1
0
mirror of https://github.com/Unleash/unleash.git synced 2025-11-24 20:06:55 +01:00

update deploy, how-to, and single sign-on

This commit is contained in:
melindafekete 2025-11-19 18:21:10 +01:00
parent 9a99e2e445
commit d29f3b3d6b
No known key found for this signature in database
34 changed files with 179 additions and 104 deletions

View File

@ -54,7 +54,7 @@ For a comprehensive and interactive reference of all available endpoints, Unleas
:::note Availability
**Unleash version**: `5.2+` enabled by default.
**Unleash version**: `4.13+` can be enabled using the `ENABLE_OAS` [environment variable](using-unleash/deploy/configuring-unleash).
**Unleash version**: `4.13+` can be enabled using the `ENABLE_OAS` [environment variable](/deploy/configuring-unleash).
:::
You can access the specification from your Unleash instance at the following paths:

View File

@ -28,6 +28,6 @@ Unleash uses [semantic versioning](https://semver.org/) with release notes avail
Unleash Cloud is a hosted service with continuous delivery. For transparency, we append build metadata to the base semantic version for every deployment. For example, in `7.0.10+6945.8192287`, `7.0.10` is the base release and `+6945.8192287` identifies the exact build.
If you're self-hosting Unleash, see [Upgrading Unleash](../using-unleash/deploy/upgrading-unleash) for how to keep your instance up to date.
If you're self-hosting Unleash, see [Upgrading Unleash](/deploy/upgrading-unleash) for how to keep your instance up to date.
[Unleash Edge](https://github.com/Unleash/unleash-edge) and our [SDKs](/reference/sdks) are versioned and released independently of Unleash. We recommend upgrading your SDKs and Unleash Edge to the latest versions to ensure compatibility, optimal performance, and access to the latest features and security updates.

View File

@ -10,7 +10,7 @@ import SearchPriority from '@site/src/components/SearchPriority';
import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem';
This guide explains how to configure your self-hosted Unleash instance when running it via [Docker Compose or the Docker CLI](/using-unleash/deploy/getting-started).
This guide explains how to configure your self-hosted Unleash instance when running it via [Docker Compose or the Docker CLI](/deploy/getting-started).
When running Unleash using Docker, configuration is managed through environment variables.
@ -116,7 +116,7 @@ If you experience intermittent database connection errors or timeouts, particula
### Back up and restore the database
It is highly recommended to back up your Unleash database, especially before [upgrades](/using-unleash/deploy/upgrading-unleash) or significant changes. When running PostgreSQL within a Docker container, use `docker exec` to run the standard `pg_dump` (backup) and `psql` (restore) commands inside the container.
It is highly recommended to back up your Unleash database, especially before [upgrades](/deploy/upgrading-unleash) or significant changes. When running PostgreSQL within a Docker container, use `docker exec` to run the standard `pg_dump` (backup) and `psql` (restore) commands inside the container.
1. **Identify container name**: Find your PostgreSQL container's name or ID (for example, using `docker ps`).

View File

@ -2,7 +2,7 @@
title: Getting started
description: "Initial steps for setting up a self-hosted Unleash instance with Docker."
toc_max_heading_level: 3
pagination_next: using-unleash/deploy/configuring-unleash
pagination_next: deploy/configuring-unleash
---
import Tabs from '@theme/Tabs';
@ -11,7 +11,7 @@ import SearchPriority from '@site/src/components/SearchPriority';
<SearchPriority level="high" />
Unleash offers several [hosting options](/understanding-unleash/hosting-options), including fully self-hosted setups. This guide helps you set up Unleash Open Source or Unleash Enterprise in your own environment using Docker.
Unleash offers several [hosting options](/deploy/hosting-options), including fully self-hosted setups. This guide helps you set up Unleash Open Source or Unleash Enterprise in your own environment using Docker.
Alternatively, for Unleash Enterprise, you can sign up for a [cloud-hosted instance](https://www.getunleash.io/pricing).
@ -140,7 +140,7 @@ The first time Unleash starts, it creates this default `admin` user. To use diff
### Install your license
If you are running Unleash Enterprise, you need to install a [license key](/using-unleash/deploy/license-keys#get-a-new-license). You'll receive a license key as part of your trial or from your account representative.
If you are running Unleash Enterprise, you need to install a [license key](/deploy/license-keys#get-a-new-license). You'll receive a license key as part of your trial or from your account representative.
In the Admin UI, go to **Admin > License**, copy the license key you received by email and click **Update license key**.

View File

@ -95,7 +95,7 @@ In this model, you host and manage all components: the Unleash API server, the d
This option offers maximum flexibility and control over your feature management infrastructure but requires the most operational effort.
In addition to [configuring Edge](#configure-edge), you must also set up the Unleash server and its database following our [self-hosting guide](../using-unleash/deploy/getting-started).
In addition to [configuring Edge](#configure-edge), you must also set up the Unleash server and its database following our [self-hosting guide](/deploy/getting-started).
## Unleash Edge options

