Te whirihora i te Single Sign-On (SSO) me te SAML, te OIDC rānei

Ka tautoko a ScribbleMaps i te Single Sign-On ā-umanga mā te SAML 2.0, te OpenID Connect (OIDC) rānei. Mā tēnei e taea ai e ngā mema o tō rōpū te whakaū i a rātou mā te whakamahi i te Identity Provider (IdP) a tō whakahaere pērā i a Okta, Microsoft Entra ID (Azure AD), Google Workspace, Auth0 rānei.

Kei team.scribblemaps.com te whirihoranga SSO, ā, he koreutu rawa.

Rārangi Kaupapa

1. Ngā Āhuatanga e Tautokona Ana
2. I Mua i te Tīmatanga
3. Waihanga 1: Manatoko i Tō Rohe Īmēra
4. Waihanga 2: Whirihora i Tō Identity Provider
5. Waihanga 3: Whirihora i te SSO i ScribbleMaps
6. Waihanga 4: Whakamātau i Tō Whirihoranga
7. Waihanga 5: Whakahohe i te SSO
8. SSO i Tīmata e te SP
9. OIN Universal Logout
10. Ngā Aratohu Mā Ia Kaiwhakarato
11. Ngā Kōwhiringa Matatau
12. Te Whakatika Raruraru

Ngā Āhuatanga e Tautokona Ana

Ka tautoko te whakaurunga SSO a ScribbleMaps i ēnei āhuatanga:

I Mua i te Tīmatanga

• Me Team Owner koe hei whirihora i te SSO
• Me whai whakaaetanga koe ki te papa whakahaere a tō Identity Provider
• Me whakareri tō rohe īmēra (hei tauira, yourcompany.com)

Waihanga 1: Manatoko i Tō Rohe Īmēra

I mua i te whirihora i te SSO, me manatoko koe i tō mana pupuri i tō rohe īmēra. Mā tēnei tūmahi haumaru e whakarite ko ngā whakahaere whakaaetia anake ka taea te whirihora i te SSO mō ō rātou rohe.

1. Takiuru ki team.scribblemaps.com
2. Haere ki Settings > Single Sign-On
3. Haere ki te ripa Domains
4. Pāwhiri i Add Domain ka whakauru i tō rohe īmēra (hei tauira, yourcompany.com)
5. Kōwhiria tētahi tikanga manatoko:

Kōwhiringa A: DNS TXT Record (E Taunakitia Ana)

Tāpiri i tētahi TXT record ki ngā tautuhinga DNS o tō rohe:

Tirohia: Tae atu ki te 48 hāora te roa e kōkiri atu ai ngā panoni DNS.

Kōwhiringa B: Tukuake Kōnae

1. Waihangatia he kōnae kuputuhi e kīia ana ko scribblemaps-verify.txt
2. Tāpiria tō waehere manatoko hei ihirangi kotahi anake
3. Tukuake ki: https://yourcompany.com/.well-known/scribblemaps-verify.txt

Whai muri i te tāpiri i te manatoko, pāwhiri i Verify Domain hei whakamana i te mana pupuri.

Waihanga 2: Whirihora i Tō Identity Provider

Tāpiri i a ScribbleMaps hei tono i roto i tō Identity Provider. Mēnā e whakamahi ana koe i a Okta, ka taea e koe te tāpiri i a ScribbleMaps ā-tōtika mai i te rārangi Okta Integration Network (OIN) — ka whirihoratia aunoatia mai te SAML SSO URL, te SP Entity ID, te ACS URL, me te OIDC Redirect URI.

