User ID or username for the account

Display name for the account

Groups that the user is associated with

Example: ["group1","group2"]

Extra metadata that can be added to the user account when they sign in.

Do not leave any field in the extra section empty. Either specify a value or remove the empty field. If your extra section is empty, omit the section entirely.

For the LOCAL identity provider only, enclose each metadata value in square brackets, [].

Example: {uid: ["1001"], department: ["MATLAB Online Server"]}

Client identifier, which must be the same as the client identifier specified in the IdP.

Optional

(Required if authorizationLocation, tokenLocation, and graphLocation are not specified)

Specifies a URL that MATLAB Online Server uses to look up the authorization, token, and user endpoints required by the OIDC protocol. Specify these subfields:

You must specify either the oidc field or the authorizationLocation, tokenLocation, and graphLocation fields, but not both.

Example:

oidc:
  enabled: true
  discoveryUrl: https://host/.well-known/...
  retryMode: "bypass"

Optional

(Required if oidc is not specified)

Specifies the authorization endpoint described in https://datatracker.ietf.org/doc/html/rfc6749#page-18.

If you set the oidc field to look up this endpoint from a discovery URL, omit this field.

Example:

authorizationLocation: "https://keycloak.example.com/realms/example-realm/protocol/openid-connect/auth"

Optional

(Required if oidc is not specified)

Specifies the token endpoint described in https://datatracker.ietf.org/doc/html/rfc6749#page-18.

If you set the oidc field to look up this endpoint from a discovery URL, omit this field.

Example:

tokenLocation: "https://keycloak.example.com/realms/example-realm/protocol/protocol/openid-connect/token"

Optional

(Required if oidc is not specified)

Specifies the user information endpoint described in https://openid.net/specs/openid-connect-core-1_0.html#UserInfo. This endpoint must use the HTTPS protocol and can include port, path, and query parameters. If you set the oidc field to look up this endpoint from a discovery URL, omit this field.

Example:

graphLocation: https://keycloak.example.com/realms/example-realm/protocol/openid-connect/userinfo

Specifies the path portion of the redirection endpoint described in https://datatracker.ietf.org/doc/html/rfc6749#page-18.

With the default value, the result will be https://fully-qualified-domain-name-of-mos-install/authnz/oauth/code.

Example:

redirectpath: "/authnz/oauth/code"

Specifies the Kubernetes secret used to specify the secret associated with the clientId.

Specifies the name of the field in the Kubernetes secret used hold the secret value.

Example:

This example shows the sample contents of a secrets YAML file.

apiVersion: "v1"
kind: "Secret"
metadata:
  name: "oauth-client"
data:
  secret: "amwXbWYtcmVhbG0XZ2VjcmV0"

To add this secret file to the Kubernetes cluster, use this command.

kubectl apply -f "secretFile.yaml"

Comma-separated list of scopes that OAuth 2.0 protocol has. Do not insert a space after each comma.

The pkce field enables you to extend the OAuth 2.0 protocol and use the proof key for code exchange (PKCE) protocol for authentication. The pkce field has these subfields.

For more details on PKCE, see https://auth0.com/docs/flows/authorization-code-flow-with-proof-key-for-code-exchange-pkce.

Example:

pkce:
  enabled: true
  challengeMethod: "S256"
  challengeLength: 32

Mapping between the keys in the OpenID Connect claims to values needed by MATLAB Online Server.

Enclose each subjectAttributeMapping field value in quotes. Valid fields are as follows:

subjectAttributeMapping:
  displayName: "displayNameClaimKey"
  subjectId: "subjectIdClaimKey"
  groups: "groupsClaimKey"
  extra:
    email: "emailClaimKey"
    uid: "userIdClaimKey"
    gid: "groupIdClaimKey"

Client ID value. Enclose the client ID in quotes.

Tenant ID value. Enclose the tenant ID in quotes.

Type of OAuth 2.0 and OIDC client, specified as one of these values.

Specifies the path portion of the redirection endpoint described in https://datatracker.ietf.org/doc/html/rfc6749#page-18.

Comma-separated list of scopes used to obtain login and user information. Do not insert a space after each comma.

When set to true, the MATLAB Online Server authentication service expects groups returned in the ID token (IDToken) returned by the identity provider. You must configure your ID token to include groups. For more details, see Configure groups optional claims (Microsoft).

Mapping between the keys in the OpenID Connect claims to values needed by MATLAB Online Server.

Enclose each subjectAttributeMapping field value in quotes. Valid fields are as follows:

subjectAttributeMapping:
  displayName: "displayNameClaimKey"
  subjectId: "subjectIdClaimKey"
  groups: "groupsClaimKey"
  extra:
    email: "emailClaimKey"
    uid: "userIdClaimKey"
    gid: "groupIdClaimKey"

Specifies the host address for the LDAP, for example: "ldapserver.yourcompany.com".

Specifies the LDAP port at the host address, for example: "389" for regular LDAP and "636" for secure LDAP.

Specifies if your LDAP server requires start TLS for connection.

You must add the trusted certificates to the MATLAB Online Server trust store. See Add Certificates to MATLAB Online Server Trust Store.

Specifies if your LDAP server requires SSL for connection.

