You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ This approach is vastly different from most (if not all) VPN/IdP solutions, whic
20
20
21
21
Incorporating IDM, ALM, VPN has also other advantages:
22
22
23
-
1. Internal IdP with 2FA/MFA enables us to provide [**real VPN 2FA/MFA**](admin-and-features/features-and-configuration/wireguard/multi-factor-authentication-mfa-2fa/architecture.md) - and not like most applications just 2FA when opening the app (and not during the connection process). Even if you use [external OIDC](enterprise/external-openid-providers.md) (Google/Microsoft/Custom - which defguard supports), we still use our internal IdP for 2FA/MFA.
23
+
1. Internal IdP with 2FA/MFA enables us to provide [**real VPN 2FA/MFA**](admin-and-features/features-and-configuration/wireguard/multi-factor-authentication-mfa-2fa/architecture.md) - and not like most applications just 2FA when opening the app (and not during the connection process). Even if you use [external OIDC](enterprise/all-enteprise-features/external-openid-providers.md) (Google/Microsoft/Custom - which defguard supports), we still use our internal IdP for 2FA/MFA.
24
24
2. Your organisation may use just **one account** (login) for access control to all your applications as well as VPN.
When initially configuring defguard desktop client all available locations for the user (with all location settings) is automatically configured (which is one of defguard's uniqe functionalities).
@@ -6,10 +10,10 @@ In the course of time: new locations can be added by administrators, existing on
6
10
7
11
In order to reconfigure users desktop client the administrator has two possibilities:
8
12
9
-
1. If using the **Open Source Open Core** - the administrator needs to send a new configuration token to each user affected, and the user needs to [Update the instance](../help/configuring-vpn/add-new-instance/update-instance.md) in the desktop client with the new obtained token.
13
+
1. If using the **Open Source Open Core** - the administrator needs to send a new configuration token to each user affected, and the user needs to [Update the instance](../../help/configuring-vpn/add-new-instance/update-instance.md) in the desktop client with the new obtained token.
10
14
2. Obtain the **Enterprise License**, then each users desktop client (and all Locations) are **reconfigured automatically, real time** (propagation takes around 30 seconds to 1 minute) each time any VPN Location is reconfigured or the user is assigned to a different group. 
11
15
12
16
{% hint style="warning" %}
13
-
If you have been using defguard prior to version 1.0.0, upgraded and have Enterprise License, to take advantage of the real-time config sync on an already configured desktop client, [please refer to Upgrade notes documentation.](../features/setting-up-your-instance/upgrading.md#desktop-client-real-time-sync)
17
+
If you have been using defguard prior to version 1.0.0, upgraded and have Enterprise License, to take advantage of the real-time config sync on an already configured desktop client, [please refer to Upgrade notes documentation.](../../features/setting-up-your-instance/upgrading.md#desktop-client-real-time-sync)
Copy file name to clipboardExpand all lines: enterprise/all-enteprise-features/behavior-customization.md
+7-3Lines changed: 7 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,12 @@
1
+
---
2
+
icon: sliders
3
+
---
4
+
1
5
# VPN & Client behavior customization
2
6
3
7
After purchasing the Enterprise License the _Enterprise features_**tab will be activated**, enabling the administrator to configure additional features:
@@ -14,7 +18,7 @@ If '_Disable users' ability to manually configure WireGuard client_' option is *
14
18
15
19
This option will not be available for users:
16
20
17
-
<figure><imgsrc="../.gitbook/assets/Screenshot 2024-10-14 at 12.44.15.png"alt=""><figcaption></figcaption></figure>
21
+
<figure><imgsrc="../../.gitbook/assets/Screenshot 2024-10-14 at 12.44.15.png"alt=""><figcaption></figcaption></figure>
18
22
19
23
{% hint style="danger" %}
20
24
Please note that defguard has only **desktop clients** and **no official mobile** client, thus when using this option users **will not be able to configure their mobile WireGuard clients.**
@@ -24,7 +28,7 @@ Please note that defguard has only **desktop clients** and **no official mobile*
24
28
25
29
Of of defguard desktop client uniqe features is the possibility for the user to automatically route **All network traffic** from their device **through the connected VPN Location**, when the user checks _All traffic_ option_**:**_
26
30
27
-
 
31
+
 
28
32
29
33
But there are scenarios that administrator would like that users have only access to the **Predefined traffic** (meaning Allowed IPs in the Network VPN configuration) and the possibility to access all networks disabled.
Copy file name to clipboardExpand all lines: enterprise/all-enteprise-features/external-openid-providers.md
+19-15Lines changed: 19 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,10 @@
1
+
---
2
+
icon: up-right-from-square
3
+
---
4
+
1
5
# External OpenID providers
2
6
3
-
Defguard, [apart from being an identity provider itself](../admin-and-features/features-and-configuration/openid-connect/), supports logging in through external OpenID providers. Currently, there are two built in providers (Google and Microsoft) but there is also an option to specify a custom provider.
7
+
Defguard, [apart from being an identity provider itself](../../admin-and-features/features-and-configuration/openid-connect/), supports logging in through external OpenID providers. Currently, there are two built in providers (Google and Microsoft) but there is also an option to specify a custom provider.
