summaryrefslogtreecommitdiff
path: root/doc/administration/auth
diff options
context:
space:
mode:
Diffstat (limited to 'doc/administration/auth')
-rw-r--r--doc/administration/auth/README.md7
-rw-r--r--doc/administration/auth/google_secure_ldap.md8
-rw-r--r--doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md8
-rw-r--r--doc/administration/auth/how_to_configure_ldap_gitlab_ee/index.md8
-rw-r--r--doc/administration/auth/img/okta_admin_panel_v13_9.pngbin0 -> 152598 bytes
-rw-r--r--doc/administration/auth/ldap-ee.md8
-rw-r--r--doc/administration/auth/ldap-troubleshooting.md8
-rw-r--r--doc/administration/auth/ldap.md8
-rw-r--r--doc/administration/auth/ldap/google_secure_ldap.md2
-rw-r--r--doc/administration/auth/ldap/index.md65
-rw-r--r--doc/administration/auth/ldap/ldap-troubleshooting.md20
-rw-r--r--doc/administration/auth/oidc.md2
-rw-r--r--doc/administration/auth/okta.md6
-rw-r--r--doc/administration/auth/smartcard.md2
14 files changed, 55 insertions, 97 deletions
diff --git a/doc/administration/auth/README.md b/doc/administration/auth/README.md
index cc3421d3133..69220113940 100644
--- a/doc/administration/auth/README.md
+++ b/doc/administration/auth/README.md
@@ -22,7 +22,8 @@ providers:
- [Facebook](../../integration/facebook.md)
- [GitHub](../../integration/github.md)
- [GitLab.com](../../integration/gitlab.md)
-- [Google](../../integration/google.md)
+- [Google OAuth](../../integration/google.md)
+- [Google Workspace SSO](../../integration/google_workspace_saml.md)
- [JWT](jwt.md)
- [Kerberos](../../integration/kerberos.md)
- [LDAP](ldap/index.md): Includes Active Directory, Apple Open Directory, Open LDAP,
@@ -31,9 +32,9 @@ providers:
- [Okta](okta.md)
- [Salesforce](../../integration/salesforce.md)
- [SAML](../../integration/saml.md)
-- [SAML for GitLab.com groups](../../user/group/saml_sso/index.md) **(SILVER ONLY)**
+- [SAML for GitLab.com groups](../../user/group/saml_sso/index.md) **(PREMIUM SAAS)**
- [Shibboleth](../../integration/shibboleth.md)
-- [Smartcard](smartcard.md) **(PREMIUM ONLY)**
+- [Smartcard](smartcard.md) **(PREMIUM SELF)**
- [Twitter](../../integration/twitter.md)
NOTE:
diff --git a/doc/administration/auth/google_secure_ldap.md b/doc/administration/auth/google_secure_ldap.md
deleted file mode 100644
index 37366b00f73..00000000000
--- a/doc/administration/auth/google_secure_ldap.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-redirect_to: 'ldap/google_secure_ldap.md'
----
-
-This document was moved to [another location](ldap/google_secure_ldap.md).
-
-<!-- This redirect file can be deleted after February 1, 2021. -->
-<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/#move-or-rename-a-page -->
diff --git a/doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md b/doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md
deleted file mode 100644
index ffce06afb63..00000000000
--- a/doc/administration/auth/how_to_configure_ldap_gitlab_ce/index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-redirect_to: '../ldap/index.md'
----
-
-This document was moved to [another location](../ldap/index.md).
-
-<!-- This redirect file can be deleted after February 1, 2021. -->
-<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/#move-or-rename-a-page -->
diff --git a/doc/administration/auth/how_to_configure_ldap_gitlab_ee/index.md b/doc/administration/auth/how_to_configure_ldap_gitlab_ee/index.md
deleted file mode 100644
index ffce06afb63..00000000000
--- a/doc/administration/auth/how_to_configure_ldap_gitlab_ee/index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-redirect_to: '../ldap/index.md'
----
-
-This document was moved to [another location](../ldap/index.md).