View File

@ -9,7 +9,7 @@ This guide provides recommendations for upgrading your self-hosted Unleash insta
Unleash aims to support client SDKs connecting to a server version that is one major version newer than the client, facilitating gradual upgrades.
Before you begin any major version upgrade, we strongly recommend performing a [full backup of your PostgreSQL database](/using-unleash/deploy/configuring-unleash#back-up-and-restore-the-database). This ensures you can restore your instance if issues occur during the upgrade.
Before you begin any major version upgrade, we strongly recommend performing a [full backup of your PostgreSQL database](/deploy/configuring-unleash#back-up-and-restore-the-database). This ensures you can restore your instance if issues occur during the upgrade.
## Upgrading from v6 to v7
Unleash v7, released in June 2025, introduced several key changes. Ensure you address the following before or during your upgrade to v7.
@ -157,7 +157,7 @@ Plan to upgrade your PostgreSQL instance to a supported version before or alongs
### License key required for self-hosted Enterprise
Starting with v6, self-hosted Unleash Enterprise instances require a valid license key to function. Obtain your [license key](/using-unleash/deploy/license-keys) before upgrading and ensure the license key is configured correctly.
Starting with v6, self-hosted Unleash Enterprise instances require a valid license key to function. Obtain your [license key](/deploy/license-keys) before upgrading and ensure the license key is configured correctly.
### Passport libraries removed from Open Source Docker distribution
@ -201,7 +201,7 @@ Unleash v5 drops support for Node.js versions below 18, which was the active LTS
### The Google Authenticator provider for SSO removed
The Google Authenticator, deprecated in v4, has now been removed. Migrate to using [OpenID Connect](../../how-to/how-to-add-sso-open-id-connect.md) instead.
The Google Authenticator, deprecated in v4, has now been removed. Migrate to using [OpenID Connect](/single-sign-on/how-to-add-sso-open-id-connect) instead.
If you are running a self-hosted version of Unleash and you need to temporarily re-enable the Google Authenticator SSO, you can do so by setting the `GOOGLE_AUTH_ENABLED` environment variable to `true`. If you're running a hosted version of Unleash, you'll need to contact support to request re-enabling the flag.
@ -279,7 +279,7 @@ Read more in the [API token documentation](/guides/how-to-create-api-tokens).
### Configuring Unleash
The options for configuring Unleash changed significantly in v4. If you are manually configuring Unleash, review the updated [configuring Unleash](/using-unleash/deploy/configuring-unleash) documentation.
The options for configuring Unleash changed significantly in v4. If you are manually configuring Unleash, review the updated [configuring Unleash](/deploy/configuring-unleash) documentation.
### Introduced role-based access control
@ -313,4 +313,4 @@ In v3 you could still enable the legacy routes via the `enableLegacyRoutes` opti
### Unleash CLI removed
Unleash no longer ships with a binary that allows you to start Unleash directly from the command line. We recommend that you run Unleash [using Docker](/using-unleash/deploy/getting-started).
Unleash no longer ships with a binary that allows you to start Unleash directly from the command line. We recommend that you run Unleash [using Docker](/deploy/getting-started).

View File

@ -164,7 +164,7 @@ curl https://z5w5lkzlsozutfhaixbjsj27cm0dhnfh.lambda-url.eu-north-1.on.aws
Mastering feature flags in serverless? This guide demonstrated the surprisingly simple use of Unleash SDK. Remember, avoid initializing the SDK multiple times within your serverless function for smooth operation.
Need to scale your AWS Lambda function to thousands of requests per second (RPS)? Consider [Unleash Edge](/understanding-unleash/hosting-options#unleash-edge-options), which uses edge computing to scale your Unleash usage. You can scale in any matter you see fit - either hosted entirely in your infrastructure on your own edge services or fully managed by Unleash.
Need to scale your AWS Lambda function to thousands of requests per second (RPS)? Consider [Unleash Edge](/deploy/hosting-options#unleash-edge-options), which uses edge computing to scale your Unleash usage. You can scale in any matter you see fit - either hosted entirely in your infrastructure on your own edge services or fully managed by Unleash.
:::note Lambda Latency

