DOCSEARCHbyAlgolia
Submit Docs

Ory Polis Documentation

repository·main·Indexed 25 days ago

https://github.com/ory/polis

Ory Polis is an open-source enterprise identity bridge that proxies SAML flows to OAuth 2.0/OIDC and provides SCIM 2.0-based directory synchronization for automated user provisioning. It can be integrated as a standalone service or as an NPM library (@boxyhq/saml-jackson). Key features include OAuth 2.0 flow abstraction, support for multiple databases (MySQL, Postgres, MongoDB, Redis, etc.), and flexible deployment options via the Ory Network managed service or self-hosted on-premise with the Ory Enterprise License (OEL).

Tokens
36.3K
Snippets
40
Records
246
Agent score
79%

What's inside Ory Polis

  1. What is Ory Polis?

    main

    Ory Polis (formerly BoxyHQ Jackson) is an open-source Enterprise Single Sign-On (SSO) service designed to connect applications to SAML and OIDC identity providers.

    Key features include:

    • SAML/OIDC Enterprise SSO: Connects to various enterprise identity systems by implementing SSO for SAML or OIDC providers.
    • OAuth 2.0 Flow Abstraction: Simplifies the SSO process by presenting it as a standard OAuth 2.0 flow, making it easier for developers familiar with OAuth 2.0 and OpenID Connect to integrate.
    • Data Ownership and Control: As an open-source solution, it can be self-hosted to maintain full control over data and customer identity information.
    • Flexible Database Support (BYOD): Supports a "Bring Your Own Database" model with built-in compatibility for MySQL, MariaDB, Postgres, MongoDB, Redis, and PlanetScale.
    • Modular Design: Uses a modular architecture with distinct controllers for business logic, allowing for flexible and incremental feature adoption.

  2. Directory Sync with SCIM 2.0

    main
    Ory Polis supports Directory Sync using the SCIM 2.0 (System for Cross-domain Identity Management) protocol. This allows organizations to automate the user lifecycle by automatically provisioning and de-provisioning users and groups in their target systems. This ensures a single source of truth for identity data and improves security by automating access removal.

  4. Create a SAML Connection in Rippling

    main

    To establish a SAML connection during the Rippling setup process, use the CreateSSOConnection component. You must provide the Identity Provider (IdP) metadata, which can be supplied in one of two ways:

    1. Metadata URL: Enter the direct URL to the IdP metadata.
    2. XML Content: Paste the raw XML content of the metadata file directly into the interface.

    The component requires a setupLinkToken to associate the connection with the current setup session and the idpType must be set to 'saml'.

    <CreateSSOConnection setupLinkToken={setupLinkToken} idpType='saml' />

  5. Configure a SAML Application in your Identity Provider

    main

    When setting up a SAML application in your Identity Provider (IdP) to work with Ory Polis, you must provide specific Service Provider (SP) configuration values.

    Important: Do not add a trailing slash at the end of the URLs. Use the exact values provided by your Polis instance.

    Required SAML Settings

    SettingRequired Value
    ResponseSigned
    Assertion SignatureSigned
    Signature AlgorithmRSA-SHA256
    Assertion EncryptionUnencrypted

    SP Configuration Values

    You must retrieve the following values from your deployed Polis service:

    • Reply URL (Assertion Consumer Service URL)
    • Identifier (Entity ID)

    You can access the metadata containing these values at your Polis instance's SAML configuration endpoint: /.well-known/saml-configuration.

  6. Configure ADFS Transform Rule for Email NameID

    main

    To prevent InvalidNameIDPolicy errors when using Microsoft ADFS, you must create a transform rule that maps the incoming Email-Address claim to the outgoing NameID (of type Email). By default, ADFS sends NameID as Unspecified, which is incompatible with the expected policy.

    You can implement this using the Claim rule language with the following rule:

    c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress");

  7. Configure Okta SAML settings for Ory Polis

    main

    To complete the Okta SSO setup, navigate to the SAML Settings section in your Okta application configuration and provide the following values:

    1. Single sign on URL: Use the Single sign on URL provided by your Ory Polis configuration.
    2. Audience URI (SP Entity ID): Use the Audience URI (SP Entity ID) provided by your Ory Polis configuration.
    3. Name ID format: Select EmailAddress from the dropdown menu.

    Ensure these values match the Service Provider (SP) configuration generated during the previous step to establish a successful SAML handshake.

  9. Create a SAML application in Azure

    main

    To set up a link with Azure, you must first create an Enterprise application in the Azure Admin console.

    1. Navigate to Enterprise applications in the left navigation menu of your Azure Admin console.
    2. If an application already exists for this purpose, select it from the list.
    3. If you need to create a new one, click New application.
    4. Select Create your own application from the options provided.
    5. Provide a Name for your application and click Create to finalize the initial setup.