-
-<!-- This redirect file can be deleted after February 1, 2021. -->
-<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/#move-or-rename-a-page -->
diff --git a/doc/administration/auth/img/okta_admin_panel_v13_9.png b/doc/administration/auth/img/okta_admin_panel_v13_9.png
new file mode 100644
index 00000000000..bba859c80af
--- /dev/null
+++ b/doc/administration/auth/img/okta_admin_panel_v13_9.png
Binary files differ
diff --git a/doc/administration/auth/ldap-ee.md b/doc/administration/auth/ldap-ee.md
deleted file mode 100644
index 6d56654a44b..00000000000
--- a/doc/administration/auth/ldap-ee.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-redirect_to: 'ldap/index.md'
----
-
-This document was moved to [another location](ldap/index.md).
-
-<!-- This redirect file can be deleted after February 1, 2021. -->
-<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/#move-or-rename-a-page -->
diff --git a/doc/administration/auth/ldap-troubleshooting.md b/doc/administration/auth/ldap-troubleshooting.md
deleted file mode 100644
index 1e02755e3e5..00000000000
--- a/doc/administration/auth/ldap-troubleshooting.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-redirect_to: 'ldap/ldap-troubleshooting.md'
----
-
-This document was moved to [another location](ldap/ldap-troubleshooting.md).
-
-<!-- This redirect file can be deleted after February 1, 2021. -->
-<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/#move-or-rename-a-page -->
diff --git a/doc/administration/auth/ldap.md b/doc/administration/auth/ldap.md
deleted file mode 100644
index 6d56654a44b..00000000000
--- a/doc/administration/auth/ldap.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-redirect_to: 'ldap/index.md'
----
-
-This document was moved to [another location](ldap/index.md).
-
-<!-- This redirect file can be deleted after February 1, 2021. -->
-<!-- Before deletion, see: https://docs.gitlab.com/ee/development/documentation/#move-or-rename-a-page -->
diff --git a/doc/administration/auth/ldap/google_secure_ldap.md b/doc/administration/auth/ldap/google_secure_ldap.md
index 6fecf74d935..2b75d864352 100644
--- a/doc/administration/auth/ldap/google_secure_ldap.md
+++ b/doc/administration/auth/ldap/google_secure_ldap.md
@@ -5,7 +5,7 @@ group: Access
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
---
-# Google Secure LDAP **(CORE ONLY)**
+# Google Secure LDAP **(FREE SELF)**
> [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/issues/46391) in GitLab 11.9.
diff --git a/doc/administration/auth/ldap/index.md b/doc/administration/auth/ldap/index.md
index de0f123acf1..74621f9c1ba 100644
--- a/doc/administration/auth/ldap/index.md
+++ b/doc/administration/auth/ldap/index.md
@@ -29,7 +29,7 @@ stands for **Lightweight Directory Access Protocol**, which is a standard
application protocol for accessing and maintaining distributed directory
information services over an Internet Protocol (IP) network.
-## Security **(CORE ONLY)**
+## Security **(FREE SELF)**
GitLab assumes that LDAP users:
@@ -44,7 +44,7 @@ We recommend against using LDAP integration if your LDAP users are
allowed to change their 'mail', 'email' or 'userPrincipalName' attribute on
the LDAP server or share email addresses.
-### User deletion **(CORE ONLY)**
+### User deletion **(FREE SELF)**
If a user is deleted from the LDAP server, they are also blocked in GitLab.
Users are immediately blocked from logging in. However, there is an
@@ -53,16 +53,16 @@ are already logged in or are using Git over SSH are be able to access
GitLab for up to one hour. Manually block the user in the GitLab Admin Area to
immediately block all access.
-GitLab Enterprise Edition Starter supports a
-[configurable sync time](#adjusting-ldap-user-sync-schedule). **(STARTER)**
+GitLab Enterprise Edition Premium supports a
+[configurable sync time](#adjusting-ldap-user-sync-schedule). **(PREMIUM)**
-## Git password authentication **(CORE ONLY)**
+## Git password authentication **(FREE SELF)**
LDAP-enabled users can always authenticate with Git using their GitLab username
or email and LDAP password, even if password authentication for Git is disabled
in the application settings.
-## Enabling LDAP sign-in for existing GitLab users **(CORE ONLY)**
+## Enabling LDAP sign-in for existing GitLab users **(FREE SELF)**
When a user signs in to GitLab with LDAP for the first time, and their LDAP
email address is the primary email address of an existing GitLab user, then
@@ -73,7 +73,7 @@ In other words, if an existing GitLab user wants to enable LDAP sign-in for
themselves, they should check that their GitLab email address matches their
LDAP email address, and then sign into GitLab via their LDAP credentials.
