Skip to main content

Add FusionAuth as an identity provider

Use FusionAuth to give your organization users single sign-on (SSO) access to Aiven.

Step 1: Add the IdP in the Aiven Console​

  1. In the organization, click Admin.
  2. Click Identity providers.
  3. Click Add identity provider.
  4. Select an identity provider and enter a name.
  5. Select a verified domain to link this IdP to. Users see linked IdPs on the login page.

On the Configuration step are two parameters that you use to set up the SAML authentication in your IdP:

  • Metadata URL
  • ACS URL

Step 2: Configure SAML on FusionAuth​

The setup on FusionAuth has three parts:

  • Create an API key
  • Generate a custom RSA certificate
  • Create an application

Create an API key​

  1. In FusionAuth, go to Settings > API Keys.

  2. Click the Add icon.

  3. Enter a description for the key.

  4. In the Endpoints list, find /api/key/import.

  5. Toggle on POST.

  6. Click the Save icon.

    Creating an API key.

  7. On the API Keys page, find your key and click the value in the Key column.

  8. Copy the whole key. You'll use this for the script.

    Copying the API key value.

  9. To clone the FusionAuth example scripts GitHub repository, run:

    git clone git@github.com:FusionAuth/fusionauth-example-scripts.git
    cd fusionauth-example-scripts/v3-certificate

  10. Run the generate-certificate script.

    ./generate-certificate

  11. Name the key.

  12. Copy the generated certificate created by the script.

You now have a certificate in the Key Master in your FusionAuth instance.

Create an application​

  1. In Applications, click the Add icon.
  2. Enter a name for the application.
  3. On the SAML tab, toggle on Enabled.
  4. In the Issuer field, enter the Metadata URL from the Aiven Console.
  5. In the Authorized redirect URLs field, enter the ACS URL from the Aiven Console.
  6. In the Authentication response section, change the Signing key to the API key you created.
  7. Click the Save icon.
  8. On the Applications page, click the magnifying glass.
  9. In the SAML v2 Integration details section, copy the Entity Id and Login URL.

Step 3: Finish the configuration in Aiven​

Go back to the Aiven Console to complete setting up the IdP. If you saved your IdP as a draft, you can open the settings by clicking the name of the IdP.

  1. In the IDP URL field, enter the Login URL from FusionAuth.
  2. In the Entity ID field, enter the Entity ID from FusionAuth.

  1. Paste the certificate from the IdP into the Certificate field.

  2. Optional: Paste or upload a JSON file with configuration details for your IdP.

  3. Click Next.

  4. Configure the security options for this IdP and click Next.

    • Require authentication context: This lets the IdP enforce stricter security measures to help prevent unauthorized access, such as requiring multi-factor authentication.

    • Require assertion to be signed: The IdP checks for a digital signature. This security measure ensures the integrity and authenticity of the assertions by verifying that they were issued by a trusted party and have not been tampered with.

    • Sign authorization request sent to IdP: A digital signature is added to the request to verify its authenticity and integrity.

    • Extend active sessions: This resets the session duration every time the token is used.

    • Enable group syncing: This syncs the group membership from your IdP to the Aiven Platform.

      note
      • The Aiven Platform doesn't create groups with this feature. It only syncs the group membership between the groups in your IdP and the groups you create in Aiven. For user group provisioning, use SCIM.
      • User group membership automatically syncs when a user logs in.
      • The IdP is the single source of truth. If a group in the IdP doesn't exist in Aiven, it will be ignored. Likewise, if a user is added to a group in Aiven Console but not in the IdP, they will be removed from the Aiven group when the group membership syncs.

  5. Optional: Select a user group to add all users who sign up with this IdP to.

  6. Click Finish to complete the setup.

note

If you set up a SAML authentication method before and are now switching to a new IdP, existing users need to log in with the new account link URL to finish the setup.