TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

SAML Single Sign-On (SSO) Integration

15 posts · Jul 2014 – May 2026

What this trail covers

GitLab continues to enhance its authentication and authorization capabilities, with a significant focus on integrating with enterprise identity management systems. This includes the ongoing development and refinement of SAML (Security Assertion Markup Language) support for Single Sign-On (SSO), and the integration with SCIM for automated user provisioning and deprovisioning. This post details the practical implementation of SAML and SCIM with Google Workspace, providing step-by-step guidance on configuring group synchronization for automatic role mapping.

All GitLab trails
  1. A leaked personal access token shouldn't expose every project its owner can reach. Fine-grained PATs scope each token’s permissions to the job.Introduced fine-grained Personal Access Tokens (PATs) as a beta feature. These tokens allow for scoping permissions to specific projects/groups and individual resource actions (Create, Read, Update, Delete) for resources like Issues, Merge Requests, Pipelines, Repositories, and Container Registry. This enhances security by implementing the principle of least privilege, reducing the impact of token leaks. The tokens table has been updated to display these granular scopes for auditing. Future roadmap includes expanding coverage to remaining REST API endpoints and adding GraphQL support.
  2. Passkeys now available for passwordless sign-in and 2FA on GitLabIntroduced Passkeys as a new authentication method, enabling passwordless sign-in and phishing-resistant two-factor authentication (2FA). Passkeys leverage WebAuthn technology and public-key cryptography, storing private keys on user devices and public keys on GitLab. They support device biometrics (fingerprint, face recognition, PIN) and are compatible with desktop browsers, mobile devices, and FIDO2 hardware security keys.
  3. How to set up GitLab SAML SSO with Google WorkspaceThis post details the practical implementation of SAML SSO with Google Workspace for GitLab.com, focusing on configuring group synchronization for automatic role mapping. It outlines the steps for obtaining GitLab SAML configuration values (Assertion consumer service URL, Identifier, GitLab SSO URL), configuring a custom SAML app in Google Workspace, mapping user attributes and group memberships (critical 'groups' attribute), enabling the application for users, and converting the Google identity provider certificate to a SHA-1 fingerprint format for GitLab configuration. It also covers recommended security settings like enforcing SAML for web and Git activity.
  4. Strengthening GitLab.com security: Mandatory MFAThis post details the implementation of mandatory multi-factor authentication (MFA) for all GitLab.com users and API endpoints authenticating with a username and password. It outlines the phased rollout strategy, user impact, and required actions, including proactive setup of MFA methods and migration to Personal Access Tokens (PATs) for API authentication. This enhances the existing authentication and authorization capabilities by adding a critical security layer against account takeover threats.
  5. Automating role-based access control (RBAC) at scaleThis post details a hands-on implementation example of GitLab + Keycloak + OIDC for automating role-based access control (RBAC) at scale. It covers setting up a local Docker environment with specific GitLab and Keycloak versions, generating self-signed SSL certificates for secure communication, and configuring GitLab's OIDC integration with Keycloak. The post outlines the Keycloak realm configuration, including a pre-configured GitLab client and default client secret, and explains how to map realm roles to GitLab roles and create a group structure with role mapping. It demonstrates a user journey from Keycloak to GitLab, showcasing automated user provisioning, least-privilege policy enforcement through role mapping and group hierarchy, and access governance across multiple teams. The post emphasizes the benefits of GitLab's comprehensive DevSecOps platform for secure, scalable access management, including native OIDC support, granular role enforcement, and flexible group hierarchy.
  7. Improving OAuth ROPC security on GitLab.comGitLab.com will require client authentication for OAuth Resource Owner Password Credentials (ROPC) starting April 8, 2025. This change mandates the inclusion of `client_id` and `client_secret` in ROPC requests to enhance security, ensure standards compliance, and improve auditing. Existing integrations without client credentials will be disrupted. Users are instructed to register applications to obtain credentials and update their authentication requests.
  8. How-to: GitLab Single Sign-on with SAML, SCIM, and Azure’s Entra IDThis post details the practical implementation of SAML and SCIM integration between GitLab and Azure Entra ID. It provides step-by-step guidance on creating an application in Entra ID, configuring SAML SSO parameters by copying values between Entra ID and GitLab's SAML settings, and mapping attributes and claims. Specific instructions are given for modifying the Name ID to `user.objectid` and configuring additional claims like `emailaddress` to `user.otheremail`. The post also covers assigning users to the Entra ID application and configuring their contact information to match their GitLab.com email addresses. Finally, it outlines the necessary steps to configure GitLab with the Identity provider single sign-on URL and Certificate fingerprint from Entra ID, and discusses the importance of setting a default membership role for SAML users.