-## Google Secure LDAP **(CORE ONLY)**
+## Google Secure LDAP **(FREE SELF)**
> Introduced in GitLab 11.9.
@@ -81,7 +81,7 @@ LDAP email address, and then sign into GitLab via their LDAP credentials.
LDAP service that can be configured with GitLab for authentication and group sync.
See [Google Secure LDAP](google_secure_ldap.md) for detailed configuration instructions.
-## Configuration **(CORE ONLY)**
+## Configuration **(FREE SELF)**
To enable LDAP integration you need to add your LDAP server settings in
`/etc/gitlab/gitlab.rb` or `/home/git/gitlab/config/gitlab.yml` for Omnibus
@@ -100,7 +100,7 @@ would be on port 389. `plain` also operates on port 389. Removed values: `tls` w
LDAP users must have a set email address, regardless of whether or not it's used
to sign in.
-### Example Configurations **(CORE ONLY)**
+### Example Configurations **(FREE SELF)**
**Omnibus Configuration**
@@ -163,7 +163,7 @@ production:
...
```
-### Basic Configuration Settings **(CORE ONLY)**
+### Basic Configuration Settings **(FREE SELF)**
| Setting | Description | Required | Examples |
| ------- | ----------- | -------- | -------- |
@@ -183,7 +183,7 @@ production:
| `user_filter` | Filter LDAP users. Format: [RFC 4515](https://tools.ietf.org/search/rfc4515) Note: GitLab does not support `omniauth-ldap`'s custom filter syntax. | no | `'(employeeType=developer)'` or `'(&(objectclass=user)(|(samaccountname=momo)(samaccountname=toto)))'` |
| `lowercase_usernames` | If lowercase_usernames is enabled, GitLab converts the name to lower case. | no | boolean |
-### SSL Configuration Settings **(CORE ONLY)**
+### SSL Configuration Settings **(FREE SELF)**
| Setting | Description | Required | Examples |
| ------- | ----------- | -------- | -------- |
@@ -193,7 +193,7 @@ production:
| `cert` | Client certificate | no | `'-----BEGIN CERTIFICATE----- <REDACTED> -----END CERTIFICATE -----'` |
| `key` | Client private key | no | `'-----BEGIN PRIVATE KEY----- <REDACTED> -----END PRIVATE KEY -----'` |
-### Attribute Configuration Settings **(CORE ONLY)**
+### Attribute Configuration Settings **(FREE SELF)**
LDAP attributes that GitLab uses to create an account for the LDAP user. The specified attribute can either be the attribute name as a string (for example, `'mail'`), or an array of attribute names to try in order (for example, `['mail', 'email']`). Note that the user's LDAP sign-in is the attribute specified as `uid` above.
@@ -205,7 +205,7 @@ LDAP attributes that GitLab uses to create an account for the LDAP user. The spe
| `first_name` | LDAP attribute for user first name. Used when the attribute configured for `name` does not exist. | no | `'givenName'` |
| `last_name` | LDAP attribute for user last name. Used when the attribute configured for `name` does not exist. | no | `'sn'` |
-### LDAP Sync Configuration Settings **(STARTER ONLY)**
+### LDAP Sync Configuration Settings **(PREMIUM SELF)**
| Setting | Description | Required | Examples |
| ------- | ----------- | -------- | -------- |
@@ -214,7 +214,7 @@ LDAP attributes that GitLab uses to create an account for the LDAP user. The spe
| `external_groups` | An array of CNs of groups containing users that should be considered external. Note: Not `cn=interns` or the full DN. | no | `['interns', 'contractors']` |
| `sync_ssh_keys` | The LDAP attribute containing a user's public SSH key. | no | `'sshPublicKey'` or false if not set |
-### Set up LDAP user filter **(CORE ONLY)**
+### Set up LDAP user filter **(FREE SELF)**
If you want to limit all GitLab access to a subset of the LDAP users on your
LDAP server, the first step should be to narrow the configured `base`. However,
@@ -254,12 +254,12 @@ group, you can use the following syntax:
For more information about this "LDAP_MATCHING_RULE_IN_CHAIN" filter, see the following
[Microsoft Search Filter Syntax](https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax) document.
