SAML SSO for Groups

Introduced in GitLab Premium 11.0.

This allows SAML to be used for adding users to a group on GitLab.com and other instances where using site-wide SAML is not possible.

When using a group SAML SSO link, users should already have an account on the GitLab instance with the email address that matches the user account from the provider.

Note: SAML SSO for groups is used only as a convenient way to add users and does not sync users between providers. Group owners will still need to manage user accounts, such as removing users when necessary.

How to configure

  1. Navigate to the group and click Settings -> SAML SSO.
  2. Configure your SAML server using the Assertion consumer service URL and Issuer. See your identity provider’s documentation for more details.
  3. Configure required assertions using the table below.
  4. Find the SSO URL from your Identity Provider and enter it on GitLab.
  5. Find and enter the fingerprint for the SAML token signing certificate.

Assertions

Field Supported keys Notes
Email email, mail (required)
Full Name name  
First Name first_name, firstname, firstName  
Last Name last_name, lastname, lastName  

Providers

Provider Documentation
ADFS (Active Directory Federation Services) Create a Relying Party Trust
Azure Configuring single sign-on to applications
Auth0 Auth0 as Identity Provider
G Suite Set up your own custom SAML application
Okta Setting up a SAML application in Okta
OneLogin How to Use the OneLogin SAML Test Connector
Ping Identity Add and configure a new SAML application

Glossary

Term Description
Identity Provider The service which manages your user identities such as ADFS, Okta, Onelogin or Ping Identity.
Service Provider SAML considers GitLab to be a service provider.
Assertion A piece of information about a user’s identity, such as their name or role. Also know as claims or attributes.
SSO Single Sign On.
Assertion consumer service URL The callback on GitLab where users will be redirected after successfully authenticating with the identity provider.
Issuer How GitLab identifies itself to the identity provider. Also known as a “Relying party trust identifier”.
Certificate fingerprint Used to confirm that communications over SAML are secure by checking that the server is signing communications with the correct certificate. Also known as a certificate thumbprint.