  9. Why GitLab access tokens now have lifetime limitsThis post details the implementation of lifetime limits for personal, group, and project access tokens in GitLab. It explains the security rationale behind this change, which is to mitigate risks associated with long-lived, static credentials. The post outlines the enforcement of expiration dates for new tokens (within 365 days) and the automatic assignment of a one-year expiration to previously non-expiring tokens. It also discusses the impact on automation, the introduction of a token rotation API with automatic reuse detection, and the recommendation of service accounts for automation use cases. The post also mentions the ability for administrators to set custom allowable expiration limits in Ultimate tiers.
  10. Unmasking password attacks at GitLabThis post details the identification and mitigation of increased password attacks against the OAuth API endpoint on GitLab.com, highlighting the use of automated attacks targeting simple usernames. GitLab is increasing security measures, monitoring activities, and recommending user-level precautions such as enabling two-factor authentication, enforcing it at the group level, using IP address restrictions for group access, and implementing Git Abuse Rate Limiting. The post also advises on general security hygiene like using strong, unique passwords and being vigilant against phishing.
  11. How GitLab supports NSA and CISA CI/CD security guidanceThis post details how GitLab's SAML SSO and SCIM integrations support NSA/CISA guidance on minimizing long-term credentials and implementing least privilege policies for CI/CD access, by centralizing authentication and authorization responsibilities and automating user identity lifecycles.
  12. GitLab account security: Verify your information for enhanced protectionIntroduced a new security measure for non-2FA users requiring email verification during login for high-risk attempts to mitigate credential stuffing attacks. This involves prompting users to enter a code sent to their email. A one-time option to update their email address is provided during this verification process.
  13. Self-managed support extended to GitLab for Jira AppThis post introduces official support for integrating the GitLab for Jira app with GitLab Self-Managed instances. It details the configuration steps, including setting up an Instance OAuth App in GitLab and linking namespaces. It also clarifies the deprecation of Jira Cloud support for the DVCS integration, recommending the GitLab for Jira app as the preferred method for both Jira Cloud and Jira Server/Data Center integrations. Options for installing the app (Marketplace, manifest file) are provided.
  14. How we boosted WebAuthn adoption from 20 percent to 93 percent in two daysThis post details the technical and operational aspects of mandating WebAuthn/FIDO2 devices for company-wide MFA within a two-day timeframe. It covers the rationale for choosing WebAuthn over other MFA methods (TOTP, push notifications) due to its phishing resistance and public key cryptography. The implementation details include leveraging built-in Touch ID on Macs, facilitating YubiKeys for Linux users and those preferring them, and crucially, the discovery and utilization of QR code scanning for self-service enrollment of new devices. The communication strategy and the use of a Slack bot to drive adoption are also described.
  15. How GitLab protects your IPThis post details how GitLab's user access controls, including roles (Guest, Auditor, Developer, Reporter, Maintainer, Owner), protected branches, protected tags, push rules, merge request approvals (including security criteria and DevSecOps integration), and code owners, work together to protect intellectual property stored in repositories. It also covers audit events for tracing access and changes, and provides an example of managing permissions as code.
  16. How we are iterating on Group Single Sign On for GitLab.comThis post details the initial MVC launch of SAML-based SSO for groups on GitLab.com, acknowledging its limitations and the need for further iteration. It highlights the prioritization of enterprise features like SSO for GitLab.com, the challenges faced by the Manage team due to security issues and broad scope, and the organizational growth plans to address these. The post also mentions the launch of the HackerOne Bug Bounty Program to improve security velocity.
  17. Support for Universal 2nd Factor AuthenticationThis post introduces support for Universal 2nd Factor (U2F) authentication using hardware security keys like YubiKey. It details how U2F leverages public key cryptography to prevent phishing and enhance account security. The post also mentions that GitLab has supported two-factor authentication since version 7.11 and directs users to documentation for enabling U2F.
  18. Feature Highlight: SAML and its future within GitLabThis post details the revival and enhancement of the `omniauth-saml` gem, including the addition of Custom Attributes for better integration flexibility. It also outlines future plans to leverage SAML 2.0 for managing GitLab Group Memberships directly from the Identity Provider, similar to existing LDAP functionality, by using `ruby-saml` directly.
  19. Feature Highlight: LDAP IntegrationThis post introduces LDAP group synchronization as a feature for GitLab Enterprise Edition. It details how to configure the synchronization between GitLab groups and LDAP groups, enabling automatic membership management based on LDAP group membership. It also covers potential pitfalls like locking oneself out of a group and explains how nested ActiveDirectory groups are handled.