Support for nested members in the user filter should not be confused with
-[group sync nested groups support](#supported-ldap-group-typesattributes). **(STARTER ONLY)**
+[group sync nested groups support](#supported-ldap-group-typesattributes). **(PREMIUM SELF)**
Please note that GitLab does not support the custom filter syntax used by
OmniAuth LDAP.
-#### Escaping special characters **(CORE ONLY)**
+#### Escaping special characters **(FREE SELF)**
The `user_filter` DN can contain special characters. For example:
@@ -290,7 +290,7 @@ The `user_filter` DN can contain special characters. For example:
OU=Gitlab \28Inc\29,DC=gitlab,DC=com
```
-### Enabling LDAP username lowercase **(CORE ONLY)**
+### Enabling LDAP username lowercase **(FREE SELF)**
Some LDAP servers, depending on their configurations, can return uppercase usernames.
This can lead to several confusing issues such as creating links or namespaces with uppercase names.
@@ -328,7 +328,7 @@ the configuration option `lowercase_usernames`. By default, this configuration o
1. [Restart GitLab](../../restart_gitlab.md#installations-from-source) for the changes to take effect.
-### Disable LDAP web sign in **(CORE ONLY)**
+### Disable LDAP web sign in **(FREE SELF)**
It can be useful to prevent using LDAP credentials through the web UI when
an alternative such as SAML is preferred. This allows LDAP to be used for group
@@ -360,7 +360,7 @@ This does not disable [using LDAP credentials for Git access](#git-password-auth
1. [Restart GitLab](../../restart_gitlab.md#installations-from-source) for the changes to take effect.
-### Using encrypted credentials **(CORE ONLY)**
+### Using encrypted credentials **(FREE SELF)**
Instead of having the LDAP integration credentials stored in plaintext in the configuration files, you can optionally
use an encrypted file for the LDAP credentials. To use this feature, you first need to enable
@@ -447,7 +447,7 @@ If initially your LDAP configuration looked like:
1. [Restart GitLab](../../restart_gitlab.md#installations-from-source) for the changes to take effect.
-## Encryption **(CORE ONLY)**
+## Encryption **(FREE SELF)**
### TLS Server Authentication
@@ -467,7 +467,7 @@ You should disable anonymous LDAP authentication and enable simple or SASL
authentication. The TLS client authentication setting in your LDAP server cannot
be mandatory and clients cannot be authenticated with the TLS protocol.
-## Multiple LDAP servers **(STARTER ONLY)**
+## Multiple LDAP servers **(PREMIUM SELF)**
With GitLab Enterprise Edition Starter, you can configure multiple LDAP servers
that your GitLab instance connects to.
@@ -515,7 +515,7 @@ gitlab_rails['ldap_servers'] = {
If you configure multiple LDAP servers, use a unique naming convention for the `label` section of each entry. That label is used as the display name of the tab shown on the sign-in page.
-## User sync **(STARTER ONLY)**
+## User sync **(PREMIUM SELF)**
Once per day, GitLab runs a worker to check and update GitLab
users against LDAP.
@@ -530,7 +530,12 @@ The process executes the following access checks:
In Active Directory, a user is marked as disabled/blocked if the user
account control attribute (`userAccountControl:1.2.840.113556.1.4.803`)
has bit 2 set.
-For more information, see <https://ctovswild.com/2009/09/03/bitmask-searches-in-ldap/>
+
+<!-- vale gitlab.Spelling = NO -->
+
+For more information, see [Bitmask Searches in LDAP](https://ctovswild.com/2009/09/03/bitmask-searches-in-ldap/).
+
+<!-- vale gitlab.Spelling = YES -->
The user is set to an `ldap_blocked` state in GitLab if the previous conditions
fail. This means the user is not able to sign in or push/pull code.
@@ -546,7 +551,7 @@ The LDAP sync process:
- Updates existing users.
- Creates new users on first sign in.
-### Adjusting LDAP user sync schedule **(STARTER ONLY)**
+### Adjusting LDAP user sync schedule **(PREMIUM SELF)**
By default, GitLab runs a worker once per day at 01:30 a.m. server time to
check and update GitLab users against LDAP.
@@ -579,7 +584,7 @@ sync to run once every 12 hours at the top of the hour.
1. [Restart GitLab](../../restart_gitlab.md#installations-from-source) for the changes to take effect.
-## Group Sync **(STARTER ONLY)**
+## Group Sync **(PREMIUM SELF)**
If your LDAP supports the `memberof` property, when the user signs in for the
first time GitLab triggers a sync for groups the user should be a member of.
