Skip to content
|
Kong Konnect
github-edit-pageEdit this page
report-issueReport an issue

Configure generic SSO for a Konnect Org

As an alternative to Kong Konnect’s native authentication, you can set up single sign-on (SSO) access to Konnect using OpenID Connect or SAML. This authentication method allows your users to log in to Kong Konnect using their IdP credentials, without needing a separate login. This topic covers configuring SSO for use with various identity providers.

If you want to configure Okta, please see the Okta configuration guide.

Map Konnect teams to IdP groups

Before you enable SSO, you have the option to map IdP groups to Konnect teams. By doing this, you can manage a user’s Konnect team membership directly through your IdP group membership.

After mapping is set up:

  • IdP users belonging to the mapped groups can log in to Konnect.
  • When a user logs into Konnect with their IdP account for the first time, Konnect automatically provisions an account with the relevant roles.
  • If your org already has non-admin Konnect users before mapping, on their next login they will be mapped to the teams defined by their IdP group membership.
  • An organization admin can view all registered users in Konnect, but cannot edit their team membership from the Konnect side. To manage automatically-created users, adjust user permissions through your IdP, or adjust the team mapping.

Any changes to the mapped IdP groups on the IdP-side are reflected in Kong Konnect. For example:

  • Removing a user from a group in your IdP also deactivates their Konnect account.
  • Moving a user from one group to another changes their team in Konnect to align with the new group-to-team mapping.

Prerequisites

  • Konnect must be added to your IdP as an application
  • Users that need to use SSO are added to your IdP tenant
  • Claims are set up in your IdP

Set up SSO in Konnect

The Konnect OIDC integration allows you to configure various identity providers. While technically any OIDC-compliant provider can be used, the following have been verified:

  • Okta
  • Azure Active Directory
  • Oracle Identity Cloud Service
  • Keycloak

  1. In Kong Konnect, click organizations icon Organization > Settings, and then click the Authentication Scheme tab.

  2. Click Configure for OIDC.

  3. Paste the issuer URI from your IdP in the Issuer URI field.

  4. Paste the client ID from your IdP in the Client ID field.

  5. Paste the client secret from your IdP in the Client Secret field.

  6. In the Organization Login Path box, enter a unique string that will be used in the URL your users use to log in. For example: examplepath.

    Requirements:

    • The path must be unique across all Konnect organizations. If your desired path is already taken, you must to choose another one.
    • The path can be any alphanumeric string.
    • The path does not require a slash (/).
  7. Optional: You can configure custom IdP-specific behaviors in the Advanced Settings of the OIDC configuration form. The following options are available:
    • Scopes: Specify the list of scopes Konnect requests from the IdP. By default, Konnect requests the openid, email, and profile scopes. The openid scope is required and cannot be removed.
    • Claim Mappings: Customize the mapping of required attributes to a different claim in the id_token Konnect receives from the IdP. By default, Konnect requires three attributes: Name, Email, and Groups. The values in these attributes are mapped as follows:
      • name: Used as the Konnect account’s full_name.
      • email: Used as the Konnect account’s email.
      • groups: Used to map users to teams defined in the team mappings upon login.
  8. Optional: To map existing teams from IdP groups to Konnect, do the following:
    1. Configure group claims in your IdP application. Be sure to add the following to the scope: openid, email, profile

    2. In Kong Konnect, go to organizations icon Organization > Settings, click the Team Mappings tab and do at least one of the following:

      • To manage user and team memberships in Konnect from the Organization settings, select the Konnect Mapping Enabled checkbox.
      • To assign team memberships by the IdP during SSO login via group claims mapped to Konnect teams, select the IdP Mapping Enabled checkbox and enter your IdP groups in the relevant fields.

      Each Konnect team can be mapped to one IdP group.

      For example, if you have a service_admin group in your IdP, you might map it to the Service Admin team in Konnect. You can hover over the info (i) icon beside each field to learn more about the team, or see the teams reference for more information.

      You must have at least one group mapped to save configuration changes.

    3. Click Save.
  9. After clicking Save, close the configuration dialog and from the OIDC context menu, click Enable OIDC.

The Konnect SAML integration allows you to configure various identity providers. While technically any SAML-compliant provider can be used, the following have been verified:

  • Okta
  • Azure Active Directory
  • Oracle Identity Cloud Service
  • Keycloak

  1. In Kong Konnect, click organizations icon Organization > Settings, and then click the Authentication Scheme tab.

  2. Click Configure for SAML.

  3. Enter the Metadata URL from your IdP in the IDP Metadata URL field.

  4. In the Login Path field, enter a unique string that will be used in the URL your users use to log in. For example: examplepath.

    Requirements:

    • The path must be unique across all Konnect organizations.
    • The path can be any alphanumeric string.
    • The path does not require a slash (/).

  5. After clicking Save, configure the SP Entity ID and Login URL on your SAML IdP.

  6. Optional: To map existing teams from IdP groups to Konnect, do the following:
    1. Configure group claims in your IdP application. Be sure to add the following to the scope: openid, email, profile

    2. In Kong Konnect, go to organizations icon Organization > Settings, click the Team Mappings tab and do at least one of the following:

      • To manage user and team memberships in Konnect from the Organization settings, select the Konnect Mapping Enabled checkbox.
      • To assign team memberships by the IdP during SSO login via group claims mapped to Konnect teams, select the IdP Mapping Enabled checkbox and enter your IdP groups in the relevant fields.

      Each Konnect team can be mapped to one IdP group.

      For example, if you have a service_admin group in your IdP, you might map it to the Service Admin team in Konnect. You can hover over the info (i) icon beside each field to learn more about the team, or see the teams reference for more information.

      You must have at least one group mapped to save configuration changes.

    3. Click Save.
  7. In Konnect, close the configuration dialog and click Enable SAML from the context menu.

Test and apply the configuration

Important: Keep built-in authentication enabled while you are testing IdP authentication. Only disable built-in authentication after successfully testing IdP authentication.

Test the SSO configuration by navigating to the login URI based on the organization login path you set earlier. For example: https://cloud.konghq.com/login/examplepath, where examplepath is the unique login path string set in the previous steps.

If the configuration is correct, you will see the IdP sign-in page.

You can now manage your organization’s user permissions entirely from the IdP application.

Troubleshooting

Troubleshooting authentication issues with large numbers of groups

If users are assigned a very large number of groups (over 150 in most cases), the IdP may send the groups claim in a non-standard manner, causing authentication issues.

To work around this limitation in the IdP, we recommend using group filtering functions provided by the IdP for this purpose. Here are some quick reference guides for common IdPs:

You may need to contact the support team of your identity provider in order to learn how to filter groups emitted for the application.