Skip to main content
Planned release. Self-hosted Asymptote is in development and offered to design partners through a Private Deployment engagement; the Helm chart and Terraform modules described in this section are not generally available yet. This section describes the planned release: chart names, values keys and paths may change before it ships. Today’s Asymptote Cloud dashboard uses hosted services for sign-in and product analytics; the self-hosted release replaces them, as described in System Architecture. Contact us to take part.
Self-hosted Asymptote has no accounts of its own: people sign in through your identity provider, and their groups decide their role. Configure one provider per deployment, over OpenID Connect or SAML 2.0.

Roles

Map identity provider groups to roles with auth.roleMapping in the chart’s values. Someone in no mapped group cannot sign in.

OpenID Connect

1. Create the application In your identity provider, create a web application with:
  • Sign-in redirect URL: https://<domain>/auth/callback
  • Sign-out redirect URL: https://<domain>/
  • Scopes: openid, profile, email, and a groups claim
2. Configure the chart
values.yaml
3. Apply it with helm upgrade, and sign in.
Create an OIDC Web Application. Add a Groups claim to the ID token, filtered to the groups you map, and assign those groups to the application.
Register an application with the redirect URL as a Web platform URI, create a client secret, and add the groups optional claim to the ID token. The issuer is https://login.microsoftonline.com/<tenant id>/v2.0. Entra sends group object IDs; map those.
Create an OAuth client of type Web application. Google does not send groups in the token, so map roles by email domain or use SAML with group attributes instead.

SAML 2.0

1. Create the application with:
  • ACS URL: https://<domain>/auth/saml/acs
  • Entity ID: https://<domain>/auth/saml
  • Name ID: email address
  • Attributes: email, name, and groups
2. Configure the chart
values.yaml
3. Apply it with helm upgrade, and sign in.

Endpoint sign-in

People who install Beacon in user mode sign in to your deployment with beacon login --auth-url https://<domain>, which opens the same identity provider in a browser. See Connecting Endpoints.