@@ -629,11 +634,11 @@ following.
To take advantage of group sync, group owners or maintainers need to [create one
or more LDAP group links](#adding-group-links).
-### Adding group links **(STARTER ONLY)**
+### Adding group links **(PREMIUM SELF)**
For information on adding group links via CNs and filters, refer to [the GitLab groups documentation](../../../user/group/index.md#manage-group-memberships-via-ldap).
-### Administrator sync **(STARTER ONLY)**
+### Administrator sync **(PREMIUM SELF)**
As an extension of group sync, you can automatically manage your global GitLab
administrators. Specify a group CN for `admin_group` and all members of the
@@ -677,7 +682,7 @@ group, as opposed to the full DN.
1. [Restart GitLab](../../restart_gitlab.md#installations-from-source) for the changes to take effect.
-### Global group memberships lock **(STARTER ONLY)**
+### Global group memberships lock **(PREMIUM SELF)**
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/1793) in GitLab 12.0.
@@ -696,7 +701,7 @@ To enable it you need to:
1. Navigate to **(admin)** **Admin Area > Settings -> Visibility and access controls**.
1. Make sure the "Lock memberships to LDAP synchronization" checkbox is enabled.
-### Adjusting LDAP group sync schedule **(STARTER ONLY)**
+### Adjusting LDAP group sync schedule **(PREMIUM SELF)**
By default, GitLab runs a group sync process every hour, on the hour.
The values shown are in cron format. If needed, you can use a
@@ -735,7 +740,7 @@ sync to run once every 2 hours at the top of the hour.
1. [Restart GitLab](../../restart_gitlab.md#installations-from-source) for the changes to take effect.
-### External groups **(STARTER ONLY)**
+### External groups **(PREMIUM SELF)**
Using the `external_groups` setting will allow you to mark all users belonging
to these groups as [external users](../../../user/permissions.md#external-users).
diff --git a/doc/administration/auth/ldap/ldap-troubleshooting.md b/doc/administration/auth/ldap/ldap-troubleshooting.md
index 1976bab03c6..5640e938651 100644
--- a/doc/administration/auth/ldap/ldap-troubleshooting.md
+++ b/doc/administration/auth/ldap/ldap-troubleshooting.md
@@ -52,7 +52,7 @@ main: # 'main' is the GitLab 'provider ID' of this LDAP server
admin_group: 'my_admin_group'
```
-#### Query LDAP **(STARTER ONLY)**
+#### Query LDAP **(PREMIUM SELF)**
The following allows you to perform a search in LDAP using the rails console.
Depending on what you're trying to do, it may make more sense to query [a
@@ -210,7 +210,7 @@ ldapsearch -H ldaps://$host:$port -D "$bind_dn" -y bind_dn_password.txt -b "$ba
port.
- We are assuming the password for the `bind_dn` user is in `bind_dn_password.txt`.
-#### Sync all users **(STARTER ONLY)**
+#### Sync all users **(PREMIUM SELF)**
The output from a manual [user sync](index.md#user-sync) can show you what happens when
GitLab tries to sync its users against LDAP. Enter the [rails console](#rails-console)
@@ -225,7 +225,7 @@ LdapSyncWorker.new.perform
Next, [learn how to read the
output](#example-console-output-after-a-user-sync).
-##### Example console output after a user sync **(STARTER ONLY)**
+##### Example console output after a user sync **(PREMIUM SELF)**
The output from a [manual user sync](#sync-all-users) will be very verbose, and a
single user's successful sync can look like this:
@@ -316,9 +316,9 @@ adapter = Gitlab::Auth::Ldap::Adapter.new('ldapmain') # If `main` is the LDAP pr
Gitlab::Auth::Ldap::Person.find_by_uid('<uid>', adapter)
```
-### Group memberships **(STARTER ONLY)**
+### Group memberships **(PREMIUM SELF)**
-#### Membership(s) not granted **(STARTER ONLY)**
+#### Membership(s) not granted **(PREMIUM SELF)**
Sometimes you may think a particular user should be added to a GitLab group via
LDAP group sync, but for some reason it's not happening. There are several
@@ -376,7 +376,7 @@ group sync](#sync-all-groups) in the rails console and [look through the
output](#example-console-output-after-a-group-sync) to see what happens when
GitLab syncs the `admin_group`.
