đź“–
PixieBrix Documentation
🗝️

Configure SAML/SSO for PixieBrix

Step 1: Identity Provider (IDP) Configuration

ℹ️
We’re using JumpCloud as an IDP in the example below. However, the configuration should be similar for any vendor. Reach out to support@pixiebrix.com if you have any questions / concerns.
  1. Login to JumpCloud as an Administrator: https://console.jumpcloud.com/login/admin
    2. image
  2. Click “SSO” on the left side panel. Then click “Add New Application” > “Custom SAML App”
    3. image
  3. “General Info” tab
    1. Display Name: PixieBrix
  4. “SSO” tab
    1. Upload Metadata: Navigate to https://app.pixiebrix.com/api/saml/metadata/ and save the metadata to a file. Then upload the metadata to JumpCloud.
        2. image

        This should populate the following fields:

      1. Service Provider (SP) Entity ID
      2. ACS URL

        3. Note, you can manually fill the fields out if you want but uploading the metadata file is easier / less error-prone.

    2. IDP Entity ID:
      1. Note the IDP Entity ID
      2. If you do not already have an IDP Entity ID, contact support@pixiebrix.com
    3. User Attributes: PixieBrix requires certain attributes to provision a user from your IDP. You need to map attributes from your IDP to the Service Provider attributes PixieBrix expects.

      4. SAML defines Attribute Definitions for configuring Service Provider attributes. For example, urn:oid:0.9.2342.19200300.100.1.3 maps to the user’s email.

      PixieBrix requires the following attributes:

      Attribute Name
      Service Provider Attribute Name
      username
      urn:oid:0.9.2342.19200300.100.1.1
      email
      urn:oid:0.9.2342.19200300.100.1.3
      first Name
      urn:oid:2.5.4.42
      last Name
      urn:oid:2.5.4.4

      Once completed in JumpCloud, the “User Attributes” section should look like this:

      image
  5. “User Groups” tab
    1. Grant the users that should have access to log in with SAML. For example: the screenshot below shows granting the PixieBrix Engineering group access to the SAML App
      2. image

Step 2: Service Provider Configuration

PixieBrix needs certain data from the IDP to complete the integration. Please securely send support@pixiebrix.com the following information:

  • IDP Entity ID
  • IDP URL (aka SSO URL)
  • IDP Public Certificate: You can download this from the IDP.
    • In JumpCloud, you just need to click “Download Certificate”.
      • image

Optional: Configure the PixieBrix Browser Extension Policy

ℹ️
This feature is available since
âś…
Release 1.7.23

You can configure your PixieBrix Browser Extension Policy (Google Workspace, or GPO) to automatically authenticate with your configured IDP.

  1. Contact support@pixiebrix.com to receive the authentication flow URL
  2. Set the ssoUrl property for the managed browser extension settings. See more information on managed browser extension settings here:
Property
Value
ssoUrl
Authentication flow URL. Will have the form: https://app.pixiebrix.com/login/saml/?idp=<name>,<orgId>

Twitter