Mō te SAML 2.0

Mō te OIDC

Waihanga 3: Whirihora i te SSO i ScribbleMaps

Te Whirihora i te SAML 2.0

1. I ScribbleMaps, haere ki Settings > Single Sign-On > te ripa SAML
2. Whakauruhia ēnei mōhiohio mai i tō Identity Provider:

3. Pāwhiri i Save Settings

Te Whirihora i te OIDC

1. I ScribbleMaps, haere ki Settings > Single Sign-On > te ripa OIDC
2. Kōwhiria tō Provider Type (Google, Microsoft, Okta, Auth0, Custom rānei)
3. Whakauruhia ēnei mōhiohio:

4. Pāwhiri i Save Settings

Waihanga 4: Whakamātau i Tō Whirihoranga

I mua i te whakahohe i te SSO mō ngā kaiwhakamahi katoa, whakamātauria tō whirihoranga:

1. Pāwhiri i te pātene Test Connection
2. Ka tuwhera he matapihi hou hei whakatauira i te rere takiuru SSO
3. Whakaotia te whakaū me tō Identity Provider
4. Manatokohia kua whakawhitia koe ki ScribbleMaps me te angitu

Mēnā ka rahua te whakamātautau, arotakea te karere hapa ka tirohia ō tautuhinga whirihoranga.

Waihanga 5: Whakahohe i te SSO

Ina angitu te whakamātautau:

1. Whakahohea te pana Enable SSO ki te ON
2. Kōwhiria tō kōwhiringa whakamana:
   • Optional: Ka taea e ngā kaiwhakamahi te kōwhiri i te SSO, i te takiuru ā-kupuhipa rānei
   • Enforced: Me whakamahi te SSO e ngā kaiwhakamahi he rohe īmēra kua manatokohia (kua monokia te takiuru ā-kupuhipa)

Tirohia: Ka taea tonu e ngā Team Owner te whakamahi i te takiuru ā-kupuhipa hei tautoko, ahakoa kua whakamanahia te SSO.

SSO i Tīmata e te SP

Ka tautoko a ScribbleMaps i te SSO i tīmata e te SP, e taea ai e ngā kaiwhakamahi te tīmata i te hātepe takiuru mai i te whārangi takiuru o ScribbleMaps. Anei tana mahi:

1. Haere ki scribblemaps.com/account/login
2. Whakauruhia tō wāhitau īmēra (hei tauira, [email protected])
3. Pāwhiri i Sign in with SSO
4. Ka whakawhitia koe ki te Identity Provider a tō whakahaere (hei tauira, Okta) hei whakaū
5. Whai muri i te whakaū angitu, ka whakawhitia aunoatia koe ki ScribbleMaps ka takiuru

Mēnā kua whakamanahia te SSO e tō whakahaere, ka whakawhitia aunoatia koe ki tō Identity Provider ina whakauru koe i tō īmēra ki te whārangi takiuru — e kore e whakaatuhia he āpure kupuhipa.

OIN Universal Logout

E tautokona ana te universal logout a Okta. Mō ngā tohutohu whirihora, tēnā koa toro ki tēnei hono.

Ngā Aratohu Mā Ia Kaiwhakarato

Okta

1. I te Okta Admin Console, haere ki Applications > Browse App Catalog
2. Rapua a ScribbleMaps ka pāwhiri i Add Integration
3. Ka whirihoratia aunoatia te SSO URL, te Entity ID, me te Redirect URI
4. Haere ki te ripa Sign On hei kimi i ngā taipitopito whirihoranga IdP:
   • Tikiake i te X.509 Certificate
   • Tāruatia te Identity Provider Issuer (Entity ID)
   • Tāruatia te Single Sign-On URL
5. Whakauruhia ēnei uara ki ngā tautuhinga SSO o ScribbleMaps (tirohia Waihanga 3)

Microsoft Entra ID (Azure AD)

1. I te Azure Portal, haere ki Microsoft Entra ID > App registrations > New registration
2. Whirihora:
   • Redirect URI: https://api.scribblemaps.com/oidc/callback (Web platform)
3. Haere ki Certificates & secrets > Waihangatia he Client secret hou
4. Tāruatia te Application (client) ID me te Client secret value
5. Authority URL: https://login.microsoftonline.com/YOUR-TENANT-ID/v2.0

Google Workspace

1. I te Google Cloud Console, haere ki APIs & Services > Credentials
2. Pāwhiri i Create Credentials > OAuth client ID
3. Kōwhiria Web application
4. Tāpiri i te Authorized redirect URI: https://api.scribblemaps.com/oidc/callback
5. Tāruatia te Client ID me te Client Secret
6. Authority URL: https://accounts.google.com

Tirohia: Hei tono i te MFA mō Google Workspace, whirihora i tērā i tō Google Workspace Admin Console.