View File

@ -38,7 +38,7 @@ This persistence ensures your application remains functional not only through ne
For a deeper dive, explore the [Unleash architecture overview](/get-started/unleash-overview).
## Choosing the right deployment option
How you set up Unleash to scale depends significantly on the [hosting option](/understanding-unleash/hosting-options) you choose. Unleash offers [flexible deployment models](https://www.getunleash.io/pricing) to match your operational preferences and requirements. Let's recap the three main options.
How you set up Unleash to scale depends significantly on the [hosting option](/deploy/hosting-options) you choose. Unleash offers [flexible deployment models](https://www.getunleash.io/pricing) to match your operational preferences and requirements. Let's recap the three main options.
<Tabs groupId="unleash-deployment-options">
@ -55,7 +55,7 @@ How you set up Unleash to scale depends significantly on the [hosting option](/u
- **How it works**: You deploy, manage, and scale all Unleash components (Unleash API server, database, [Admin UI](/get-started/unleash-overview#the-unleash-admin-ui), [Unleash Edge](/reference/unleash-edge)) within your own infrastructure (cloud or on-premises).
- **Ideal for**: Organizations with strict regulatory environments requiring full data and infrastructure control, air-gapped networks, or those with strong preferences and capabilities for managing their own software infrastructure.
- **Scaling and infrastructure**: You are responsible for architecting for high availability (for example, Multi-AZ API deployment, database clusters), scaling [compute resources and database capacity planning](/using-unleash/deploy/configuring-unleash#resource-recommendations), backups, disaster recovery strategies, monitoring, handling upgrades of Unleash and Unleash Edge and other and security updates.
- **Scaling and infrastructure**: You are responsible for architecting for high availability (for example, Multi-AZ API deployment, database clusters), scaling [compute resources and database capacity planning](/deploy/configuring-unleash#resource-recommendations), backups, disaster recovery strategies, monitoring, handling upgrades of Unleash and Unleash Edge and other and security updates.
- **Key tradeoff**: Maximum control over data and infrastructure, at the cost of significant SRE/DevOps expertise, resources, and ongoing operational effort.
</TabItem>
@ -82,7 +82,7 @@ Utilize Auto Scaling Groups (ASGs) or similar mechanisms in cloud environments t
### Database
A [PostgreSQL database](/using-unleash/deploy/configuring-unleash#resource-recommendations) that stores all configurations, feature flags, strategies, context fields, metrics, and audit logs. It is the critical stateful component.
A [PostgreSQL database](/deploy/configuring-unleash#resource-recommendations) that stores all configurations, feature flags, strategies, context fields, metrics, and audit logs. It is the critical stateful component.
The database layer must be performant and highly available. Use managed database services (such as AWS RDS for PostgreSQL) configured for high availability and backups.
@ -147,7 +147,7 @@ Key benefits:
Scale the number of Unleash API instances horizontally (by increasing the replica count behind a load balancer) or vertically (by increasing the CPU and memory limits and requests per instance) based on observed bottlenecks and traffic patterns.
Read more details in the [Unleash deployment and self-hosting guides](/using-unleash/deploy/getting-started).
Read more details in the [Unleash deployment and self-hosting guides](/deploy/getting-started).
</details>
@ -170,7 +170,7 @@ Configure the following:
Scale the database instance vertically (to a larger instance size) or horizontally (by adding read replicas) based on observed bottlenecks.
Read more details in the [self-hosting guide](/using-unleash/deploy/getting-started).
Read more details in the [self-hosting guide](/deploy/getting-started).
</details>
@ -178,7 +178,7 @@ Configure the following:
SDK caching provides resilience against temporary database unavailability for flag evaluations, but we still recommend that you configure high-availability for the database to maintain key functionality like flag configuration updates and Admin UI access.
Configure automatic failover for your database (managed services typically handle this). Failover within a region should ideally complete in less than a few minutes. Ensure [full database backups](/using-unleash/deploy/configuring-unleash#back-up-and-restore-the-database) are regularly taken and stored securely, preferably in a separate region.
Configure automatic failover for your database (managed services typically handle this). Failover within a region should ideally complete in less than a few minutes. Ensure [full database backups](/deploy/configuring-unleash#back-up-and-restore-the-database) are regularly taken and stored securely, preferably in a separate region.
In the rare event of a complete primary region failure (disaster recovery scenario):
1. Promote the database read replica (or restore from backup) in the standby region to become the new primary database.
@ -257,7 +257,7 @@ Unleash is architected with scalability, performance, and resilience in mind, de
This FAQ section addresses common questions about scaling Unleash for enterprise use, focusing on performance, high availability, and managing large user and flag volumes.
#### Should I choose cloud-hosted or self-hosted Unleash?
Choosing a [hosting option](/understanding-unleash/hosting-options) depends on several factors such as: your organization's tolerance for operational overhead, requirements for data residency and infrastructure control, regulatory compliance needs (such as FedRAMP), available SRE/DevOps resources and expertise, and desired speed of implementation (time-to-value).
Choosing a [hosting option](/deploy/hosting-options) depends on several factors such as: your organization's tolerance for operational overhead, requirements for data residency and infrastructure control, regulatory compliance needs (such as FedRAMP), available SRE/DevOps resources and expertise, and desired speed of implementation (time-to-value).
We generally recommend Unleash Cloud for most enterprises due to reduced operational complexity, built-in high-availability and disaster recovery, and managed scaling by Unleash experts. Choose self-hosted or hybrid if specific control, network isolation (air-gapped), or strict regulatory requirements mandate it.
@ -290,7 +290,7 @@ The main challenges include:
- **High availability**: Architecting and managing redundancy for all components across multiple AZs or even regions.
- **Global Edge deployment**: If needed, deploying, managing, routing traffic to, and monitoring Edge instances across multiple geographic locations adds complexity.
- **Monitoring and alerting**: Setting up comprehensive monitoring for all components and configuring meaningful alerts requires significant effort.
- **Operational maintenance**: Handling [upgrades](/using-unleash/deploy/upgrading-unleash), security patching, dependency management, and capacity planning requires dedicated SRE/DevOps resources.
- **Operational maintenance**: Handling [upgrades](/deploy/upgrading-unleash), security patching, dependency management, and capacity planning requires dedicated SRE/DevOps resources.
#### What happens if the Unleash API goes down? Will my application stop working?
No, your application will not stop working. The Unleash [SDKs](/reference/sdks) are designed for resilience:

View File

@ -46,7 +46,7 @@ Your developers and other stakeholders need to securely access platforms used to
To use single sign-on in Unleash, your users can authenticate themselves through OpenID Connect (OIDC) or SAML 2.0 protocols.
We have integration guides to connect Unleash to enterprise identity providers like Okta, Microsoft Entra ID, and Keycloak, but you can use any identity provider that uses OIDC or SAML 2.0 protocol. Read our [how-to guide for single sign-on](/how-to/how-to-add-sso-open-id-connect).
We have integration guides to connect Unleash to enterprise identity providers like Okta, Microsoft Entra ID, and Keycloak, but you can use any identity provider that uses OIDC or SAML 2.0 protocol. Read our [how-to guide for single sign-on](/single-sign-on/how-to-add-sso-open-id-connect).
![A diagram showing how Unleash integrates with authentication providers and identity providers.](/img/sso-idp-auth-provider.jpg)
@ -69,7 +69,7 @@ By enabling [SCIM](/reference/scim) in Unleash, you can:
- Sync group membership.
- Ensure consistent access across multiple platforms.
To unlock these benefits, set up [SCIM for automatic provisioning using our how-to guides](/how-to/how-to-setup-provisioning-with-okta).
To unlock these benefits, set up [SCIM for automatic provisioning using our how-to guides](/provisioning/how-to-setup-provisioning-with-okta).
## Configure role-based access control for administrators and developers
@ -197,7 +197,7 @@ Protecting data is critical within any software tool. Its a security best pra
This is a potential attack surface area that you wouldnt want to be the root of data breaches or unauthorized access in your system. Thats why Unleash was built in a way where integrating feature flags into your services wont be a weak link in your organizations ability to ship software safely.
With Unleash, you can architect your feature flagging solution in a way that all user data stays within your applications. When using backend SDKs, user data remains within your application and is never shared with the Unleash server regardless of your setup. For frontend SDKs, you can retain all user data within your applications by either [self-hosting Unleash](/understanding-unleash/hosting-options#), or [self-hosting Unleash Edge](/understanding-unleash/hosting-options#unleash-edge-options). Read more on the [Unleash architecture here](/get-started/unleash-overview).
With Unleash, you can architect your feature flagging solution in a way that all user data stays within your applications. When using backend SDKs, user data remains within your application and is never shared with the Unleash server regardless of your setup. For frontend SDKs, you can retain all user data within your applications by either [self-hosting Unleash](/deploy/hosting-options#), or [self-hosting Unleash Edge](/deploy/hosting-options#unleash-edge-options). Read more on the [Unleash architecture here](/get-started/unleash-overview).
### Use Unleash Edge for enterprise-grade data privacy

