Single Sign On (SSO)

GitKraken offers a Single Sign On (SSO) option as an easy way to sign in to your account. This is only for use with the cloud versions of GitKraken, it is not available for the serverless options.

Once your organization has set up SSO with an Identity Provider (IdP), the Owner or an Admin on your GitKraken organization can link your organization to that identity provider. Then, any users associated with your IdP can login to GitKraken apps and services. 🎉

What is Single Sign On (SSO)?

The Wikipedia definition of SSO:

“Single sign-on is an authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems. True single sign-on allows the user to log in once and access services without re-entering authentication factors.”

The above diagram depicts what a typical SSO setup entails. Here is some relevant terminology:

Directory Server: A Directory Server is an application that stores information about the “objects” that belong to an organization. An object is typically something like: printers, computers, shared folders, users, or groups. Some objects can contain other objects which then allows them to reflect hierarchical structures.

Examples of Directory Server applications are:

• Microsoft Active Directory
• Oracle Identity Governance (OIG) Suite
• Jump Cloud

Identity Provider: An identity provider (abbreviated IdP or IDP) is a system entity that creates, maintains, and manages identity information as well as provides authentication services to relying applications within a distributed network. An IdP provider stores 3 main components: Users, Groups, and Applications.

Examples of Identity Provider applications are:

• Azure Active Directory
• Okta
• Google Identity Platform

The Identity Providers provide services that allow third party applications to authenticate their users. The authentication mechanism they provide is called “Oauth”, which allows third party applications to authenticate users without accessing/storing their password.

Third party applications: These are the applications that use IdP services to authenticate users. The end user is redirected to the IdP to instead login there. Then the Idp directs back to the 3rd party app to complete the login, confirming that the user is who they claim to be.

Examples of third party apps:

• GitKraken
• Slack
• Jira

---

SSO in GitKraken

GitKraken is a 3rd party application in this scenario. You (or an Owner/Admin) setup which IdP(s) you want to use and we will use them to log them in. If your organization has already set up SSO with an IdP and in GitKraken, simply sign in and you are all set!

If you need to set up SSO for your GitKraken Organization see Setting up SSO on a GitKraken Organization

Supported Identity Providers

GitKraken may initiate an Oauth authentication flow with the following supported Identity Providers (IdPs):

• Azure Active Directory
• Okta
• Google Identity Platform (G Suite)
• Ping Identity

While we do not assist in setting up the identity provider, the example IdP setup section gives step-by-step instructions for what this typically looks like.

License Requirements

Single Sign On is available as part of the teams and enterprise plans.

Setting up SSO on a GitKraken Organization

First, some quick notes:

• SSO is set up at the Organization level. Each organization can have 0,1, or many identity providers connected simultaneously.
• SSO can only be set up by the Owner or by an Admin of the organization.

How to set up SSO:

1. Login and navigate to the organization you want to enable SSO for.

2. On the left menu click on SSO.

3. Click the Enable SSO checkbox and you will be presented with some additional fields:

Organization Domain Name: The domain that is used for everyone who wants to use SSO to login. Each user must have a matching domain in their email address and each user must be defined in the IdP.

There is only one domain allowed per GitKraken organization, and it must be unique. If your domain is already in use you can contact support for help.

JIT, Enable Just In Time Provisioning: This allows users in this domain to login with their email and be automatically provisioned a license. In order for a user to be automatically given a license:

• Just in time provisioning must be enabled (JIT option checked)☑.
• The user email must be part of the SSO domain on the IdP.
• There must be an available license on the GitKraken Organization.

When a user logs in for the first time using SSO, and all three of the above conditions are met, they will be automatically given a GitKraken license.

4. Click on Save changes to store the SSO configuration. Once this is completed you will see the Configure SSO Connection button appear.

5. Click the Configure SSO Connection button to set up the connection between your GitKraken Organization and the Identity Provider. You will now be able to configure the connection using Metadata.

Add SSO Connection using Metadata

Click on Add Using Metadata and you will see the following fields:

• Identity Provider: choose a supported provider from the drop-down.
• IdP Metadata URL /IdP Metadata: depending on the IdP we can use one or both of these options for setting up the SSO connection.
• Don’t enable this connection immediately ✅ by default new connections are automatically enabled. This checkbox will create the connection but users will not be able to login using SSO with this IdP until it is enabled.

Example 1: setting up Okta

Okta is configured using a metadata file.

