SAML SSO for GitLab.com groups

Introduced in GitLab 11.0.

This page describes SAML for groups. For instance-wide SAML on self-managed GitLab instances, see SAML OmniAuth Provider. View the differences between SaaS and Self-Managed Authentication and Authorization Options.

SAML on GitLab.com allows users to sign in through their SAML identity provider. If the user is not already a member, the sign-in process automatically adds the user to the appropriate group.

User synchronization of SAML SSO groups is supported through SCIM. SCIM supports adding and removing users from the GitLab group automatically. For example, if you remove a user from the SCIM app, SCIM removes that same user from the GitLab group.

SAML SSO is only configurable at the top-level group.

If required, you can find a glossary of common terms.

Configure your identity provider

  1. Find the information in GitLab required for configuration:
    1. On the top bar, select Menu > Groups and find your group.
    2. On the left sidebar, select Settings > SAML SSO.
    3. Note the Assertion consumer service URL, Identifier, and GitLab single sign-on URL.
  2. Configure your SAML identity provider app using the noted details. Alternatively, GitLab provides a metadata XML configuration. See specific identity provider documentation for more details.
  3. Configure the SAML response to include a NameID that uniquely identifies each user.
  4. Configure the required user attributes, ensuring you include the user’s email address.
  5. While the default is enabled for most SAML providers, please ensure the app is set to have service provider initiated calls in order to link existing GitLab accounts.
  6. Once the identity provider is set up, move on to configuring GitLab.

Issuer and callback for configuring SAML identity provider with GitLab.com

If your account is the only owner in the group after SAML is set up, you can’t unlink the account. To unlink the account, set up another user as a group owner.

NameID

GitLab.com uses the SAML NameID to identify users. The NameID element:

  • Is a required field in the SAML response.
  • Must be unique to each user.
  • Must be a persistent value that never changes, such as a randomly generated unique user ID.
  • Is case sensitive. The NameID must match exactly on subsequent login attempts, so should not rely on user input that could change between upper and lower case.
  • Should not be an email address or username. We strongly recommend against these as it’s hard to guarantee it doesn’t ever change, for example, when a person’s name changes. Email addresses are also case-insensitive, which can result in users being unable to sign in.

The relevant field name and recommended value for supported providers are in the provider specific notes. appropriate corresponding field.

caution
Once users have signed into GitLab using the SSO SAML setup, changing the NameID breaks the configuration and potentially locks users out of the GitLab group.

NameID Format

We recommend setting the NameID format to Persistent unless using a field (such as email) that requires a different format. Most NameID formats can be used, except Transient due to the temporary nature of this format.

User attributes

To create users with the correct information for improved user access and management, the user’s details must be passed to GitLab as attributes in the SAML assertion. At a minimum, the user’s email address must be specified as an attribute named email or mail.

You can configure the following attributes with GitLab.com Group SAML:

  • username or nickname. We recommend you configure only one of these.
  • The attributes available to self-managed GitLab instances.

Metadata configuration

GitLab provides metadata XML that can be used to configure your identity provider.

  1. On the top bar, select Menu > Groups and find your group.
  2. On the left sidebar, select Settings > SAML SSO.
  3. Copy the provided GitLab metadata URL.
  4. Follow your identity provider’s documentation and paste the metadata URL when it’s requested.

Configure GitLab

After you set up your identity provider to work with GitLab, you must configure GitLab to use it for authentication:

  1. On the top bar, select Menu > Groups and find your group.
  2. On the left sidebar, select Settings > SAML SSO.
  3. Find the SSO URL from your identity provider and enter it the Identity provider single sign-on URL field.
  4. Find and enter the fingerprint for the SAML token signing certificate in the Certificate field.
  5. Select the access level to be applied to newly added users in the Default membership role field. The default access level is ‘Guest’.
  6. Select the Enable SAML authentication for this group checkbox.
  7. Select the Save changes button.

Group SAML Settings for GitLab.com

note
The certificate fingerprint algorithm must be in SHA1. When configuring the identity provider, use a secure signature algorithm.

SSO enforcement

Version history
  • Introduced in GitLab 11.8.
  • Improved in GitLab 11.11 with ongoing enforcement in the GitLab UI.
  • Improved in GitLab 13.8, with an updated timeout experience.
  • Improved in GitLab 13.8 with allowing group owners to not go through SSO.
  • Improved in GitLab 13.11 with enforcing open SSO session to use Git if this setting is switched on.
  • Improved in GitLab 14.7 to not enforce SSO checks for Git activity originating from CI/CD jobs.

With this option enabled, users must access GitLab using your group GitLab single sign-on URL to access group resources. Users can’t be added as new members manually. Users with the Owner role can use the standard sign in process to make necessary changes to top-level group settings.

SSO enforcement does not affect sign in or access to any resources outside of the group. Users can view which groups and projects they are a member of without SSO sign in.