4
8
5
9
### Prerequisites
6
10
@@ -29,7 +33,7 @@ This is an optional value required only if you are using Microsoft as your provi
29
33
30
34
In order to configure the external OpenID provider login, go to the settings in the Defguard admin dashboard.
Everything related to the external OpenID configuration can be found in the OpenID tab of the settings page. First thing to do here would be to pick your provider using the dropdown menu under the "Provider" label. Next, fill out the required information with values acquired from your provider. If you picked "Microsoft" or "Custom", make sure to also make corresponding changes in the "Base URL" field. After you are done, click "Save changes" to keep your changes. 
35
39
@@ -44,37 +48,37 @@ You may have also noticed the checkbox option on the right. By default, when a n
44
48
1. The Google OpenID connect can be configured in the [Google Cloud Console](https://console.cloud.google.com)
45
49
2. If you don't have any project setup already (or you want to create a new one for this purpose), create it by clicking the dropdown menu here:
6. Fill in all required details. Make sure to fill the correct domain. This should be the top domain under which your Defguard dashboard can be accessed, not the subdomain (e.g. `defguard.example.com` -> `example.com`). 
58
62
7. On the scopes config screen, click `ADD OR REMOVE SCOPES`, Defguard requires at least the following scopes:
Make sure to select "Web application" as the application type. The other thing to note here is the redirect URI. It is the URI to which the user will be redirected from the external provider's authorization. This URI is in the form of `<DEFGUARD_DASHBOARD_URL>/auth/callback`. Replace `<DEFGUARD_DASHBOARD_URL>` with the URL under which your dashboard is accessible, e.g. `https://defguard.example.com`.
75
79
11. After you proceed further, you will be presented with a popup containing your `Client ID` and `Client Secret`, copy them and paste on the Defguard OpenID configuration page.
Make sure the Redirect URL you insert here is correct. Replace `defguard.example.com` with the domain you use for your Defguard dashboard.
97
101
6. You should be now on the registered application's management screen. You can copy the client's ID and the tenant ID from here, as you need to provide them on the Defguard settings' page.\
98
102
99
103
100
-
<figure><imgsrc="../.gitbook/assets/Zrzut ekranu 2024-10-18 o 16.13.54.png"alt=""><figcaption></figcaption></figure>
104
+
<figure><imgsrc="../../.gitbook/assets/Zrzut ekranu 2024-10-18 o 16.13.54.png"alt=""><figcaption></figcaption></figure>
101
105
7. Go to Defguard settings, click the OpenID tab and paste the copied client ID. The tenant ID should be inserted instead of the `<TENANT_ID>` placeholder in the base URL field.
102
106
8. Now back in Microsoft Entra ID, still in your newly created application, go to Certificates and Secrets\
Copy file name to clipboardExpand all lines: enterprise/license.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ icon: file-certificate
4
4
5
5
# License
6
6
7
-
Defguard Enterprise offers a lot of functionalities that are not offered in the Open Source Open Core, like external OpenID Connect support, automatic\&real time desktop client synchronization and configuration, and much more (go to [All Enterprise Features](all-enteprise-features.md) to see more). In order to activate those features an Enterprise License must be obtained.
7
+
Defguard Enterprise offers a lot of functionalities that are not offered in the Open Source Open Core, like external OpenID Connect support, automatic\&real time desktop client synchronization and configuration, and much more (go to [All Enterprise Features](all-enteprise-features/) to see more). In order to activate those features an Enterprise License must be obtained.
8
8
9
9
{% hint style="info" %}
10
10
From release 1.1.0 (to be released mid Nov 2024) **all enterprise features up to the following limits are free and no license is required!**
Copy file name to clipboardExpand all lines: features/setting-up-your-instance/upgrading.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ If you have duplicate emails in your database, the migrations during the upgrade
23
23
24
24
### Desktop Client Real Time Sync
25
25
26
-
From 1.0.0 we have introduced [Enterprise features](../../enterprise/all-enteprise-features.md), and one of them is [automatic and real-time desktop client configuration synchronisation](../../enterprise/automatic-real-time-desktop-client-configuration.md).
26
+
From 1.0.0 we have introduced [Enterprise features](../../enterprise/all-enteprise-features/), and one of them is [automatic and real-time desktop client configuration synchronisation](../../enterprise/all-enteprise-features/automatic-real-time-desktop-client-configuration.md).
27
27
28
28
To enable this on an **already configured desktop client** one must perform one time instance update, which will generate necessary tokens on the client to perform from now on automatic updates. In details:
Copy file name to clipboardExpand all lines: help/configuring-vpn/add-new-instance/update-instance.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ If you are looking for how to generate tokens for your users as an Administrator
11
11
{% endhint %}
12
12
13
13
{% hint style="warning" %}
14
-
Updating the desktop client instance manually is only done if you are using defguard Open Source Open Core, if you have an Enterprise License, all desktop clients and all instances are [synchronized automatically and in real-time.](../../../enterprise/automatic-real-time-desktop-client-configuration.md)
14
+
Updating the desktop client instance manually is only done if you are using defguard Open Source Open Core, if you have an Enterprise License, all desktop clients and all instances are [synchronized automatically and in real-time.](../../../enterprise/all-enteprise-features/automatic-real-time-desktop-client-configuration.md)
0 commit comments