View File

@ -26,7 +26,7 @@ In this tutorial, you will:
When an enterprise like a global banking platform considers implementing feature flags, keeping track of who can access your feature flag platform and handling authentication is critical. Traditional username and password approaches are insecure and [shared accounts pose a security risk](https://www.getunleash.io/blog/stop-sharing-accounts).
To ensure proper user authentication and reduce risk exposure, Unleash provides [single sign-on](/how-to/how-to-add-sso-open-id-connect) as the recommended centralized method for managing user access.
To ensure proper user authentication and reduce risk exposure, Unleash provides [single sign-on](/single-sign-on/how-to-add-sso-open-id-connect) as the recommended centralized method for managing user access.
Unleash supports any SSO option through OpenID Connect or SAML 2.0, including identity providers like Okta, Microsoft Entra ID, and Keycloak to create a unified authentication process.
@ -34,7 +34,7 @@ To configure SSO for feature flags, navigate to **Admin settings > Single sign-o
![In Unleash's Single Sign-On page, there are four tabs to set up Open ID Connect, SAML 2.0, traditional passwords, and SCIM.](/img/use-case-user-mgmt-saml.png)
When you connect Unleash to your identity provider, you can synchronize user groups with the identity provider. That way, the synchronization process becomes automated so your group configuration reflects organizational changes. Follow our step-by-step guide to set up [user group syncing](/how-to/how-to-set-up-group-sso-sync).
When you connect Unleash to your identity provider, you can synchronize user groups with the identity provider. That way, the synchronization process becomes automated so your group configuration reflects organizational changes. Follow our step-by-step guide to set up [user group syncing](/single-sign-on/how-to-set-up-group-sso-sync).
With SSO integration, groups defined in your identity provider are directly mapped to Unleash access groups. This means:
- New team members are automatically assigned correct permissions.
@ -71,7 +71,7 @@ Enable SCIM protocol in the **Single sign-on > SCIM** tab to generate a new toke
![Turn the **SCIM provisioning** toggle on to enable SCIM.](/img/use-case-user-mgmt-scim-protocol.png)
Next, set up [Okta provisioning](/how-to/how-to-setup-provisioning-with-okta) or [Microsoft Entra ID provisioning](/how-to/how-to-setup-provisioning-with-entra) using our how-to guides.
Next, set up [Okta provisioning](/provisioning/how-to-setup-provisioning-with-okta) or [Microsoft Entra ID provisioning](/provisioning/how-to-setup-provisioning-with-entra) using our how-to guides.
This automation creates an access control system that adapts in real-time to organizational changes. Within minutes of joining, a new team member can be granted precisely the right level of access, while departing employees are immediately locked out of sensitive systems.

View File

@ -60,7 +60,7 @@ The following table outlines where flag evaluation happens with different SDK se
Flag evaluation relies on the [Unleash Context](/reference/unleash-context) and may involve user data. Since backend SDKs always perform local evaluation, your user data remains within your application and is never shared with the Unleash server.
For frontend SDKs, you can use Unleash Edge for flag evaluation to ensure that user data is not shared with the Unleash server. You have different [hosting options](/understanding-unleash/hosting-options) for both Unleash and Unleash Edge allowing you to meet any privacy requirements.
For frontend SDKs, you can use Unleash Edge for flag evaluation to ensure that user data is not shared with the Unleash server. You have different [hosting options](/deploy/hosting-options) for both Unleash and Unleash Edge allowing you to meet any privacy requirements.
### Unleash Edge
@ -93,7 +93,7 @@ To integrate Unleash, you first need an [Unleash server](#the-unleash-api-server
- [Cloud-hosted plans](https://www.getunleash.io/pricing)
- [Self-hosted plans](https://www.getunleash.io/pricing)
- Open-source deployment options:
- [Docker](../using-unleash/deploy/getting-started)
- [Docker](/deploy/getting-started)
- [Helm Chart](https://github.com/unleash/helm-charts/)
- [GitLab](https://docs.gitlab.com/ee/operations/feature_flags.html#choose-a-client-library)

View File

@ -12,7 +12,7 @@ This is an experimental feature.
This script allows you to synchronize feature flags between two Unleash instances using the export and import APIs provided by Unleash. The script exports feature flags from the source instance and imports them into the target instance.
For one-off full instance migrations, we recommend a [database dump/restore](/using-unleash/deploy/configuring-unleash#back-up-and-restore-the-database) (`pg_dump` / `pg_restore`) instead.
For one-off full instance migrations, we recommend a [database dump/restore](/deploy/configuring-unleash#back-up-and-restore-the-database) (`pg_dump` / `pg_restore`) instead.
You can find this script in the following location within the project:

View File

@ -61,7 +61,7 @@ This page highlights the key differences between Unleash OSS and Unleash Enterpr
|-------------|-----|-------------|
| [Export / import](/reference/import-export) | ✅ | ✅ |
| [Terraform provider](/reference/terraform) | ✅ | ✅ |
| Multi-region [Enterprise Edge](/understanding-unleash/hosting-options#unleash-edge-options) | ❌ | Available as an add-on |
| Multi-region [Enterprise Edge](/deploy/hosting-options#unleash-edge-options) | ❌ | Available as an add-on |
| [Webhooks and integrations](/reference/integrations) | ✅ | ✅ |

View File

@ -34,7 +34,7 @@ Enable SCIM by turning on the toggle and keep the token Unleash provides you for
:::info Note
This guide assumes you already have an SSO application setup for Unleash. If you don't already have an application configured, please see our [guide](./how-to-add-sso-azure-saml) on setting up SSO.
This guide assumes you already have an SSO application setup for Unleash. If you don't already have an application configured, please see our [guide](/single-sign-on/how-to-add-sso-azure-saml) on setting up SSO.
:::

View File

@ -1,6 +1,6 @@
---
title: Set up Okta provisioning
pagination_next: how-to/how-to-setup-provisioning-with-entra
pagination_next: provisioning/how-to-setup-provisioning-with-entra
---
:::note Availability
@ -35,7 +35,7 @@ Enable SCIM by turning on the toggle and keep the token Unleash provides you for
:::info Note
If you already have SAML SSO configured for Unleash in Okta you can skip to the [next step](how-to-setup-provisioning-with-okta#okta-setup-step-2). If you're planning on using [SAML for Unleash](../how-to/how-to-add-sso-saml), do that first and skip to the next step. Note that if you're using OIDC SSO in Okta you still need to do this step.
If you already have SAML SSO configured for Unleash in Okta you can skip to the [next step](how-to-setup-provisioning-with-okta#okta-setup-step-2). If you're planning on using [SAML for Unleash](/single-sign-on/how-to-add-sso-saml), do that first and skip to the next step. Note that if you're using OIDC SSO in Okta you still need to do this step.
This step will create an empty Sign-On Application that will only be used for SCIM.

