SAML Single Sign-On (SSO) Integration

5/7/2026

Introduced fine-grained Personal Access Tokens (PATs) as a beta feature. These tokens allow for scoping permissions to specific projects/groups and individual resource actions (Create, Read, Update, Delete) for resources like Issues, Merge Requests, Pipelines, Repositories, and Container Registry. This enhances security by implementing the principle of least privilege, reducing the impact of token leaks. The tokens table has been updated to display these granular scopes for auditing. Future roadmap includes expanding coverage to remaining REST API endpoints and adding GraphQL support.

2/25/2026

Introduced Passkeys as a new authentication method, enabling passwordless sign-in and phishing-resistant two-factor authentication (2FA). Passkeys leverage WebAuthn technology and public-key cryptography, storing private keys on user devices and public keys on GitLab. They support device biometrics (fingerprint, face recognition, PIN) and are compatible with desktop browsers, mobile devices, and FIDO2 hardware security keys.

1/9/2026

This post details the implementation of mandatory multi-factor authentication (MFA) for all GitLab.com users and API endpoints authenticating with a username and password. It outlines the phased rollout strategy, user impact, and required actions, including proactive setup of MFA methods and migration to Personal Access Tokens (PATs) for API authentication. This enhances the existing authentication and authorization capabilities by adding a critical security layer against account takeover threats.

4/1/2025

This post details the upcoming requirement for client authentication in OAuth ROPC on GitLab.com, effective April 8, 2025. It explains that existing ROPC integrations without client credentials will face service disruption and provides instructions on how to register applications to obtain client credentials (client_id and client_secret) and update authentication requests accordingly. The post highlights the security benefits of client authentication, including enhanced security, standards compliance, and improved auditing.

1/23/2025

This post provides a detailed, step-by-step guide for integrating GitLab with Azure's Entra ID using SAML and SCIM for single sign-on. It covers the creation of the application in Entra ID, configuration of SAML parameters (Identifier, Reply URL, Sign on URL), modification of attributes and claims (including Name ID and email mapping), user assignment within Entra ID, and the corresponding configuration within GitLab's SAML SSO settings. It also touches upon setting default membership roles and testing the integration.

10/25/2023

This post details the implementation of lifetime limits for personal, group, and project access tokens in GitLab. It explains the security rationale behind this change, which is to mitigate risks associated with long-lived, static credentials. The post outlines the enforcement of expiration dates for new tokens (within 365 days) and the automatic assignment of a one-year expiration to previously non-expiring tokens. It also discusses the impact on automation, the introduction of a token rotation API with automatic reuse detection, and the recommendation of service accounts for automation use cases. The post also mentions the ability for administrators to set custom allowable expiration limits in Ultimate tiers.

9/28/2023

This post details the identification and mitigation of increased password attacks against the OAuth API endpoint on GitLab.com, highlighting the use of automated attacks targeting simple usernames. GitLab is increasing security measures, monitoring activities, and recommending user-level precautions such as enabling two-factor authentication, enforcing it at the group level, using IP address restrictions for group access, and implementing Git Abuse Rate Limiting. The post also advises on general security hygiene like using strong, unique passwords and being vigilant against phishing.

9/19/2023

This post details how GitLab's SAML SSO and SCIM integrations support NSA/CISA guidance on minimizing long-term credentials and implementing least privilege policies for CI/CD access, by centralizing authentication and authorization responsibilities and automating user identity lifecycles.

8/8/2023

Introduced a new security measure for non-2FA users requiring email verification during login for high-risk attempts to mitigate credential stuffing attacks. This involves prompting users to enter a code sent to their email. A one-time option to update their email address is provided during this verification process.

11/9/2022

This post details the technical and operational aspects of mandating WebAuthn/FIDO2 devices for company-wide MFA within a two-day timeframe. It covers the rationale for choosing WebAuthn over other MFA methods (TOTP, push notifications) due to its phishing resistance and public key cryptography. The implementation details include leveraging built-in Touch ID on Macs, facilitating YubiKeys for Linux users and those preferring them, and crucially, the discovery and utilization of QR code scanning for self-service enrollment of new devices. The communication strategy and the use of a Slack bot to drive adoption are also described.

8/7/2020

This post details how GitLab's user access controls, including roles (Guest, Auditor, Developer, Reporter, Maintainer, Owner), protected branches, protected tags, push rules, merge request approvals (including security criteria and DevSecOps integration), and code owners, work together to protect intellectual property stored in repositories. It also covers audit events for tracing access and changes, and provides an example of managing permissions as code.

1/17/2019

This post details the initial Minimum Viable Change (MVC) for SAML-based Single Sign-On (SSO) on GitLab.com, addressing the challenges of a multi-tenant SaaS environment compared to self-managed instances. It highlights the prioritization of enterprise features like SSO for GitLab.com and the ongoing efforts to address security issues and resource constraints within the Manage team. The post also mentions the launch of the HackerOne Bug Bounty Program to improve security issue velocity and the planned restructuring of the Manage team to better meet demand.

6/22/2016

This post introduces support for Universal 2nd Factor (U2F) authentication using hardware security keys like YubiKey. It details how U2F leverages public key cryptography to prevent phishing and enhance account security. The post also mentions that GitLab has supported two-factor authentication since version 7.11 and directs users to documentation for enabling U2F.

3/30/2016

This post details the author's work on improving GitLab's SAML integration. It covers the revival and enhancement of the `omniauth-saml` gem, including adding support for custom attributes and better error handling. It also outlines future plans to leverage SAML 2.0 for managing GitLab Group Memberships directly from the Identity Provider, which will involve using the `ruby-saml` library directly.