mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
90 lines
3.2 KiB
Plaintext
90 lines
3.2 KiB
Plaintext
---
|
|
title: Authenticate
|
|
sidebar_position: 3
|
|
---
|
|
|
|
Firezone supports the following authentication methods:
|
|
|
|
1. [Local email/password (default)](local-auth)
|
|
1. [SSO authentication via OpenID Connect](oidc)
|
|
1. [SSO authentication via SAML 2.0](saml)
|
|
|
|
:::note
|
|
If your Identity Provider doesn't work with the methods listed above,
|
|
[contact us](https://www.firezone.dev/contact/sales?utm_source=docs.firezone.dev) about custom integrations.
|
|
:::
|
|
|
|
## Integrate an SSO provider
|
|
|
|
We've included instructions on how to set up Firezone with several popular
|
|
identity providers using our Generic OIDC integration:
|
|
|
|
* [Okta](oidc/okta)
|
|
* [Azure Active Directory](oidc/azuread)
|
|
* [Google](oidc/google)
|
|
* [Onelogin](oidc/onelogin)
|
|
* [JumpCloud](saml/jumpcloud)
|
|
* [Keycloak](oidc/keycloak)
|
|
* [Zitadel](oidc/zitadel)
|
|
* [Auth0](oidc/auth0)
|
|
|
|
If your identity provider is not listed above, but has a generic OIDC or SAML
|
|
connector, please consult their documentation to find instructions on obtaining
|
|
the configuration settings required. Instructions for setting up Firezone with any
|
|
generic OIDC provider can be found [here](oidc).
|
|
|
|
Open a [Github issue](https://github.com/firezone/firezone/issues)
|
|
to request documentation or submit a pull request to add documentation for your
|
|
provider.
|
|
|
|
### The OIDC redirect URI
|
|
|
|
For each OIDC provider a corresponding URL is created for redirecting to
|
|
the configured provider's sign-in URL. The URL format is `https://firezone.example.com/auth/oidc/CONFIG_ID`
|
|
where `CONFIG_ID` is the OIDC Config ID for that particular provider.
|
|
|
|
For example, the OIDC config below:
|
|
|
|
<center>
|
|
<img width="509" alt="config-oidc" src="https://user-images.githubusercontent.com/167144/216438674-a2b64b3b-2ed6-43dc-b554-de9c055dc741.png"/>
|
|
</center>
|
|
|
|
would generate the following OIDC login URL:
|
|
|
|
* `https://firezone.example.com/auth/oidc/google`
|
|
|
|
This URL could then be distributed to end users for direct navigation to
|
|
the identity provider's login portal for authentication to Firezone.
|
|
|
|
## Enforce periodic re-authentication
|
|
|
|
Periodic re-authentication can be enforced by changing the setting in
|
|
`settings/security`. This can be used to ensure a user must sign in to Firezone
|
|
periodically in order to maintain their VPN session.
|
|
|
|
You can set the session length to a minimum of **1 hour** and maximum of **90 days**.
|
|
Setting this to Never disables this setting, allowing VPN sessions indefinitely.
|
|
This is the default.
|
|
|
|
### Re-authentication
|
|
|
|
To re-authenticate an expired VPN session, a user will need to turn off their
|
|
VPN session and sign in to the Firezone portal (URL specified during
|
|
[deployment](../deploy#prepare-to-deploy)).
|
|
|
|
See detailed Client Instructions on how to re-authenticate your session
|
|
[here](../user-guides/client-instructions).
|
|
|
|
#### VPN connection status
|
|
|
|
A user's connection status is shown on the Users page under the table column
|
|
`VPN Connection`. The connection statuses are:
|
|
|
|
* ENABLED - The connection is enabled.
|
|
* DISABLED - The connection is disabled by an administrator or OIDC refresh failure.
|
|
* EXPIRED - The connection is disabled due to authentication expiration or a user
|
|
has not signed in for the first time.
|
|
|
|
import SupportOptions from '@site/src/partials/_support_options.mdx';
|
|
<SupportOptions />
|