View File

@ -20,7 +20,7 @@ In this guide, you'll:
![The Unleash Admin UI onboarding experience](/img/onboarding-experience.png)
If you prefer to manage your own infrastructure, see the [self-hosted setup guide](./using-unleash/deploy/getting-started). To use the open-source version, see the instructions in the [Unleash GitHub repository](https://github.com/Unleash/unleash?tab=readme-ov-file#get-started-with-unleash).
If you prefer to manage your own infrastructure, see the [self-hosted setup guide](/deploy/getting-started). To use the open-source version, see the instructions in the [Unleash GitHub repository](https://github.com/Unleash/unleash?tab=readme-ov-file#get-started-with-unleash).
## Sign up for an Unleash Enterprise Cloud trial
@ -127,6 +127,6 @@ For examples that show how to connect to Unleash in other programming languages,
You have successfully connected Unleash to your application. To continue exploring, see the following resources:
- **Core concepts**: Learn about the [Unleash architecture](/get-started/unleash-overview), available [hosting options](/understanding-unleash/hosting-options), and other [reference documentation](/reference/projects).
- **Core concepts**: Learn about the [Unleash architecture](/get-started/unleash-overview), available [hosting options](/deploy/hosting-options), and other [reference documentation](/reference/projects).
- **Developer guides**: Explore feature flag [best practices](/guides/feature-flag-best-practices) and [language-specific tutorials](/feature-flag-tutorials/react).
- **Join the community**: Have questions or feedback? Join the [Unleash community on Slack](https://slack.unleash.run) to connect with other developers and the Unleash team.

View File

@ -337,7 +337,7 @@ You cant add a group with a [custom root role](#custom-root-roles) to a proje
:::
You can integrate user groups with your single sign-on (SSO) provider to automatically manage user assignments.
Note that this just-in-time process updates groups only when a user logs in, which differs from a full provisioning system like [SCIM](/how-to/how-to-setup-provisioning-with-okta) that syncs all user information proactively.
Note that this just-in-time process updates groups only when a user logs in, which differs from a full provisioning system like [SCIM](/provisioning/how-to-setup-provisioning-with-okta) that syncs all user information proactively.
When a user logs in through SSO, they are automatically added to or removed from a user group based on their SSO group membership. Manually added users are not affected by the SSO sync.

View File

@ -21,7 +21,7 @@ import SearchPriority from '@site/src/components/SearchPriority';
Our implementation supports user and group provisioning, but not password syncing or role mapping. It uses soft-deletes to preserve audit logs when you deprovision users.
See our how-to guides on setting up provisioning for [Okta](../how-to/how-to-setup-provisioning-with-okta.md) or [Entra](../how-to/how-to-setup-provisioning-with-entra.md).
See our how-to guides on setting up provisioning for [Okta](/provisioning/how-to-setup-provisioning-with-okta) or [Entra](/provisioning/how-to-setup-provisioning-with-entra).
## Retain admin access

View File

@ -19,8 +19,8 @@ Unleash provides single sign-on (SSO) support through SAML 2.0, OpenID Connect,
To configure SSO, navigate to **Admin settings > Single sign-on** in the Unleash Admin UI. Admin access is required.
For step-by-step configuration instructions, refer to the following guides:
- [OpenID Connect with Okta](../how-to/how-to-add-sso-open-id-connect)
- [SAML 2.0 with Okta](../how-to/how-to-add-sso-saml)
- [SAML 2.0 with Keycloak](../how-to/how-to-add-sso-saml-keycloak)
- [SAML 2.0 with Microsoft Entra ID](../how-to/how-to-add-sso-azure-saml)
- [Google Authentication](../how-to/how-to-add-sso-google) (deprecated)
- [OpenID Connect with Okta](/single-sign-on/how-to-add-sso-open-id-connect)
- [SAML 2.0 with Okta](/single-sign-on/how-to-add-sso-saml)
- [SAML 2.0 with Keycloak](/single-sign-on/how-to-add-sso-saml-keycloak)
- [SAML 2.0 with Microsoft Entra ID](/single-sign-on/how-to-add-sso-azure-saml)
- [Google Authentication](/single-sign-on/how-to-add-sso-google) (deprecated)

View File

@ -68,8 +68,8 @@ resource "unleash_api_token" "backend_token" {
### Single sign-on protocols
- `unleash_oidc`: Manage your [OpenID Connect configuration](../how-to/how-to-add-sso-open-id-connect).
- `unleash_saml`: Manage your [SAML configuration](../how-to/how-to-add-sso-saml).
- `unleash_oidc`: Manage your [OpenID Connect configuration](/single-sign-on/how-to-add-sso-open-id-connect).
- `unleash_saml`: Manage your [SAML configuration](/single-sign-on/how-to-add-sso-saml).
### Context fields

