diff --git a/docs/assets/identity-center-1.png b/docs/assets/identity-center-1.png index 0cd49528d90f7..1e308dd461b32 100644 Binary files a/docs/assets/identity-center-1.png and b/docs/assets/identity-center-1.png differ diff --git a/docs/operator-manual/user-management/identity-center.md b/docs/operator-manual/user-management/identity-center.md index c4019964d7a4d..62d381aec73d5 100644 --- a/docs/operator-manual/user-management/identity-center.md +++ b/docs/operator-manual/user-management/identity-center.md @@ -10,10 +10,15 @@ A working Single Sign-On configuration using Identity Center (AWS SSO) has been ## SAML (with Dex) 1. Create a new SAML application in Identity Center and download the certificate. - * ![Identity Center SAML App 1](../../assets/identity-center-1.png) - * ![Identity Center SAML App 2](../../assets/identity-center-2.png) + +![Identity Center SAML App 1](../../assets/identity-center-1.png) + +![Identity Center SAML App 2](../../assets/identity-center-2.png) + 2. Click `Assign Users` after creating the application in Identity Center, and select the users or user groups you wish to grant access to this application. - * ![Identity Center SAML App 3](../../assets/identity-center-3.png) + +![Identity Center SAML App 3](../../assets/identity-center-3.png) + 3. Copy the Argo CD URL into the `data.url` field in the `argocd-cm` ConfigMap. data: @@ -24,15 +29,20 @@ A working Single Sign-On configuration using Identity Center (AWS SSO) has been !!! note "Group attribute mapping is not officially!" Group attribute mapping is not officially supported in the AWS docs, however the workaround is currently working. - * ![Identity Center SAML App 4](../../assets/identity-center-4.png) - * ![Identity Center SAML App 5](../../assets/identity-center-5.png) +![Identity Center SAML App 4](../../assets/identity-center-4.png) + +![Identity Center SAML App 5](../../assets/identity-center-5.png) 5. Download the CA certificate to use in the `argocd-cm` configuration. + * If using the `caData` field, you'll need to base64-encode the entire certificate, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` stanzas (e.g., `base64 my_cert.pem`). + * If using the `ca` field and storing the CA certificate separately as a secret, you will need to mount the secret onto the `dex` container in the `argocd-dex-server` Deployment. - * ![Identity Center SAML App 6](../../assets/identity-center-6.png) + +![Identity Center SAML App 6](../../assets/identity-center-6.png) + 6. Edit the `argocd-cm` and configure the `data.dex.config` section: @@ -60,6 +70,7 @@ dex.config: | ### Connect Identity Center Groups to Argo CD Roles + Argo CD recognizes user memberships in Identity Center groups that match the **Group Attribute Statements** regex. In the example above, the regex `argocd-*` is used, making Argo CD aware of a group named `argocd-admins`.