docs(enterprise): add Authentik SAML provider guide (stacked on #799) - #800
Merged
rajshah4 merged 4 commits intoSep 15, 2026
Merged
Conversation
Add a provider-specific, tutorial-style page for configuring Authentik as a SAML identity provider, nested under the SAML SSO guide in the navigation. The page ends with the values to copy into the Replicated or Helm configuration. Link to it from Step 1 of the SAML SSO guide. Co-authored-by: openhands <openhands@all-hands.dev>
jpshackelford
added this pull request to stack #801
September 14, 2026 11:53
jpshackelford
marked this pull request as draft
September 14, 2026 11:57
Rework the Authentik SAML guide to follow the single 'New application' wizard (Application -> Choose a Provider -> Configure Provider -> Configure Bindings -> Review) rather than a separate provider/application flow. Correct the NameID setting to 'Default NameID Policy: Persistent', note that the default property mappings already include Email, and add the Service Provider Binding and digest/signature algorithm values, matching the real UI. Co-authored-by: openhands <openhands@all-hands.dev>
…dable icon Break Step 1 into sub-steps for the UI Settings: explain that the Launch URL and icon make OpenHands appear as a one-click tile on the Authentik User Dashboard, and provide a downloadable OpenHands icon users can upload. Co-authored-by: openhands <openhands@all-hands.dev>
Selecting a signing certificate reveals four signing toggles. Document that 'Sign assertions' is on by default (which is what OpenHands requires) and the others should stay off. Verified against the working reference deployment. Co-authored-by: openhands <openhands@all-hands.dev>
rajshah4
approved these changes
Sep 15, 2026
rajshah4
left a comment
rajshah4
left a comment
Member
There was a problem hiding this comment.
🟢 Good taste — a well-structured provider guide with no blocking grammar or clarity issues.
Source Verification
| Documentation claim | Verified? | Source evidence |
|---|---|---|
OpenHands uses the fixed SAML provider alias enterprise_sso |
✅ | Keycloak configuration script, lines 303–370 |
| OpenHands requires a metadata signing certificate and validates SAML signatures | ✅ | Keycloak configuration script, lines 316–350 |
| The configured identity-provider display name controls the provider display name | ✅ | Keycloak configuration script, lines 333–352 |
Helm passes the display name and metadata URL through enterpriseSSO values |
✅ | Deployment template, lines 77–86 |
The tutorial sequence is easy to follow, the provider-specific material is properly separated from the generic SAML guide, and the navigation/link checks pass. I found no grammar issue or confusing instruction worth delaying publication.
Risk assessment: 🟢 LOW — documentation-only addition, implementation-backed, and validated by CI and the author’s live deployment test.
Verdict: ✅ Worth merging after its base PR.
This review was generated by an AI agent (OpenHands) on behalf of the user.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on top of #799 (base branch is
docs-saml-sso-signing-cert, notmain). Review or merge #799 first; once #799 merges, GitHub will automatically retarget this PR tomain.What
Adds a provider-specific, tutorial-style guide for configuring Authentik as a SAML identity provider, nested below the SAML SSO page in the navigation.
enterprise/integrations/saml-providers/authentik.mdx— step-by-step Authentik setup (create SAML provider, attach property mappings, create application, optional access restriction, create a test user), ending with a "Values for OpenHands" section listing the SAML Metadata URL and Identity Provider Display Name to paste into Replicated or Helm.docs.json) — converts the flatsaml-ssoentry into a nested "SAML SSO" group so provider guides live beneath the main SSO page. Additional providers (Okta, Entra ID, etc.) can be added to the same group later.Notes
enterprise_sso/allhandsfixed identifiers, the signing-certificate requirement, and the bare.../metadata/URL) were verified against a working OpenHands Enterprise deployment brokering to Authentik.This PR was created by an AI agent (OpenHands) on behalf of the user.