View File

@ -6,7 +6,7 @@ Version 4 of Unleash brings a lot of improvements to Unleash. In this document w
### Upgrade with ease {#upgrade-with-ease}
Unleash can either be hosted by us or self-hosted. If you have a managed Unleash Enterprise instance you are automatically upgraded to version 4. If you manage Unleash yourself (either Open-Source or Enterprise Self-hosted) we recommend reading the [migration guide](../using-unleash/deploy/upgrading-unleash).
Unleash can either be hosted by us or self-hosted. If you have a managed Unleash Enterprise instance you are automatically upgraded to version 4. If you manage Unleash yourself (either Open-Source or Enterprise Self-hosted) we recommend reading the [migration guide](/deploy/upgrading-unleash).
**PS! The first time you access Unleash v4 from a self-hosted instance you will need to login with the default admin user:**

View File

@ -11,7 +11,7 @@ import SearchPriority from '@site/src/components/SearchPriority';
:::caution Deprecation notice
Single Sign-on via the Google Authenticator provider has been removed in Unleash v5 (deprecated in v4). We recommend using [OpenID Connect](./how-to-add-sso-open-id-connect.md) instead. If you're running a self hosted version of Unleash and you need to temporarily re-enable Google SSO, you can do so by setting the `GOOGLE_AUTH_ENABLED` environment variable to `true`. If you're running a hosted version of Unleash, you'll need to reach out to us and ask us to re-enable the flag. Note that this code will be removed in a future release and this is not safe to depend on.
Single Sign-on via the Google Authenticator provider has been removed in Unleash v5 (deprecated in v4). We recommend using [OpenID Connect](/single-sign-on/how-to-add-sso-open-id-connect) instead. If you're running a self hosted version of Unleash and you need to temporarily re-enable Google SSO, you can do so by setting the `GOOGLE_AUTH_ENABLED` environment variable to `true`. If you're running a hosted version of Unleash, you'll need to reach out to us and ask us to re-enable the flag. Note that this code will be removed in a future release and this is not safe to depend on.
:::

View File

@ -1,7 +1,7 @@
---
title: Set up SSO with OpenID Connect
description: Set up SSO for Unleash with OpenID Connect.
pagination_next: how-to/how-to-add-sso-saml
pagination_next: single-sign-on/how-to-add-sso-saml
---
:::note Availability

View File

@ -53,7 +53,7 @@ Navigate to “Realm Settings” and open the “SAML 2.0 Identity Provider Meta
Go back to Unleash Admin Dashboard and navigate to `Admin Menu -> Single-Sign-On -> SAML`. Fill in the values captured in the step 3.
- Entity ID (3b a)
- Single Sing-On URL (3a b)
- Single Sign-On URL (3a b)
- Certificate (3b b)
You may also choose to “auto create users”. This will make Unleash automatically create new users on the fly first time they sign-in to Unleash with the given SSO provider. You may also limit the auto-creation to certain email domains, shown in the example below.

View File

@ -8,7 +8,7 @@ title: Set up user group SSO syncing
:::
This guide takes you through how to configure your [user groups](../reference/rbac#user-groups) to automatically populate users through Single Sign On (SSO). Refer to [setting up Keycloak for user group sync](../../how-to/how-to-setup-sso-keycloak-group-sync) for an end to end example. Note that the steps below require you to be logged in as an admin user.
This guide takes you through how to configure your [user groups](/reference/rbac#user-groups) to automatically populate users through Single Sign On (SSO). Refer to [setting up Keycloak for user group sync](/single-sign-on/how-to-setup-sso-keycloak-group-sync) for an end to end example. Note that the steps below require you to be logged in as an admin user.
## Step 1: Navigate to SSO configuration {#step-1}
@ -18,9 +18,9 @@ Navigate to the "Single sign-on" configuration page.
## Step 2: Enable Group Syncing {#step-2}
Turn on "Enable Group Syncing" and enter a value for "Group Field JSON Path". Refer to the [User group SSO integration documentation](/reference/rbac#set-up-group-sso-syncing) for more information or to the [how-to guide for integrating with Keycloak](how-to-setup-sso-keycloak-group-sync.md) for a practical example.
Turn on "Enable Group Syncing" and enter a value for "Group Field JSON Path". Refer to the [User group SSO integration documentation](/reference/rbac#set-up-group-sso-syncing) for more information or to the [how-to guide for integrating with Keycloak](/single-sign-on/how-to-setup-sso-keycloak-group-sync) for a practical example.
The value is the JSON path in the token response where your group properties are located, this is up to your SSO provider, a full example for Keycloak can be [found here](../../how-to/how-to-setup-sso-keycloak-group-sync). Once you're happy, save your configuration.
The value is the JSON path in the token response where your group properties are located, this is up to your SSO provider, a full example for Keycloak can be [found here](/single-sign-on/how-to-setup-sso-keycloak-group-sync). Once you're happy, save your configuration.
![The Single sign-on configuration page with enable group syncing, group field JSON path and save inputs highlighted.](/img/setup-sso-group-sync-2.png)

View File

@ -137,7 +137,7 @@ If a documented Unleash feature isn't showing up in your Admin UI, check the fol
## Got locked out of an Admin account after configuring SCIM
When you integrate Unleash with an identity provider (IdP) like [Okta](../how-to/how-to-setup-provisioning-with-okta) or [Entra ID](../how-to/how-to-setup-provisioning-with-entra) via [SCIM](/reference/scim), your IdP becomes the source of truth for user information.
When you integrate Unleash with an identity provider (IdP) like [Okta](/provisioning/how-to-setup-provisioning-with-okta) or [Entra ID](/provisioning/how-to-setup-provisioning-with-entra) via [SCIM](/reference/scim), your IdP becomes the source of truth for user information.
This can have an unintended side effect: users, including the one who set up the integration, might lose their admin permissions.
When your IdP syncs a user with Unleash, it sends over the user's attributes. However, the standard SCIM protocol does not have a field for user roles. If role information isn't specified, Unleash defaults the user to the Viewer role for security reasons.

