Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: add to oauth docs #457

Merged
merged 1 commit into from
Oct 2, 2024
Merged

chore: add to oauth docs #457

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions versioned_docs/version-2.0/self_hosting/configuration/sso.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,19 +4,24 @@ import {
HelmBlock,
} from "../../../../src/components/InstructionsWithCode";

# SSO
# SSO with OAuth2.0 and OIDC

## OAuth2.0 and OIDC (PKCE)
LangSmith Self-Hosted provides SSO via OAuth2.0 and OIDC. This will delegate authentication to your Identity Provider (IdP) to manage access to LangSmith.

LangSmith Self-Hosted provides SSO via OAuth2.0 and OIDC. Once configured, this will delegate authentication to your Identity Provider(IdP) to manage access to LangSmith.
Our implementation supports almost anything that is OIDC compliant, with a few exceptions.
Once configured, you will see a login screen like this:

![LangSmith UI with OAuth SSO](../static/langsmith_ui_sso.png)

## Without Client Secret (PKCE) {#without-secret}

Our implementation supports almost anything that is OIDC compliant, with a few exceptions.
This flow does _not_ require a `Client Secret` - see the flow [below](#with-secret) for the alternative that does.

### Requirements

There are a couple of requirements for using OAuth SSO with LangSmith:

- Your IdP must support the `Authorization Code with PKCE` [flow](https://www.oauth.com/oauth2-servers/pkce) (Google does not support this flow for example, but see [below](#using-oauth10-and-oidc) for an alternative configuration that Google supports). This is often displayed in your OAuth Provider as configuring a "Single Page Application (SPA)"
- Your IdP must support the `Authorization Code with PKCE` [flow](https://www.oauth.com/oauth2-servers/pkce) (Google does not support this flow for example, but see [below](#with-secret) for an alternative configuration that Google supports). This is often displayed in your OAuth Provider as configuring a "Single Page Application (SPA)"
- Your IdP must support using an external discovery/issuer URL. We will use this to fetch the necessary routes and keys for your IdP.
- You must provide the `OIDC`, `email`, and `profile` scopes to LangSmith. We use these to fetch the necessary user information and email for your users.
- You will need to set the callback URL in your IdP to `http://<host>/oauth-callback`, where host is the domain or IP you have provisioned for your LangSmith instance. This is where your IdP will redirect the user after they have authenticated.
Expand All @@ -39,13 +44,10 @@ OAUTH_ISSUER_URL=https://your-issuer-url
]}
/>

Once configured, you will see a login screen like this:

![LangSmith UI with OAuth SSO](../static/langsmith_ui_sso.png)

## OAuth2.0 and OIDC (without PKCE)
## With Client Secret {#with-secret}

For providers that do _not_ support `Authorization Code with PKCE`, LangSmith Self-Hosted supports the `Autorization Code` flow with a `Client Secret`.
For providers that do _not_ support `Authorization Code with PKCE`, LangSmith Self-Hosted supports the `Autorization Code` flow with `Client Secret`.
In this version of the flow, your client secret is stored security in the LangSmith platform (not on the frontend) and used for authentication and establishing auth sessions.

### Requirements

Expand Down
Loading