However, users are not prompted to sign in through SSO on each visit. GitLab checks whether a user has authenticated through SSO. If it’s been more than 1 day since the last sign-in, GitLab prompts the user to sign in again through SSO.

An issue exists to add a similar SSO requirement for API activity.

SSO has the following effects when enabled:

  • For groups, users can’t share a project in the group outside the top-level group, even if the project is forked.
  • For Git activity over SSH and HTTPS, users must have at least one active session signed-in through SSO before they can push to or pull from a GitLab repository.
  • Git activity originating from CI/CD jobs do not have the SSO check enforced.
  • Credentials that are not tied to regular users (for example, project and group access tokens, and deploy keys) do not have the SSO check enforced.
  • Users must be signed-in through SSO before they can pull images using the Dependency Proxy.

When SSO is enforced, users are not immediately revoked. If the user:

  • Is signed out, they cannot access the group after being removed from the identity provider.
  • Has an active session, they can continue accessing the group for up to 24 hours until the identity provider session times out.

Providers

The SAML standard means that you can use a wide range of identity providers with GitLab. Your identity provider might have relevant documentation. It can be generic SAML documentation or specifically targeted for GitLab.

When configuring your identity provider, please consider the notes below for specific providers to help avoid common issues and as a guide for terminology used.

For providers not listed below, you can refer to the instance SAML notes on configuring an identity provider for additional guidance on information your identity provider may require.

GitLab provides the following information for guidance only. If you have any questions on configuring the SAML app, please contact your provider’s support.

Azure setup notes

Follow the Azure documentation on configuring single sign-on to applications with the notes below for consideration.

For a demo of the Azure SAML setup including SCIM, see SCIM Provisioning on Azure Using SAML SSO for Groups Demo. The video is outdated in regard to objectID mapping and the SCIM documentation should be followed.

GitLab Setting Azure Field
Identifier Identifier (Entity ID)
Assertion consumer service URL Reply URL (Assertion Consumer Service URL)
GitLab single sign-on URL Sign on URL
Identity provider single sign-on URL Login URL
Certificate fingerprint Thumbprint

The recommended attributes and claims settings are:

  • Unique User Identifier (Name identifier) set to user.objectID.
  • nameid-format set to persistent.
  • Additional claims set to supported attributes.

If using Group Sync, customize the name of the group claim to match the required attribute.

See the troubleshooting page for an example configuration.

Google Workspace setup notes

Follow the Google Workspace documentation on setting up SSO with Google as your identity provider with the notes below for consideration.

GitLab setting Google Workspace field
Identifier Entity ID
Assertion consumer service URL ACS URL
GitLab single sign-on URL Start URL
Identity provider single sign-on URL SSO URL
note
Google Workspace displays a SHA256 fingerprint. To retrieve the SHA1 fingerprint required by GitLab for configuring SAML, download the certificate and calculate the SHA1 certificate fingerprint.

The recommended attributes and claims settings are:

  • Primary email set to email.
  • First name set to first_name.
  • Last name set to last_name.

For NameID, the following settings are recommended:

  • Name ID format is set to EMAIL.
  • NameID set to Basic Information > Primary email.

When selecting Verify SAML Configuration on the GitLab SAML SSO page, disregard the warning recommending setting the NameID format to “persistent”.

See the troubleshooting page for an example configuration.

Okta setup notes

Please follow the Okta documentation on setting up a SAML application in Okta with the notes below for consideration.

For a demo of the Okta SAML setup including SCIM, see Demo: Okta Group SAML & SCIM setup.

GitLab Setting Okta Field
Identifier Audience URI
Assertion consumer service URL Single sign-on URL
GitLab single sign-on URL Login page URL (under Application Login Page settings)
Identity provider single sign-on URL Identity Provider Single Sign-On URL

Under Okta’s Single sign-on URL field, check the option Use this for Recipient URL and Destination URL.

For NameID, the following settings are recommended; for SCIM, the following settings are required:

  • Application username (NameID) set to Custom user.getInternalProperty("id").
  • Name ID Format set to Persistent.

OneLogin setup notes

OneLogin supports their own GitLab (SaaS) application.

If you decide to use the OneLogin generic SAML Test Connector (Advanced), we recommend the “Use the OneLogin SAML Test Connector” documentation with the following settings:

GitLab Setting OneLogin Field
Identifier Audience
Assertion consumer service URL Recipient
Assertion consumer service URL ACS (Consumer) URL
Assertion consumer service URL (escaped version) ACS (Consumer) URL Validator
GitLab single sign-on URL Login URL
Identity provider single sign-on URL SAML 2.0 Endpoint

Recommended NameID value: OneLogin ID.

Change the SAML app

To change the SAML app used for sign in:

  • If the NameID is not identical in both the existing and new SAML apps, users must: