SAML SSO Authentication

Table of Contents

Set up SAML in your identity provider
Set up SAML in Kloudfuse
- Store the IdP metadata
- Enable SAML in your Helm values
Troubleshooting

Configure SAML-based single sign-on (SSO) for Kloudfuse in two parts: register Kloudfuse as a service provider with your identity provider (IdP), then give your Kloudfuse cluster the IdP’s metadata and turn on SAML in your Helm values.

Set up SAML in your identity provider

Set up your SAML based on the steps in BoxyHQ documentation.

Choose your IdP:

Use these values in the Service provider details section:

ACS URL

https://<your kloudfuse domain name>/api/oauth/saml

Entity ID

https://<your kloudfuse domain name>/samlresponse

Generate and download the IdP metadata XML file, or note its URL. You need it in Store the IdP metadata.

Set up SAML in Kloudfuse

Setting up SAML in Kloudfuse takes two steps:

Store the IdP metadata
Enable SAML in your Helm values

Store the IdP metadata

Save the metadata XML file from your IdP as kfuse.xml. If your IdP gave you a URL instead of a file, download it:
```
curl <metadata-xml-url> > kfuse.xml
```
Create a generic secret named kfuse-xml from the file, in the namespace where Kloudfuse runs. The command uses kfuse, the namespace the standard Helm install uses. If you installed Kloudfuse in a different namespace, use that namespace instead; the secret must be in the same namespace as the Helm release.
```
kubectl create secret generic kfuse-xml --from-file=kfuse.xml -n kfuse
```
If the kfuse-xml secret already exists, or you are re-creating it, see Troubleshooting.

Enable SAML in your Helm values

In your custom-values.yaml file, make these changes:
- Under global, set dnsName to your Kloudfuse domain name, and set kfuse-saml.enabled to true.
- Under kfuse-auth.oauth2-proxy.config, set saml-provider-name to the name of your SAML provider, and set existingSecret to kfuse-auth-saml. Kloudfuse creates the kfuse-auth-saml secret automatically when kfuse-saml is enabled.
Example: SAML with Okta
```
global:
  dnsName: <your kloudfuse domain name>
  kfuse-saml:
    enabled: true

kfuse-auth:
  oauth2-proxy:
    config:
      saml-provider-name: "Okta"
      existingSecret: "kfuse-auth-saml"
```
yaml

Apply the change with a Helm upgrade:

helm upgrade --install kfuse oci://us-east1-docker.pkg.dev/mvp-demo-301906/kfuse-helm/kfuse \
  -n kfuse \
  --version <VERSION> \ (1)
  -f custom-values.yaml

bash

1	Replace `<VERSION>` with a valid Kloudfuse release value. See Release Notes for the latest release.

Troubleshooting

If you re-create the kfuse-xml secret, for example to switch to a different IdP or to replace expired metadata, reset the SAML database so that Kloudfuse loads the new metadata:

Open a shell in the kfuse-configdb-0 pod, signed in to PostgreSQL. Replace kfuse with your Kloudfuse namespace if it differs:
```
kubectl exec -it kfuse-configdb-0 -n kfuse -- bash -c 'PGPASSWORD=$POSTGRES_PASSWORD psql -U postgres'
```
Check whether the samldb database exists:
```
\l
```
If it does, delete and re-create it:
```
DROP DATABASE samldb;
CREATE DATABASE samldb;
```
postgresql