connection

Enterprise single sign-on connections: one customer’s identity provider, bound to the group its users sign in to. Manage them with howdy/auth/connections, after enabling them with auth.with_sso.

A connection’s identity provider is run by the customer, not by a party Howdy can pin. It may assert any address, so an address is only believed inside the connection’s own domains, and its users only ever land in the connection’s group.

Types

Config

opaque </>

Keep the encryption key outside the auth database; all nodes must use the same stable, 32-byte base64url key. It may be the MFA key. Rotate it with with_decryption_keys and connections.reseal.

pub opaque type Config

Connection

</>

pub type Connection {
  Connection(
    id: String,
    group_id: String,
    name: String,
    protocol: Protocol,
    domains: List(String),
    enabled: Bool,
    enforced: Bool,
    trusts_provider_mfa: Bool,
    created_at: timestamp.Timestamp,
    updated_at: timestamp.Timestamp,
  )
}

Constructors

```
Connection(
  id: String,
  group_id: String,
  name: String,
  protocol: Protocol,
  domains: List(String),
  enabled: Bool,
  enforced: Bool,
  trusts_provider_mfa: Bool,
  created_at: timestamp.Timestamp,
  updated_at: timestamp.Timestamp,
)
```
Arguments

name

Shown on the sign-in page, such as the customer’s name.

domains

Lowercase email domains that route to this connection, and the only ones whose asserted addresses it is believed about.

enforced

Whether the members it covers may sign in only through it; see connections.enforce.

trusts_provider_mfa

Whether a sign-in through it skips Howdy’s own second factor; see connections.trust_provider_mfa.

Protocol

</>

What the customer’s identity provider administrator hands over.

pub type Protocol {
  Oidc(
    issuer: String,
    client_id: String,
    client_secret: secret.Secret,
  )
  Saml(
    entity_id: String,
    sso_url: String,
    certificates: List(String),
  )
}

Constructors

```
Oidc(
  issuer: String,
  client_id: String,
  client_secret: secret.Secret,
)
```
OpenID Connect. Endpoints and keys are discovered at issuer, an HTTPS URL exactly as the provider publishes it.
```
Saml(
  entity_id: String,
  sso_url: String,
  certificates: List(String),
)
```
SAML 2.0. certificates are the provider’s PEM signing certificates: more than one only while it rotates. They are pinned; a certificate inside a response is never trusted.

Values

config

</>

pub fn config(
  encryption_key: String,
) -> Result(Config, service.Error)

oidc

</>

pub fn oidc(
  issuer issuer: String,
  client_id client_id: String,
  client_secret client_secret: String,
) -> Protocol

Construct an Oidc protocol from plain text.

to_json

</>

pub fn to_json(connection: Connection) -> json.Json

The client secret and certificates stay out of JSON.

with_decryption_keys

</>

pub fn with_decryption_keys(
  config: Config,
  keys: List(String),
) -> Result(Config, service.Error)

Keys that still decrypt connections but never encrypt new ones, replacing any given before. Rotate in the same three steps as mfa.with_decryption_keys, finishing with connections.reseal.

Constructors

Arguments

Constructors