# Configure SSO Authentication with SAML

## Set up SAML in Customer Environment

1. Set up your SAML based on the steps in BoxyHQ documentation.

Choose your IdP:
   
   - [Generic SAML](https://boxyhq.com/docs/jackson/sso-providers/generic-saml)
   - [Microsoft Entra ID (formerly Azure AD) SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/azure)
   - [Microsoft AD FS SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/microsoft-adfs)
   - [Okta SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/okta)
   - [Auth0 SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/auth0)
   - [Google SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/google)
   - [OneLogin SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/onelogin)
   - [PingOne SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/pingone)
   - [JumpCloud SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/jumpcloud)
   - [Rippling SAML SSO](https://boxyhq.com/docs/jackson/sso-providers/rippling)
   - [OIDC Provider setup](https://boxyhq.com/docs/jackson/sso-providers/generic-oidc)

2. Use these values in the **Service provider details** section:

- **ACS URL**  
     
     ```console
     https://<your kloudfuse domain name>/api/oauth/saml
     ```  
 
   - **Entity ID**  
     
     ```console
     https://<your kloudfuse domain name>/samlresponse
     ```

3. Generate and save the Metadata (XML file).

This is necessary to configure the Kloudfuse connection with your SAML provider.

4. Share the metadata with Kloudfuse support.

## Set up SAML in Kloudfuse

To set up SAML in Kloudfuse, you must:

- [Set up Metadata Secret](https://docs.kloudfuse.com/platform/3.3.6/sso-saml/#secret)
- [Set up the Environment](https://docs.kloudfuse.com/platform/3.3.6/sso-saml/#environment)

### Set up Metadata Secret

1. Rename the Metadata XML file that the customer shares to `kfuse.xml`.

Alternatively, if the customer shared a URL, run the following command:

```console
   curl {metadata xml file url} > kfuse.xml
   ```

2. Save the `kfuse.xml` file in the customer’s terminal.

3. Create the generic `kfuse-xml` secret in the customer’s cluster and namespace by running the following command:

```console
   kubectl create secret generic kfuse-xml --from-file=kfuse.xml
   ```

|     |     |
   | --- | --- |
   |  | If the secret `kfuse-xml` already exists, or if you are re-creating it, see [Troubleshooting](https://docs.kloudfuse.com/platform/3.3.6/sso-saml/#troubleshooting). |

### Set up the Environment

In the `custom-values.yaml` file, complete these steps:

1. In the `global` section:
   
   1. Set the `dnsName` tag to the customer’s domain name.
   2. Enable the `kfuse-saml` service.

2. In the `kfuse-auth` section:
   
   1. Set the `saml-provider-name` to the customer’s SAML provider name.
   2. Set `existingSecret` to `kfuse-auth-saml`.

3. Perform a general upgrade using the `custom-values.yaml`.

See [Upgrade Kloudfuse](https://docs.kloudfuse.com/platform/3.3.6/upgrade/) and [Upgrade validation](https://docs.kloudfuse.com/platform/3.3.6/upgrade-validation/).

Example Configuration for SAML with Okta:

```yaml
   global:
        dnsName: <your kloudfuse domain name>
        kfuse-saml:
          enabled: true
   
   kfuse-auth:
        oauth2-proxy:
          config:
            saml-provider-name: "Okta"
            existingSecret: "kfuse-auth-saml"
   ```

## Troubleshooting

1. Open an interactive shell into `kfuse-configdb-0` pod.

```console
   kubectl exec -it kfuse-configdb-0 -- bash
   ```

2. Log in to PostgreSQL:

```console
   psql into the postgres using command -
   ```

Enter your password when prompted.

3. Check if `samldb` database exists using the following command:

```console
   \l
   ```

4. Delete and recreate the database `samldb`:

```postgresql
   DROP DATABASE samldb;
   CREATE DATABASE samldb;
   ```