# Authentik Follow the steps documented below to integrate your Org and Authentik Organizations for Single Sign On (SSO). Important Only users with "Organization Admin" privileges can configure SSO in the Rafay Console. --- ## Step 1: Create Group - Login into the Rafay Console as an Organization Admin - Click on System and select **Groups** - Click on **New Group** - Provide a name and optionally, a Description - Click **Create** --- ## Step 2: Assign Group to Project - After creating the group, go to the **Projects** tab and click **Assign Group to Project** - Select a project from the drop-down, then choose a base role or a custom role - Click **Save & Exit** --- ## Step 3: Create Group in Authentik - Log in to your **Authentik** organization as an **Administrator** - Select **Groups** under **Directory**, and click **Create** - Enter the same group name used in the Rafay Console (e.g., `demo-ssogroup`), and click **Create** --- ## Step 4: Create IdP - Login into the Rafay Console as an Organization Admin - Click on System and select **Identity Providers** - Click on **New Identity Provider** - Provide a name, select "Custom" from the IdP Type drop down - Enter the **domain** for which you would like to enable SSO - Provide an admin email who can access the Authentik Important Within an org, the domain of an IdP cannot be used for another IdP. A domain existing in an org can be used in multiple orgs (for one IdP in each org) - Optionally, toggle **Encryption** if you wish to send/receive encrypted SAML assertions - Provide the **Group** attribute `http://schemas.xmlsoap.org/claims/Group` - Optionally, toggle "Include Authentication Context" if you wish to send/receive auth context information in assertion - Click on **Save & Continue** Important Encrypting SAML assertions is optional because privacy is already provided at the transport layer using HTTPS. Encrypted assertions provide an additional layer of security on top ensuring that only the SP (Org) can decrypt the SAML assertion. --- ## Step 5: View SP Details The IdP configuration wizard will display critical information that you need to copy/paste into your Authentik Org. Provide the following information to your Authentik administrator. - Assertion Consumer Service (ACS) URL - SP Entity ID - Name ID Format --- ## Step 6: Create User in Authentik - On the **Authentik** page, select **Users** under **Directory**, and click **Create** - Provide a username, name, and email ID using the same domain name shown in the console (e.g., `democompany.com`) - Click **Create** --- ## Step 7: Add User to the Group - Once the user is created, click on the user and select the **Groups** tab - Click **Add to Existing Group**, and then click the `+` icon - Select the group from the list (e.g., `demo-ssogroup`), and click **Add** - If the user already exists in the system, select the username from the available options and click **Add** to proceed. To add a new user manually, enter the `username`, `name`, and `email address` using the domain displayed in the Rafay console (for example, `democompany.com`) - Click **Create** Once the user is added to the group, navigate to the **Groups** page to view the newly added user in the group. --- ## Step 8: Create Application - On the **Authentik** page, select **Applications** under the **Applications** menu, and click **Create with Provider** - Provide a name and enter the same group name used in the Rafay Console (e.g., `demo-ssogroup`) - Click **Next** - Choose the provider type **SAML Provider**, and click **Next** The **Configure SAML Provider** page appears - Select the authorization flow (either _implicit_ or _explicit_) from the drop-down - Copy and paste the ACS URL (refer to Step 5) from the Rafay Console into the **ACS URL** and **Issuer** text boxes - Select `Post` for **Service Provider Binding** - Under **Advanced Flow Settings**, select the _Authentication flow_ as `default-authentication-flow (Welcome to authentik!)` - Under **Advanced Protocol Settings**, select the _Signing Certificate_ as `authentik Self-signed Certificate` - Select the **NameID Property Mapping** as `authentik default SAML Mapping: Email` - Provide the remaining details as required, and click **Next** - Optionally, to create a Policy/User/Group binding, click **Bind existing policy/group/user** - Since the group is already created, select the **Group** tab and choose the group from the drop-down (e.g., `demo-ssogroup`) - Click **Save Binding** and then, **Next** - Once all the details are provided, click **Submit** --- ## Step 9: Specify IdP Metadata Copy the "Identity Provider Metadata" URL from the Authentik using the below steps - Open the **Providers** page, click on the provider created - Click on **Copy download URL** - Navigate to the Rafay Console's IdP configuration wizard and paste the Identity Provider Metadata URL from Authentik - Click **Save & Exit** to complete the IdP Registration - Once this process is complete, you can view details about the IdP configuration on the Identity Provider page. - You can also edit and update the configuration if required. --- ## Step 10: Impersonate the User Once all configurations are completed, use the **Impersonate** option to verify the user's access and application view. **Impersonation** allows administrators to temporarily log in as a specific user without their credentials. This is useful for validating access, testing SSO configuration, and ensuring the user is mapped correctly to the intended applications. - On the Authentik user details page, click **Impersonate**. After impersonating the user, the **My Applications** page appears, showing the applications assigned to the user's group (e.g., `demo-ssogroup`). - Click on the application card (e.g., **user-login**) to initiate SSO and verify that it redirects to the **Rafay Console** as expected.