Repository navigation
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Syncs the Enterprise Cookbook tab with OpenHands/enterprise-cookbook@2fb0f51. Every file under `cookbook/` and the Enterprise Cookbook tab in `docs.json` are generated from that repository. Change them there, not here; edits made directly in this repository are overwritten by the next sync. _Opened automatically by the docs-publish workflow in OpenHands/enterprise-cookbook ([run](https://github.com/OpenHands/enterprise-cookbook/actions/runs/39214962875))._ Co-authored-by: openhands-release-bot[bot] <290150379+openhands-release-bot[bot]@users.noreply.github.com>
* docs: add tested Google Cloud Replicated quick start * docs: split Enterprise quick start into AWS and Generic VM guides * docs: add Azure Replicated quick start * Correct quick-start sizing references and direct installation links * Link directly to the Replicated installation skill * Clarify validated Azure VM path after independent review * docs: group Enterprise quick starts under VM Install
* docs: add AWS Bedrock gateway guide for Helm and Replicated * docs: clarify adding Bedrock models in Replicated and Helm * docs: clarify Bedrock Admin Console authentication fields * Align Bedrock managed gateway profiles with provider guides
* docs: add Google Vertex AI and Gemini gateway guide * Preserve measured validation and clarify supported configuration scope * Use verified profile UI fields and tested organization API overrides * State Google profile validation scope precisely * Clarify Replicated Google credential distribution
* docs: update documentation for OpenHands v1.28.0 Add release notes page for Agent Canvas 1.28.0 and update the affected docs based on the release review in #977. - Add openhands/usage/agent-canvas/release-notes/v1.28.0.mdx and a docs.json navigation entry. - secrets-settings: document agent-requested secrets (inline chat card, value never shown, status-only result, local-backend scope). - prebuilt-automations: document the six templates hidden on self-hosted cloud backends. - conversations: document the missing-runtime archived presentation and drop the removed overview-drawer panels. - plugins: document the Local launch plugin-parameter limitation. - application-settings: add the supported UI languages, including Bahasa Indonesia. Co-authored-by: openhands <openhands@all-hands.dev> * Remove self-hosted recommended automations section Removed section about recommended automations on self-enterprise when inside agent canvas section --------- Co-authored-by: openhands <openhands@all-hands.dev> Co-authored-by: Devin <devinvinson@gmail.com>
* docs: link GKE guide to Google LLM gateway setup * docs: cross-link AWS and Azure installation gateway guides
jpelletier1
self-requested a review
October 20, 2026 17:12
jpelletier1
marked this pull request as ready for review
October 20, 2026 17:12
jpelletier1
approved these changes
Oct 20, 2026
Contributor
|
Holding for the release. Before taking this out of draft:
|
This was referenced Oct 20, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add an Okta SAML guide under Enterprise → SAML SSO, covering administrator app/group setup, required profile attributes, deployment through the shared SAML guide, multi-user verification, and the separate administrator and user steps for GitHub access. Explain the Okta→Keycloak SAML and Keycloak→OpenHands OIDC protocol boundaries. Include the tested claims screenshot and link the page from the SAML overview and navigation.
Draft only — do not merge or publish until the release and validation gates below are met. The page retains an explicit draft warning. No supported minimum fixed release has been established, and it does not document unreleased enforcement flags or manual Kubernetes repairs as customer setup.
Dependencies and Merge Gates
The broader Okta-only requirement additionally depends on the matching application/chart candidates, OpenHands/enterprise#838 and OpenHands/OpenHands-Cloud#1424, plus live restart/redeployment/rollback validation. That work is deferred to the upgraded Helm evaluation; this PR explicitly says SAML enablement alone does not enforce Okta-only login. Maintainers may scope the first publication to SAML sign-in and separate Git access, keeping enforcement documented as unavailable until validated.
Evidence and Limits
Azure Replicated package 0.75.0 / app 1.68.0 / Keycloak 26.3.0 was tested with explicitly approved certificate/profile provisioning repairs. Two group-assigned users signed in, retained separate accounts/history, and were denied access to each other's private conversations. Removing an app assignment blocked the next sign-in but did not immediately revoke an existing OpenHands session.
One Okta-backed user connected a second GitHub identity and checked out/read a selected private repository. This required a temporary public, personally owned GitHub App and manual linking-only guard; both were rolled back, and the test installation was removed. It does not validate the candidate code, organization-owned private app rollout, token renewal, persistent enforcement, or an unmodified supported release. Internal logs, credentials, tenant identifiers, and live test URLs are excluded from this PR.
Validation
broken-links: no broken links found (Node 24 LTS).git diff --checkpasses. The included screenshot was inspected for credentials and user/tenant details.