRB5_KTNAME — environment variable for the Kerberos library. Format: FILE:/path/to/keytab. Example: FILE:/opt/gramax/config/gramax.keytab

  • KERBEROS_REALM must exactly match the Active Directory domain in UPPERCASE

  • KERBEROS_SERVICE_PRINCIPAL must match the SPN registered in Active Directory

  • The path in KRB5_KTNAME must start with the FILE: prefix

  • Mount the keytab file into the container as :ro and make it readable by the container user with UID 10001. The :ro mode prevents writes but does not change file ownership or permissions. Recommended permissions are 400 for owner UID 10001, or 440 for an appropriate group

User list

For CONNECTOR_TYPE=ldap

  • LDAP_URL — LDAP server URL. Example: ldap://ldap.example.com:389 or ldaps://ldap.example.com:636

  • LDAP_ADMIN_DN — user DN with directory search permissions. Example: gramax@gramax.ru

  • LDAP_ADMIN_PASSWORD — password of the user specified in LDAP_ADMIN_DN. Example: secretAdminPass

  • LDAP_USER_SEARCH_BASE — DN of the base user search point. Example: ou=users,dc=example,dc=com

  • LDAP_GROUP_CLASS — LDAP object class used to search for groups. Example: group

  • LDAP_GROUP_SEARCH_BASE — DN of the base group search point. Example: ou=groups,dc=example,dc=com

  • LDAP_SEARCH_GROUP_LIMIT — maximum number of groups returned during LDAP search. Example: 15

  • LDAP_OBJECT_TYPE_FILTER — object type filter used when searching for users. Default: objectCategory=person

For CONNECTOR_TYPE=keycloak

  • KEYCLOAK_SERVER_URL — Keycloak server URL. Example: https://keycloak.gram.ax/auth/

  • KEYCLOAK_REALM — realm name in Keycloak. Example: gramax

  • KEYCLOAK_API_TOKEN — access token.

For CONNECTOR_TYPE=scim

  • SCIM_SERVER_URL — SCIM server URL. Example: https://scim.gram.ax/auth/

  • SCIM_TOKEN — access token (used instead of SCIM_ADMIN_LOGIN + SCIM_ADMIN_PASSWORD).

  • SCIM_GET_USERS_FILTER — filter for user search. Default: userName co "${searchSubstring}"

  • SCIM_ADMIN_LOGIN — username for Basic authorization (instead of SCIM_TOKEN).

  • SCIM_ADMIN_PASSWORD — password for Basic authorization (instead of SCIM_TOKEN).