SAML SSO Authentication

Configure SAML-based Single Sign-On in Kloudfuse by setting up your identity provider with BoxyHQ and applying the corresponding environment configuration to your Kloudfuse cluster.

Set up SAML in Customer Environment

1. Set up your SAML based on the steps in BoxyHQ documentation.

Choose your IdP:

• Generic SAML
• Microsoft Entra ID (formerly Azure AD) SAML SSO
• Microsoft AD FS SAML SSO
• Okta SAML SSO
• Auth0 SAML SSO
• Google SAML SSO
• OneLogin SAML SSO
• PingOne SAML SSO
• JumpCloud SAML SSO
• Rippling SAML SSO
• OIDC Provider setup

2. Use these values in the Service provider details section:

   • ACS URL

     https://<your kloudfuse domain name>/api/oauth/saml
     

   • Entity ID

     https://<your kloudfuse domain name>/samlresponse
     

3. Generate and save the Metadata (XML file). This is necessary to configure the Kloudfuse connection with your SAML provider.

4. Share the metadata with Kloudfuse support.

Set up SAML in Kloudfuse

To set up SAML in Kloudfuse, you must:

• Set up Metadata Secret
• Set up the Environment

Set up Metadata Secret

1. Rename the Metadata XML file that the customer shares to kfuse.xml.

Alternatively, if the customer shared a URL, run the following command:

curl {metadata xml file url} > kfuse.xml

2. Save the kfuse.xml file in the customer’s terminal.

3. Create the generic kfuse-xml secret in the customer’s cluster and namespace by running the following command:

   kubectl create secret generic kfuse-xml --from-file=kfuse.xml
   

Set up the Environment

In the custom-values.yaml file, complete these steps:

1. In the global section:

   1. Set the dnsName tag to the customer’s domain name.
   2. Enable the kfuse-saml service.

2. In the kfuse-auth section:

   1. Set the saml-provider-name to the customer’s SAML provider name.
   2. Set existingSecret to kfuse-auth-saml.

When you enable the ‘kfuse-saml’ flag, Kloudfuse automatically creates this secret.

3. Perform a general upgrade using the custom-values.yaml.

Example Configuration for SAML with Okta:

global:
     dnsName: <your kloudfuse domain name>
     kfuse-saml:
       enabled: true

kfuse-auth:
     oauth2-proxy:
       config:
         saml-provider-name: "Okta"
         existingSecret: "kfuse-auth-saml"

Troubleshooting

1. Open an interactive shell into kfuse-configdb-0 pod.

   kubectl exec -it kfuse-configdb-0 -- bash
   

2. Log in to PostgreSQL:

   psql into the postgres using command -
   

   Enter your password when prompted.

3. Check if samldb database exists using the following command:

   \l
   

4. Delete and recreate the database samldb:

   DROP DATABASE samldb;
   CREATE DATABASE samldb;