-#### Sync all groups **(STARTER ONLY)**
+#### Sync all groups **(PREMIUM SELF)**
NOTE:
To sync all groups manually when debugging is unnecessary, [use the Rake
@@ -394,7 +394,7 @@ LdapAllGroupsSyncWorker.new.perform
Next, [learn how to read the
output](#example-console-output-after-a-group-sync).
-##### Example console output after a group sync **(STARTER ONLY)**
+##### Example console output after a group sync **(PREMIUM SELF)**
Like the output from the user sync, the output from the [manual group
sync](#sync-all-groups) will also be very verbose. However, it contains lots
@@ -484,7 +484,7 @@ stating as such:
No `admin_group` configured for 'ldapmain' provider. Skipping
```
-#### Sync one group **(STARTER ONLY)**
+#### Sync one group **(PREMIUM SELF)**
[Syncing all groups](#sync-all-groups) can produce a lot of noise in the output, which can be
distracting when you're only interested in troubleshooting the memberships of
@@ -506,7 +506,7 @@ EE::Gitlab::Auth::Ldap::Sync::Group.execute_all_providers(group)
The output will be similar to
[that you'd get from syncing all groups](#example-console-output-after-a-group-sync).
-#### Query a group in LDAP **(STARTER ONLY)**
+#### Query a group in LDAP **(PREMIUM SELF)**
When you'd like to confirm that GitLab can read a LDAP group and see all its members,
you can run the following:
@@ -562,7 +562,7 @@ emails.each do |username, email|
end
```
-You can then [run a UserSync](#sync-all-users) **(STARTER ONLY)** to sync the latest DN
+You can then [run a UserSync](#sync-all-users) **(PREMIUM SELF)** to sync the latest DN
for each of these users.
## Debugging Tools
diff --git a/doc/administration/auth/oidc.md b/doc/administration/auth/oidc.md
index 158182edfb5..1ddf75e7c1b 100644
--- a/doc/administration/auth/oidc.md
+++ b/doc/administration/auth/oidc.md
@@ -175,6 +175,6 @@ If you're having trouble, here are some tips:
OAuth2 access token if `client_auth_method` is not defined or if set to `basic`.
If you are seeing 401 errors upon retrieving the `userinfo` endpoint, you may
want to check your OpenID Web server configuration. For example, for
- [oauth2-server-php](https://github.com/bshaffer/oauth2-server-php), you
+ [`oauth2-server-php`](https://github.com/bshaffer/oauth2-server-php), you
may need to [add a configuration parameter to
Apache](https://github.com/bshaffer/oauth2-server-php/issues/926#issuecomment-387502778).
diff --git a/doc/administration/auth/okta.md b/doc/administration/auth/okta.md
index 50dc3b58680..a014fe7404f 100644
--- a/doc/administration/auth/okta.md
+++ b/doc/administration/auth/okta.md
@@ -19,13 +19,13 @@ The following guidance is based on this Okta article, on adding a [SAML Applicat
1. On Okta admin section, make sure to select Classic UI view in the top left corner. From there, choose to **Add an App**.
1. When the app screen comes up you see another button to **Create an App** and
choose SAML 2.0 on the next screen.
-1. Now, very important, add a logo
+1. Optionally you can add a logo
(you can choose it from <https://about.gitlab.com/press/>). You'll have to
crop and resize it.
-1. Next, you'll need the to fill in the SAML general configuration. Here's an example
+1. Next, you'll need the to fill in the SAML general configuration. Here's an example (showing the required URLs and attribute mapping):
image.
- ![Okta admin panel view](img/okta_admin_panel.png)
+ ![Okta admin panel view](img/okta_admin_panel_v13_9.png)
1. The last part of the configuration is the feedback section where you can
just say you're a customer and creating an app for internal use.
diff --git a/doc/administration/auth/smartcard.md b/doc/administration/auth/smartcard.md
index 9790802e413..dfeee5e7ac4 100644
--- a/doc/administration/auth/smartcard.md
+++ b/doc/administration/auth/smartcard.md
@@ -5,7 +5,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
type: reference
---
-# Smartcard authentication **(PREMIUM ONLY)**
+# Smartcard authentication **(PREMIUM SELF)**
GitLab supports authentication using smartcards.
View Lorry Controller Status