> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO

> Sign in to self-hosted Asymptote through your SAML 2.0 or OpenID Connect identity provider.

> [!NOTE]
>
> **Planned release.** Self-hosted Asymptote is in development and offered to design partners through a Private Deployment engagement; the Helm chart and Terraform modules described in this section are not generally available yet. This section describes the planned release: chart names, values keys and paths may change before it ships. Today's Asymptote Cloud dashboard uses hosted services for sign-in and product analytics; the self-hosted release replaces them, as described in [System Architecture](https://docs.asymptotelabs.ai/self-hosting/system-architecture.md#hosted-services-in-asymptote-cloud). [Contact us](https://asymptotelabs.ai/contact) to take part.

Self-hosted Asymptote has no accounts of its own: people sign in through your identity provider, and their groups decide their role. Configure one provider per deployment, over OpenID Connect or SAML 2.0.

## Roles

| Role | Can |
| - | - |
| Admin | Everything, including policies, enforcement, integrations and users |
| Analyst | See all telemetry and findings, triage findings |
| Member | See only their own agent activity |

Map identity provider groups to roles with `auth.roleMapping` in the chart's values. Someone in no mapped group cannot sign in.

## OpenID Connect

**1. Create the application**

In your identity provider, create a web application with:

* Sign-in redirect URL: `https://<domain>/auth/callback`
* Sign-out redirect URL: `https://<domain>/`
* Scopes: `openid`, `profile`, `email`, and a `groups` claim

**2. Configure the chart**

```yaml title="values.yaml" theme={null}
auth:
  oidc:
    issuer: https://example.okta.com
    clientId: <client id>
    # client secret: the oidc-client-secret key in global.existingSecret
  roleMapping:
    admin: [asymptote-admins]
    analyst: [security-team]
    member: [engineering]
```

**3. Apply it** with `helm upgrade`, and sign in.

> [accordion] Okta
>
> Create an OIDC Web Application. Add a Groups claim to the ID token, filtered to the groups you map, and assign those groups to the application.

> [accordion] Microsoft Entra ID
>
> Register an application with the redirect URL as a Web platform URI, create a client secret, and add the `groups` optional claim to the ID token. The issuer is `https://login.microsoftonline.com/<tenant id>/v2.0`. Entra sends group object IDs; map those.

> [accordion] Google Workspace
>
> Create an OAuth client of type Web application. Google does not send groups in the token, so map roles by email domain or use SAML with group attributes instead.

## SAML 2.0

**1. Create the application** with:

* ACS URL: `https://<domain>/auth/saml/acs`
* Entity ID: `https://<domain>/auth/saml`
* Name ID: email address
* Attributes: `email`, `name`, and `groups`

**2. Configure the chart**

```yaml title="values.yaml" theme={null}
auth:
  saml:
    metadataUrl: https://idp.example.com/app/<id>/sso/saml/metadata
  roleMapping:
    admin: [asymptote-admins]
    analyst: [security-team]
    member: [engineering]
```

**3. Apply it** with `helm upgrade`, and sign in.

## Endpoint sign-in

People who install Beacon in user mode sign in to your deployment with `beacon login --auth-url https://<domain>`, which opens the same identity provider in a browser. See [Connecting Endpoints](https://docs.asymptotelabs.ai/self-hosting/connect-endpoints.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.