Auth0

1. I te Auth0 Dashboard, haere ki Applications > Create Application
2. Kōwhiria Regular Web Applications
3. Whirihora:
   • Allowed Callback URLs: https://api.scribblemaps.com/oidc/callback
   • Allowed Logout URLs: https://api.scribblemaps.com/oidc/logout-callback
4. Tāruatia te Client ID me te Client Secret mai i te ripa Settings
5. Authority URL: https://YOUR-DOMAIN.auth0.com

Ngā Kōwhiringa Matatau

Just-In-Time (JIT) Provisioning

Ina whakahohea, ka waihangatia aunoatia ngā kaiwhakamahi i ScribbleMaps i tā rātou takiuru SSO tuatahi. Ka whakakiia ō rātou mōhiohio kōtaha (ingoa, īmēra) mai i te Identity Provider.

Require Multi-Factor Authentication (OIDC anake)

Whakahohea tēnei kōwhiringa hei tono i te manatoko MFA i mua i te whakaaetanga takiuru. Ka manatoko a ScribbleMaps kua whakamanahia e tō IdP te MFA mō te kaiwhakamahi.

Mō Okta, ka taea e koe te tohu i ngā uara ACR ritenga pērā i:

• urn:okta:loa:2fa:any - Tētahi tauwhanga tuarua
• phr - Whakaū e ātete ana ki te phishing
• phrh - Whakaū e ātete ana ki te phishing, e herea ana ki te taputapu

Attribute/Claim Mapping

Whakarerekētia te āhua o te tāpoi i ngā huānga kaiwhakamahi mai i tō IdP ki ngā āpure kaiwhakamahi o ScribbleMaps:

Te Whakatika Raruraru

Ngā Take Noa

"Domain not verified"

• Whakaūngia kua whirihoratia tika tō DNS TXT record, tō kōnae manatoko rānei
• Tae atu ki te 48 hāora te roa e kōkiri atu ai ngā panoni DNS
• Manatokohia kāore he hapa tuhi i te waehere manatoko

"Invalid certificate"

• Whakaūngia e whakamahi ana koe i te certificate tōpū, tae atu ki a -----BEGIN CERTIFICATE----- me -----END CERTIFICATE-----
• Tirohia kāore anō kia pau te wā o te certificate
• Kia mōhio ko te signing certificate tāu i tāruatia, ehara i te encryption certificate

"Invalid signature"

• Manatokohia he ōrite te certificate ki te signing certificate o nāianei a tō IdP
• Tirohia he ōrite te signature algorithm (SHA-256 me SHA-1)

"User not found" or "Email mismatch"

• Whakaūngia he ōrite te īmēra i whakahokia mai e tō IdP ki tētahi rohe kua manatokohia
• Tirohia kua tautuhia te NameID format ki Email Address
• Manatokohia he tika te attribute/claim mapping

"Security error: Your Identity Provider is not authorized for this email domain"

• Ka puta tēnei ina kāore te whirihoranga IdP e ōrite ki te rohe kua manatokohia
• Whakaūngia kua manatokohia te rohe īmēra i raro i tō rōpū
• Tirohia e takiuru ana koe me tētahi īmēra no tētahi rohe kua manatokohia

Te Tiro i ngā Audit Logs

Aroturukitia te mahi SSO i Settings > Single Sign-On > Audit Logs. Ka taea e koe te:

• Tātari mā te momo takahanga (Login, Logout, Failed Login)
• Tātari mā te awhe rā
• Kawe atu i ngā log hei CSV mō te pūrongo ā-ture

E Hiahia Āwhina Ana?

Mēnā he raruraru tō whirihoranga SSO, tēnā koa whakapā ki tā mātou rōpū tautoko me:

• Te ingoa o tō Rōpū (Team)
• Te Identity Provider e whakamahi ana koe
• Ngā karere hapa e kitea ana e koe
• Ngā whakaahua mata o tō whirihoranga IdP (kua huna ngā raraunga tairongo)

Kei konei mātou hei āwhina i a koe ki te whirihora i te SSO mō tō whakahaere.