You must add the trusted certificates to the MATLAB Online Server trust store. See Add Certificates to MATLAB Online Server Trust Store.

Specifies the starting point for the search tree in your LDAP environment. For example: "dc=ldap,dc=yourcompany,dc=com"

Specifies an LDAP search filter. Use the search filter to scan a subset of users from the LDAP database. This allows you to reduce the scope of the LDAP search and control which organizational user may access MATLAB Online Server.

The default search filter is objectClass=organizationalPerson.

For more information on search filters, see LDAP filters at https://ldap.com/ldap-filters.

Specifies the administrator account used to establish the connection to the LDAP server, for example: "cn=readonly".

This account is used to query LDAP for the list of users. The account requires only read access to the directory and does not attempt to store information back into LDAP.

Specifies the administrator account password used to establish the connection to the LDAP server.

Mapping between your internal LDAP values to values needed by MATLAB Online Server.

For example, your user’s first name might be stored as displayFirstName in the LDAP system.

To map this value in MATLAB Online Server set displayName: "displayFirstName".

Enclose each subjectAttributeMapping value in quotes. Valid fields are as follows:

subjectAttributeMapping:
  subjectId: "subject_id"
  displayName: "display_name"
  groups: "groups"
  extra:
    email: "email_address"
    uid: "uid_number"
    gid: "gid_number"

displayName is an optional attribute that controls what is displayed for the username in the upper-right corner of MATLAB Online Server.

The subjectId is the default mapping field for the user account, normally “cn”.

The extra fields are for additional customization relating to the network files system (NFS):

Do not leave any field in the extra section empty. Either specify a value or remove the empty field. If your extra section is empty, omit the section entirely.

Binding method used for sending authentication requests to the Identity Provider, specified as "POST" (HTTP POST) or "Redirect" (HTTP Redirect).

The HTTP Redirect method sends request data as query parameters in the URL, whereas HTTP POST method sends data more securely in the request body.

The assertion consumer service (ACS) endpoint is a location where the SSO tokens are sent. ACS is applicable to all SAML versions and both the IdP-initiated and SP-initiated SSO profiles.

The fully qualified domain name of the server that communicates with MATLAB Online Server, for example, samlintegrationhost.yourcompanydomain.com.

The hostname for the server that integrates with the SAML Identity Provider. This value is typically the hostname of the DNS entry for your MATLAB Online Server Kubernetes cluster, but depending on the integration product or service being used to expose the Identity Provider via the SAML system, this value can also be an arbitrary identifier.

The subject attribute mapping lets you set values for the user attributes that map to your organizational SAML assertion values.

For example, your user’s first name might be stored as displayFirstName in the SAML system.

To map this in MATLAB Online Server, set displayName: displayFirstName.

Enclose each subjectAttributeMapping field value in quotes. Valid fields are as follows:

subjectAttributeMapping:
  subjectId: "<subject_id>"
  displayName: "<display_name>"
  groups: "<groups>"
  extra:
    email: "<email_address>"
    uid: "<uid_number>"
    gid: "<gid_number>"

displayName is an optional attribute that controls what is displayed for the user name in the upper-right corner of MATLAB Online Server.

subjectId is the default mapping field for the user account. This value comes from the SAML assertions sent as part of a successful login.

groups is an optional attribute that defines what groups the user belongs to.

extra contains customization fields relating to the network file system (NFS):

Do not leave any field in the extra section empty. Either specify a value or remove the empty field. If your extra section is empty, omit the section entirely.

Set this field to true to enable the use of an IdP-initiated workflow for accessing MATLAB Online Server.

In an IdP-initiated workflow, when users log in to their IdP (such as by using their SSO credentials), they are brought to a portal for accessing applications supported by their organization. When users select an application hosted by MATLAB Online Server, they are redirected to that application.

To enable IdP-initiated workflows, you must:

Omit this field or set it to false to initiate authentication of a user's SSO credentials through the service provider (SP), MATLAB Online Server. In an SP-initiated workflow, users log in directly to MATLAB Online Server and the server connects to the identity provider to authenticate their credentials.

Optional

(Required if supportIdpInitiated is true)

IdP issuer for IdP-initiated relay state. This value uniquely identifies the IdP issuer. It is often the name of the IdP client configuration that MATLAB Online Server uses to authenticate users.

This value must be the same as the one used to configure the default relay state parameter that the IdP uses when communication with MATLAB Online Server. When configuring the IdP field, the format of the default relay state is idpIssuerName|idpRedirectUrl, where:

Separate these values with a pipe character (|). For example:

"idp-issuer-name|https://<IdP issuer redirect URL>"

This field applies only when supportIdpInitiated is set to true.

Optional

(You must specify either idpMetadataUrl or idpMetadataXml, but not both)

URL to the required SAML metadata for SP-initiated or IdP-initiated profiles.

Optional

(You must specify either idpMetadataUrl or idpMetadataXml, but not both)

The value of idpMetadataXml is a block of XML that is exported by the SAML Identity Provider. You can paste the exported XML into this field, but the field must be properly formatted YAML. Otherwise, mosadm is unable to deploy the AuthNZ details.

Depending on the integration product or service being used to expose the Identity Provider via SAML, there might be newline characters. Delete those newline characters from the metadata XML before pasting the code into authnz.yaml.