View File

@ -25,7 +25,7 @@ This guide provides an overview of how [Unleash Enterprise](https://www.getunlea
| CC 5.3, CC 7.1, CC 8.1 Change management procedures enforced | Change management procedures are enforced. | Unleash supports defining custom roles with configurable permissions in each environment. [Change Requests](/reference/change-requests) supports a 4-eyes approval workflow for changes. |
| CC 6.1, CC 8.1 Production deployment and application access restricted | The company restricts access to migrate changes to production to authorized personnel. | Unleash supports defining custom roles with configurable permissions in each environment. [Change Requests](/reference/change-requests) supports a 4-eyes approval workflow for changes. |
| CC 6.1 Unique account authentication enforced | The company requires authentication to systems and applications to use unique username and password or authorized Secure Socket Shell (SSH) keys. | Unleash supports both username/password authentication, as well as [single sign-on](/reference/sso). In addition, the [SCIM integration](/reference/scim) facilitates user account provisioning. |
| CC 6.1 Password policy enforced | The company requires passwords for in-scope system components to be configured according to the company's policy. | Unleash has [password strength requirements](/using-unleash/deploy/configuring-unleash#password-requirements) for all users using username/password authentication. |
| CC 6.1 Password policy enforced | The company requires passwords for in-scope system components to be configured according to the company's policy. | Unleash has [password strength requirements](/deploy/configuring-unleash#password-requirements) for all users using username/password authentication. |
| CC 6.1, CC 6.6 Remote access MFA enforced | The company's production systems can only be remotely accessed by authorized employees possessing a valid multi-factor authentication (MFA) method. | You can enable MFA through your identity provider, such as Okta or Microsoft Entra ID, after implementing [single sign-on](/reference/sso). |
| CC 6.1, CC 6.6 Remote access encrypted and enforced | The company's production systems can only be remotely accessed by authorized employees via an approved encrypted connection. | Unleash is secured by enforcing TLS 1.2. |
| CC 6.7 Data transmission encrypted | The company uses secure data transmission protocols to encrypt confidential and sensitive data when transmitted over public networks. | Unleash is secured by enforcing TLS 1.2. |

View File

@ -593,21 +593,21 @@ const sidebars: SidebarsConfig = {
{
type: 'doc',
label: 'Unleash hosting options',
id: 'understanding-unleash/hosting-options',
id: 'deploy/hosting-options',
},
{
type: 'category',
link: {
type: 'doc',
id: 'using-unleash/deploy/getting-started',
id: 'deploy/getting-started',
},
label: 'Self-hosting Unleash',
items: [
'using-unleash/deploy/getting-started',
'using-unleash/deploy/configuring-unleash',
'using-unleash/deploy/upgrading-unleash',
'using-unleash/deploy/license-keys',
'using-unleash/deploy/https',
'deploy/getting-started',
'deploy/configuring-unleash',
'deploy/upgrading-unleash',
'deploy/license-keys',
'deploy/https',
{
type: 'doc',
label: 'Synchronize Unleash instances',
@ -620,15 +620,15 @@ const sidebars: SidebarsConfig = {
type: 'category',
link: {
type: 'doc',
id: 'how-to/how-to-add-sso-open-id-connect',
id: 'single-sign-on/how-to-add-sso-open-id-connect',
},
items: [
'how-to/how-to-add-sso-open-id-connect',
'how-to/how-to-add-sso-saml',
'how-to/how-to-add-sso-saml-keycloak',
'how-to/how-to-add-sso-azure-saml',
'how-to/how-to-setup-sso-keycloak-group-sync',
'how-to/how-to-set-up-group-sso-sync',
'single-sign-on/how-to-add-sso-open-id-connect',
'single-sign-on/how-to-add-sso-saml',
'single-sign-on/how-to-add-sso-saml-keycloak',
'single-sign-on/how-to-add-sso-azure-saml',
'single-sign-on/how-to-setup-sso-keycloak-group-sync',
'single-sign-on/how-to-set-up-group-sso-sync',
],
},
{
@ -636,11 +636,11 @@ const sidebars: SidebarsConfig = {
type: 'category',
link: {
type: 'doc',
id: 'how-to/how-to-setup-provisioning-with-okta',
id: 'provisioning/how-to-setup-provisioning-with-okta',
},
items: [
'how-to/how-to-setup-provisioning-with-okta',
'how-to/how-to-setup-provisioning-with-entra',
'provisioning/how-to-setup-provisioning-with-okta',
'provisioning/how-to-setup-provisioning-with-entra',
],
},
{

