Contact your Customer Success Manager (CSM) to enable the SSO feature for your organization.
Qovery will provide you a unique $CONNECTION_NAME that you will need to configure your IDP
You will need to provide required information to setup the configuration on Qovery side
2
Validate Authentication Flow
When the configuration is done on your side and on Qovery side, we plan a session to validate the authentication flow.
3
User Provisioning
Once your users are provisioned using SAML or OIDC inside your organization, you will need to remove old users and transfer your organization ownership.
If you want to automatically assign a Qovery role according to your users’ groups (see Configure Group Synchronization), you need to expose this information:
Add attribute groups to match the targeted IDP groups you want to expose
Use .* to expose all groups assigned to your users
Go to Sign On tab and gather the following required information:
Sign on URL
Signing Certificate
Go to General section, edit SAML Settings section, and click on Preview the SAML Assertion. This will generate an XML file that you will need to share.
Validate your XML: You should see in the SAML Assertion XML file the fields that IDP will expose to Qovery inside <saml2:AttributeStatement>, for example:
If you want to automatically assign a Qovery role according to your users’ groups (see Configure Group Synchronization), you need to expose them.Go to Sign On > OpenID Connect ID Token:
Add a groups claim
You can filter on the groups you want to expose or not (e.g., .* to expose all groups assigned to your users)
This is the Qovery role that will be associated to your IDP users when they log in to Qovery.You can indicate either a Qovery provided role or a custom role:
Group synchronization tells Qovery to always synchronize the Qovery role with your IDP users’ groups. You need to configure Group Mappings when setting Enforce Sync Group to true.
You can create a mapping table to associate the expected Qovery role based on your user IDP group.Example 1: Users with IDP groups “Administrators” or “DevSecOps” get the “admin” Qovery role:
Users are not auto-provisioned into Qovery. They need to log in at least once to Qovery using the SAML or OIDC authentication flow to be present in your organization.Qovery defines a user according to both their email and their authentication provider. This means that when your users use the new SAML/OIDC authentication flow, they will be considered as new users in your organization. You will need to manually remove the old users that were using classic SSO login.
Billing ConsiderationQovery computes billing according to the number of users present in your organization.During the transition from classic SSO to SAML/OIDC authentication flow, you may experience a billing increase if you don’t delete old users progressively. If it happens, a refund will be done the next month.
