Configure SAML based SSO Authentication

From Customers:

Setup your SAML provider IdP following the steps provided in the link below for your Idp. For e.g. - For Google based SAML login, follow the steps

Enter following values in the Service provider details section:

ACS URL - https://<your kloudfuse domain name>/api/oauth/saml
Entity ID - https://<your kloudfuse domain name>/samlresponse

Generate Metadata (XML file) and save the file. Provide it to kloudfuse. It’s required to configure the kloudfuse connection with your SAML provider.

SAML Setup in Kloudfuse:

A. Metadata-Secret Setup

Rename the obtained metadata (XML) file to “kfuse.xml” exactly.
In the customer’s cluster and appropriate namespace, run this command
```
kubectl create secret generic kfuse-xml --from-file=kfuse.xml
```

If kfuse-xml secret exists already and if you are re-creating it, then follow the steps in the troubleshooting section below.

B. In the environment values.yaml file -

  kfuse-saml:
    enabled: true

Set the flag saml-provider-name to the customer’s SAML provider name in kfuse-auth config. For example, for Okta as the SAML provider -

kfuse-auth:
  oauth2-proxy:
    config:
      saml-provider-name: "Okta"

Ensure that flag “existingSecret” exists and is non-empty.

kfuse-auth:
  oauth2-proxy:
    config:
      existingSecret: "kfuse-auth-saml"

Now, do the general upgrade using the environment’s file.

Troubleshooting steps

Exec into kfuse-configdb shell.
```
k exec -it kfuse-configdb-0 -- bash
```
psql into the postgres
```
psql -U postgres
```
Check all tables and if samldb exist
```
\l
```
Delete and create the table samldb
```
drop database samldb;
createdb samldb
```