PSMDB-1438-OIDC-8.0

[nastena1606]

new file: docs/_images/OIDC-flow.png
modified: docs/authentication.md
new file: docs/oidc.md
modified: docs/psmdb-pro.md
modified: mkdocs-base.yml

[radoslawszulgo]

Suggested change

Percona Server for MongoDB supports OpenID Connect (OIDC) as an authentication mechanism which extends the OAuth 2.0 authorization framework. You can configure SSO for Percona Server for MongoDB using an external IP provider so that users and applications are authenticated and authorized without sharing their credentials. As a result you streamline authentication and authorization flow and increase security within your system.

Percona Server for MongoDB supports OpenID Connect (OIDC) as an authentication mechanism that extends the OAuth 2.0 authorization framework. You can configure SSO for Percona Server for MongoDB using an external Identity Provider (IdP) so that users and applications are authenticated and authorized without sharing their credentials with MongoDB clients. As a result, you streamline authentication and authorization flow and increase security within your system.

[radoslawszulgo]

Suggested change

	This functionality is available with [Percona Server for MongoDB Pro](psmdb-pro.md). [Reach out to us](https://www.percona.com/about/contact) to become a Percona Customer.
	This feature is built only with [Percona Server for MongoDB Pro](psmdb-pro.md). To become a Percona customer, [Reach out to us](https://www.percona.com/about/contact). Alternatively, you can also build PSMDB with OIDC feature from sources without a Percona subscription.

[radoslawszulgo]

Suggested change

	With the OIDC / OAuth 2.0 support in Percona Server for MongoDB, users can authenticate and authorize in your infrastructure without sharing their credentials. To make this happen, you enable a single sign-on (SSO) for Percona Server for MongoDB using an external identity provider (IdP).
	With the OIDC / OAuth 2.0 support in Percona Server for MongoDB, users can authenticate and authorize your infrastructure without sharing their credentials in the MongoDB client. Single Sign-On (SSO) requires an external Identity Provider (IdP) for Percona Server for MongoDB.

[radoslawszulgo]

Suggested change

* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a `mongo` client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when both a `mongo` client and Percona Server for MongoDB run in a cloud environment and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords.

* **Device authentication**: instead of redirecting a user to authenticate on a login portal directly, a MongoDB client receives the URL of the login portal and the authentication code. The user follows the URL and enters the authentication code. The example use case for such a workflow is when a MongoDB client and Percona Server for MongoDB run in a cloud environment, and the client needs to authenticate in Percona Server for MongoDB without managing long-term credentials like passwords.