From 74a0336c653291f1ddb5d6403f875004d52469c5 Mon Sep 17 00:00:00 2001 From: ulziibay-kernel <253135130+ulziibay-kernel@users.noreply.github.com> Date: Mon, 26 Oct 2026 16:14:36 +0000 Subject: [PATCH 1/2] Add enterprise SSO docs page --- docs.json | 1 + info/enterprise.mdx | 1 + info/sso.mdx | 31 +++++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+) create mode 100644 info/sso.mdx diff --git a/docs.json b/docs.json index 4b9cca8c..e6b4e14b 100644 --- a/docs.json +++ b/docs.json @@ -304,6 +304,7 @@ "group": "Enterprise", "pages": [ "info/enterprise", + "info/sso", "info/hipaa", "info/zero-data-retention", "info/contact-sales" diff --git a/info/enterprise.mdx b/info/enterprise.mdx index 55df691b..ad883854 100644 --- a/info/enterprise.mdx +++ b/info/enterprise.mdx @@ -20,6 +20,7 @@ KERNEL signs a BAA on the Enterprise plan. See [HIPAA](/info/hipaa) for what KER | --- | --- | | Concurrency and rate limits | Custom limits for concurrency and browser creation. See [concurrency and limits](/browsers/concurrency-and-limits). | | Audit logs | [Continuous export to S3](/info/audit-logs#continuous-s3-export), in addition to search and download | +| Single sign-on (SSO) | [SAML 2.0 and OIDC](/info/sso) connections to your identity provider | | Replay retention | Custom [replay](/browsers/replays) retention | | [Support](/info/support) | A shared Slack channel, with tiered response times | | Data processing | [DPA](/dpa) | diff --git a/info/sso.mdx b/info/sso.mdx new file mode 100644 index 00000000..1950f3a3 --- /dev/null +++ b/info/sso.mdx @@ -0,0 +1,31 @@ +--- +title: "Single Sign-On (SSO)" +sidebarTitle: "SSO" +description: "Sign in to Kernel with your corporate identity provider on the Enterprise plan" +--- + +Single sign-on (SSO) lets your team sign in to the Kernel dashboard with their corporate identity provider (IdP) instead of a Kernel email and password. SSO is included in the [Enterprise plan](/info/enterprise). + +Connections are configured per organization and scoped to your email domain: anyone signing in with an address at that domain is redirected to your IdP. Accounts are created on first sign-in, and existing accounts at the domain are linked automatically. + +Kernel's SSO runs on [Clerk](https://clerk.com). For protocol details, claim mappings, and per-provider setup walkthroughs, refer to [Clerk's enterprise SSO documentation](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/overview). + +## Supported identity providers + +| Protocol | Providers | +| --- | --- | +| SAML 2.0 | [Microsoft Entra ID](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/azure) (formerly Azure AD), [Okta Workforce](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/okta), [Google Workspace](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/google), or [any other SAML 2.0 provider](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/custom-provider) | +| OpenID Connect | [Any OIDC-compatible provider](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/oidc/custom-provider) | + +## User provisioning + +- **Just-in-time** — accounts are created the first time someone signs in through your IdP, so there's nothing to provision before your team gets started. +- **SCIM directory sync** (available on request) — [Clerk's Directory Sync](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/directory-sync) keeps Kernel accounts in sync with your IdP directory: accounts are created as people join, updated as their attributes change, and deactivated — revoking their active sessions — when they leave. Works with Microsoft Entra ID, Okta, and any provider that supports SCIM 2.0; Google Workspace syncs through its Admin SDK. + +## MFA + +Your IdP's multi-factor policy applies to SSO sign-ins. Users can also add a TOTP second factor on their Kernel account. + +## Getting started + +Setting up SSO is a short metadata exchange between Kernel and your IT team — reply URLs, entity IDs, and certificates for SAML, or a discovery URL for OIDC. To scope it for your organization, [contact sales](/info/contact-sales). \ No newline at end of file From 07150cae7476870634ed80abc9d67ec8e93fde90 Mon Sep 17 00:00:00 2001 From: ulziibay-kernel <253135130+ulziibay-kernel@users.noreply.github.com> Date: Mon, 26 Oct 2026 16:31:31 +0000 Subject: [PATCH 2/2] Describe SSO integrations without naming the identity vendor --- info/sso.mdx | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/info/sso.mdx b/info/sso.mdx index 1950f3a3..2559043b 100644 --- a/info/sso.mdx +++ b/info/sso.mdx @@ -6,21 +6,21 @@ description: "Sign in to Kernel with your corporate identity provider on the Ent Single sign-on (SSO) lets your team sign in to the Kernel dashboard with their corporate identity provider (IdP) instead of a Kernel email and password. SSO is included in the [Enterprise plan](/info/enterprise). -Connections are configured per organization and scoped to your email domain: anyone signing in with an address at that domain is redirected to your IdP. Accounts are created on first sign-in, and existing accounts at the domain are linked automatically. - -Kernel's SSO runs on [Clerk](https://clerk.com). For protocol details, claim mappings, and per-provider setup walkthroughs, refer to [Clerk's enterprise SSO documentation](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/overview). +Connections are configured per organization and scoped to your email domain: anyone signing in with an address at that domain is redirected to your IdP. Subdomains can be allowed if your team spans more than one. Accounts are created on first sign-in, and existing accounts with matching email addresses are linked automatically. ## Supported identity providers | Protocol | Providers | | --- | --- | -| SAML 2.0 | [Microsoft Entra ID](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/azure) (formerly Azure AD), [Okta Workforce](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/okta), [Google Workspace](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/google), or [any other SAML 2.0 provider](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/saml/custom-provider) | -| OpenID Connect | [Any OIDC-compatible provider](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/oidc/custom-provider) | +| SAML 2.0 | Microsoft Entra ID (formerly Azure AD), Okta Workforce, Google Workspace, or any other SAML 2.0 provider | +| OpenID Connect | Any OIDC-compatible provider | + +Both service provider-initiated and IdP-initiated sign-in flows are supported for SAML connections. ## User provisioning - **Just-in-time** — accounts are created the first time someone signs in through your IdP, so there's nothing to provision before your team gets started. -- **SCIM directory sync** (available on request) — [Clerk's Directory Sync](https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/directory-sync) keeps Kernel accounts in sync with your IdP directory: accounts are created as people join, updated as their attributes change, and deactivated — revoking their active sessions — when they leave. Works with Microsoft Entra ID, Okta, and any provider that supports SCIM 2.0; Google Workspace syncs through its Admin SDK. +- **Directory sync** (available on request) — Kernel accounts stay in sync with your IdP's directory: people are added as they join, their attributes update as they change, and they're deactivated — with their active sessions revoked — when they leave. Supported for Microsoft Entra ID, Okta, Google Workspace, and other directory providers. ## MFA @@ -28,4 +28,4 @@ Your IdP's multi-factor policy applies to SSO sign-ins. Users can also add a TOT ## Getting started -Setting up SSO is a short metadata exchange between Kernel and your IT team — reply URLs, entity IDs, and certificates for SAML, or a discovery URL for OIDC. To scope it for your organization, [contact sales](/info/contact-sales). \ No newline at end of file +Setting up SSO is a short metadata exchange between Kernel and your IT team: Kernel shares the reply URL and entity ID for your IdP's SAML application (or the parameters your provider needs for OIDC), and your team shares your IdP's federation metadata. To scope it for your organization, [contact sales](/info/contact-sales). \ No newline at end of file