SAML single sign-on for GitLab with SSOGEN

• GitLab.com: Premium or Ultimate, and the Owner role on the top-level group. Self-Managed: shell access to the server, and GitLab served over HTTPS.
• An SSOGEN administrator who can save SAML applications (see Add a SAML application in SSOGEN).
• openssl, or another tool that prints a certificate’s SHA-256 fingerprint.

GitLab.com group

1. Open the group, then Settings > SAML SSO. Copy Assertion consumer service URL, Identifier and GitLab single sign-on URL into SSOGEN (step 1).

2. Under Configuration fill in:

   GitLab field	Value
   Identity provider single sign-on URL	https://acme.ssogen.ai/saml/idp/sso
   Certificate fingerprint	The SHA-256 fingerprint from step 1
   Default membership role	The role new members get, for example Guest

3. Select Enable SAML authentication for this group. Leave the three enforcement boxes clear for the first test. Select Save changes.

4. Select Verify SAML Configuration. GitLab sends you through SSOGEN and shows what it received.

5. Link your own account: while signed in to GitLab.com, open the GitLab single sign-on URL and select Authorize.

When members have linked their accounts, select Enforce SSO-only authentication for web activity for this group (and, if wanted, the Git and Dependency Proxy box) and Save changes.

GitLab Self-Managed

1. Add the provider to /etc/gitlab/gitlab.rb:

   gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
   gitlab_rails['omniauth_block_auto_created_users'] = false
   gitlab_rails['omniauth_providers'] = [
     {
       name: "saml",
       label: "SSOGEN",
       args: {
         assertion_consumer_service_url: "https://gitlab.acme.example/users/auth/saml/callback",
         idp_cert_fingerprint: "<SHA-256 fingerprint from step 1>",
         idp_sso_target_url: "https://acme.ssogen.ai/saml/idp/sso",
         issuer: "https://gitlab.acme.example",
         name_identifier_format: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
       }
     }
   ]

2. Run sudo gitlab-ctl reconfigure.

3. The sign-in page now shows an SSOGEN button below the regular form.

To link a SAML sign-in to an existing GitLab user with the same primary email, add gitlab_rails['omniauth_auto_link_saml_user'] = true. To send every sign-in straight to SSOGEN, add gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'; local sign-in then stays reachable at https://gitlab.acme.example/users/sign_in?auto_sign_in=false.