View File

@ -808,12 +808,12 @@
},
{
"source": "/tutorials/proxy-hosting",
"destination": "/understanding-unleash/hosting-options",
"destination": "/deploy/hosting-options",
"permanent": true
},
{
"source": "/topics/proxy-hosting",
"destination": "/understanding-unleash/hosting-options",
"destination": "/deploy/hosting-options",
"permanent": true
},
{
@ -823,32 +823,37 @@
},
{
"source": "/using-unleash/deploy",
"destination": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
"source": "/using-unleash/deploy/database-backup",
"destination": "/using-unleash/deploy/configuring-unleash#configure-the-database-connection",
"destination": "/deploy/configuring-unleash#configure-the-database-connection",
"permanent": true
},
{
"source": "/using-unleash/deploy/database-setup",
"destination": "/using-unleash/deploy/configuring-unleash#configure-the-database-connection",
"destination": "/deploy/configuring-unleash#configure-the-database-connection",
"permanent": true
},
{
"source": "/using-unleash/deploy/email-service",
"destination": "/using-unleash/deploy/configuring-unleash#configure-an-email-server",
"destination": "/deploy/configuring-unleash#configure-an-email-server",
"permanent": true
},
{
"source": "/using-unleash/troubleshooting/email-service",
"destination": "/using-unleash/deploy/configuring-unleash#configure-an-email-server",
"destination": "/deploy/configuring-unleash#configure-an-email-server",
"permanent": true
},
{
"source": "/understanding-unleash/proxy-hosting",
"destination": "/understanding-unleash/hosting-options",
"destination": "/deploy/hosting-options",
"permanent": true
},
{
"source": "/understanding-unleash/hosting-options",
"destination": "/deploy/hosting-options",
"permanent": true
},
{
@ -903,7 +908,7 @@
},
{
"source": "/how-to/troubleshooting/https",
"destination": "/using-unleash/deploy/https",
"destination": "/deploy/https",
"permanent": true
},
{
@ -958,22 +963,22 @@
},
{
"source": "/reference/deploy",
"destination": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
"source": "/deploy",
"destination": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
"source": "/reference/deploy/getting-started",
"destination": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
"source": "/deploy/getting_started",
"destination": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
@ -998,12 +1003,12 @@
},
{
"source": "/reference/deploy/configuring-unleash",
"destination": "/using-unleash/deploy/configuring-unleash",
"destination": "/deploy/configuring-unleash",
"permanent": true
},
{
"source": "/deploy/configuring_unleash",
"destination": "/using-unleash/deploy/configuring-unleash",
"destination": "/deploy/configuring-unleash",
"permanent": true
},
{
@ -1018,87 +1023,157 @@
},
{
"source": "/how-to/sso",
"destination": "/how-to/how-to-add-sso-open-id-connect",
"destination": "/single-sign-on/how-to-add-sso-open-id-connect",
"permanent": true
},
{
"source": "/how-to/how-to-add-sso-open-id-connect",
"destination": "/single-sign-on/how-to-add-sso-open-id-connect",
"permanent": true
},
{
"source": "/how-to/how-to-add-sso-saml",
"destination": "/single-sign-on/how-to-add-sso-saml",
"permanent": true
},
{
"source": "/how-to/how-to-add-sso-saml-keycloak",
"destination": "/single-sign-on/how-to-add-sso-saml-keycloak",
"permanent": true
},
{
"source": "/how-to/how-to-add-sso-azure-saml",
"destination": "/single-sign-on/how-to-add-sso-azure-saml",
"permanent": true
},
{
"source": "/how-to/how-to-setup-sso-keycloak-group-sync",
"destination": "/single-sign-on/how-to-setup-sso-keycloak-group-sync",
"permanent": true
},
{
"source": "/how-to/how-to-add-sso-google",
"destination": "/single-sign-on/how-to-add-sso-google",
"permanent": true
},
{
"source": "/how-to/how-to-set-up-group-sso-sync",
"destination": "/single-sign-on/how-to-set-up-group-sso-sync",
"permanent": true
},
{
"source": "/how-to/provisioning",
"destination": "/how-to/how-to-setup-provisioning-with-okta",
"destination": "/provisioning/how-to-setup-provisioning-with-okta",
"permanent": true
},
{
"source": "/how-to/how-to-setup-provisioning-with-okta",
"destination": "/provisioning/how-to-setup-provisioning-with-okta",
"permanent": true
},
{
"source": "/how-to/how-to-setup-provisioning-with-entra",
"destination": "/provisioning/how-to-setup-provisioning-with-entra",
"permanent": true
},
{
"source": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
"source": "/using-unleash/deploy/configuring-unleash",
"destination": "/deploy/configuring-unleash",
"permanent": true
},
{
"source": "/using-unleash/deploy/upgrading-unleash",
"destination": "/deploy/upgrading-unleash",
"permanent": true
},
{
"source": "/using-unleash/deploy/license-keys",
"destination": "/deploy/license-keys",
"permanent": true
},
{
"source": "/using-unleash/deploy/https",
"destination": "/deploy/https",
"permanent": true
},
{
"source": "/reference/deploy/configuring-unleash-v3",
"destination": "/using-unleash/deploy/configuring-unleash-v3",
"destination": "/deploy/configuring-unleash-v3",
"permanent": true
},
{
"source": "/deploy/configuring_unleash_v3",
"destination": "/using-unleash/deploy/configuring-unleash-v3",
"destination": "/deploy/configuring-unleash-v3",
"permanent": true
},
{
"source": "/reference/deploy/database-setup",
"destination": "/using-unleash/deploy/configuring-unleash#configure-the-database-connection",
"destination": "/deploy/configuring-unleash#configure-the-database-connection",
"permanent": true
},
{
"source": "/deploy/database-setup",
"destination": "/using-unleash/deploy/configuring-unleash#configure-the-database-connection",
"destination": "/deploy/configuring-unleash#configure-the-database-connection",
"permanent": true
},
{
"source": "/reference/deploy/database-backup",
"destination": "/using-unleash/deploy/configuring-unleash#configure-the-database-connection",
"destination": "/deploy/configuring-unleash#configure-the-database-connection",
"permanent": true
},
{
"source": "/deploy/database-backup",
"destination": "/using-unleash/deploy/configuring-unleash#configure-the-database-connection",
"destination": "/deploy/configuring-unleash#configure-the-database-connection",
"permanent": true
},
{
"source": "/reference/deploy/email-service",
"destination": "/using-unleash/deploy/configuring-unleash#configure-an-email-server",
"destination": "/deploy/configuring-unleash#configure-an-email-server",
"permanent": true
},
{
"source": "/deploy/email",
"destination": "/using-unleash/deploy/configuring-unleash#configure-an-email-server",
"destination": "/deploy/configuring-unleash#configure-an-email-server",
"permanent": true
},
{
"source": "/reference/deploy/google-auth-hook",
"destination": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
"source": "/deploy/google_auth",
"destination": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
"source": "'/using-unleash/deploy/google-auth-hook",
"destination": "/using-unleash/deploy/getting-started",
"destination": "/deploy/getting-started",
"permanent": true
},
{
"source": "/deploy/migration_guide",
"destination": "/using-unleash/deploy/upgrading-unleash",
"destination": "/deploy/upgrading-unleash",
"permanent": true
},
{
"source": "/reference/deploy/migration-guide",
"destination": "/using-unleash/deploy/upgrading-unleash",
"destination": "/deploy/upgrading-unleash",
"permanent": true
},
{
"source": "/reference/deploy/securing-unleash",
"destination": "/using-unleash/deploy/configuring-unleash#securing-unleash",
"destination": "/deploy/configuring-unleash#securing-unleash",
"permanent": true
},
{
"source": "/deploy/securing_unleash",
"destination": "/using-unleash/deploy/configuring-unleash#securing-unleash",
"destination": "/deploy/configuring-unleash#securing-unleash",
"permanent": true
},
{