import Alert from "@/components/DocsAlert";
import Image from "next/image";

# SSO with Fusion Auth

Firezone's universal OIDC connector has been tested to work successfully with
[Fusion Auth](https://fusionauth.io). Follow this guide to set up Fusion Auth
for use with Firezone's OIDC connector.

## Step 1: Create a new Application in Fusion Auth

1. Within your Fusion Auth instance, click on the `Settings` menu in the
   sidebar. Then select `Key Master`.
   <Image
     src="/images/kb/authenticate/oidc/fusion/sidebar-settings.png"
     alt="image of sidebar with settings selected"
     width="200"
     height="200"
     className="shadow mx-auto"
   />
1. In the `Generate` drop down menu, select `Generate RSA Key Pair`.
   <Image
     alt="image of generate menu"
     src="/images/kb/authenticate/oidc/fusion/generate.png"
     width="225"
     height="225"
     className="shadow mx-auto"
   />
1. Name the key appropriately, leave all other settings as their default.
   <Image
     alt="image of key generation dialog"
     src="/images/kb/authenticate/oidc/fusion/key.png"
     width="800"
     height="800"
     className="shadow mx-auto"
   />
1. Within your Fusion Auth instance, click on the `Applications` menu in the
   sidebar.
   <Image
     alt="image of sidebar with applications selected"
     src="/images/kb/authenticate/oidc/fusion/sidebar-applications.png"
     width="200"
     height="200"
     className="shadow mx-auto"
   />
1. Click the green + button at the top of the screen.
   <Image
     alt="image of top of applications page"
     src="/images/kb/authenticate/oidc/fusion/top.png"
     width="800"
     height="800"
     className="shadow mx-auto"
   />
1. Provide this application a unique name within your system (i.e.
   `Firezone-1.0`).
1. Under the OAuth tab enter the two urls provided by Firezone in the Authorized
   redirect URLs entry. Also add `https://app.firezone.dev` to the Authorized
   request origin URLs. You may enter any logout URL you wish. Optionally,
   enable PKCE for enhanced security.
   <Image
     alt="image of oauth tab"
     src="/images/kb/authenticate/oidc/fusion/setup-oauth.png"
     width="800"
     height="800"
     className="shadow mx-auto"
   />
1. Under the JWT tab, ensure that JWT is enabled. Also, for both entries under
   JSON web token settings, ensure your newly created RSA key is used.
   <Image
     alt="image of oauth tab"
     src="/images/kb/authenticate/oidc/fusion/setup-jwt.png"
     width="800"
     height="800"
     className="shadow mx-auto"
   />
1. Save your application. Then go back into your application in edit mode. Copy
   the client id / secret to enter into Firezone in the next step.

## Step 2: Create identity provider in Firezone

1. In your Firezone admin dashboard, go to
   `Settings -> Identity Providers -> Add -> OIDC`.
1. Enter the `client id` and `client secret` saved from the previous step.
1. In the Discovery URL, enter
   `https://<domain>/.well-known/openid-configuration` replacing `<domain>` with
   the domain you use to host Fusion Auth.
1. Click Create.

## Step 3: Test

You should now be able authenticate users to Firezone using the identity
provider just created.

<Alert
  color="warning"
  html={`
    Firezone <strong>does not</strong> automatically provision users or groups for identity providers
    using the universal OIDC connector. You must create Actors and
    associated Identities <strong>before</strong> the user will be able to sign in.
  `}
/>