1. Access your Okta instance.
2. Navigate to the Application that you want to use. See our Okta example for an example of how to make one.
3. Click on “Sign on” and scroll down to SAML Signing Certificates:

4. Notice that there is just one Active. Click on Actions for the active certificate.

5. Click on Download certificate and you will be prompted with an xml file.
6. Copy this file content and paste it into the IdP metadata field in the SSO Create Connection form.
7. Click on Create Connection. Optionally, you can check “Don’t enable this connection immediately” to not automatically enable this connection and prevent users from using it.

Example 2: setting up Azure Active Directory

Azure is configured using a metadata URL.

1. Access to your Azure account, and go to Active Directory -> Enterprise Applications.

2. Navigate to the application that you want to use. See our Azure Active Directory example for an example of how to make one.
3. On the left menu select Single Sign-on.
4. Scroll down to the section: SAML Signing Certificate.

5. Copy the App Federation Metadata Url.
6. Paste this URL into the Idp metadata URL field in SSO Create Connection:

7. Click on Create Connection. Optionally, you can check “Don’t enable this connection immediately” and choose to later enable it.

Logging in using SSO

When logging into GitKraken Client, GitLens, account.gitkraken.com , or anywhere else to access your GitKraken account, you will see the Sign In with SSO option.

After clicking Sign in with SSO, the SSO form will open and ask for an email address to use for SSO login. Enter your email address and GitKraken will determine which SSO option(s) are available and present them to you. Click an option and you will be sent to the IdP login page to complete the process.

Example Identity Provider (IdP) setup instructions

G Suite

How to Create SAML Application in G Suite:

1. Go to https://admin.google.com/

2. Click on Apps and then Web and mobile apps.

3. Click on Add app.

4. Click Add custom SAML app.

5. Type in your app name (such as GitKraken SSO).

6. Copy your SSO URL and Certificate.

7. Enter the callback URL https://api.gitkraken.com/oauth/sso/callback for ACS URL and Entity ID.

8. Add desired attributes and click on Finish.

9. Click on TEST SAML LOGIN.

10. Click on ALLOW ACCESS.

11. Select ON for everyone and save.

Now you are all set to setup your SSO on a GitKraken Organization

Azure Active Directory

How to create SAML application in Azure Active Directory:

1. In a browser, go to Azure login portal.
2. Enter your azure credentials and login.
3. Go to Azure Active Directory from search bar.
4. In the left menu click on Enterprise applications.

5. Click on New application from the top of the page.

6. Select Create your own application.

7. Give your application name (such as “GitKraken SSO”) and select “Integrate any other application you don’t find in the gallery (Non-gallery)”.

8. Select Single sign-on from the left sidebar and then choose SAML.

9. Click the edit icon in the top right corner to configure SAML.

10. Input the Entity ID URI and Reply URL. Both of these should direct to https://api.gitkraken.com/oauth/sso/callback for GitKraken SSO.

Now you are all set to setup your SSO on a GitKraken Organization

Okta

How to Create SAML Application in Okta:

1. In a browser go to the Okta login page.
2. Enter your Okta credentials and login.
3. Go to admin dashboard and select Applications in navigation bar.

4. Click on Add Application.
5. Select Create New App.

6. Select SAML 2.0 as a Sign on Method and click to next button.

7. Enter a name of application (such as “GitKraken SSO”).

8. Configure SAML Integration. The Single sign on URL and Audience URI fields should direct to https://api.gitkraken.com/oauth/sso/callback.

Step 9: Scroll down to the attribute statement and fill in the optional fields.

Step 10: Select “I am an Okta customer adding an internal app” from option menu and then click to finish.

Now you are all set to setup your SSO on a GitKraken Organization

Ping Identity

How to Create SAML Application in Ping Identity

1. Go to https://www.pingidentity.com/en/account/sign-on.html

2. Create an account or sign in your existing one.

3. Go to the home page and click on Add Environment.

4. Select the appropriate solution based on your need (in this guide, we use Customer solution) and click Next.

5. Select PingOne SSO, then click Next.

6. Type in your environment name (in TRIAL ENVIRONMENT NAME), then click Finish. Now your environment is created. Go ahead and click on it.

7. Select Identities to add some users. Once you are done adding them click on Groups, and then click on the plus button to add a group. (Make sure to add users with their email addresses).

8. Select Groups, then click on the plus button to add a group. Once you have that, you can add the users to your group.

9. Select Connections.

10. Click on the plus button.

11. Enter a name for your application, then select SAML Application. Next click on the Configure button which appears once you select your application type.

12. Select Manually Enter. Type in the URL for ACS URLs and Entity ID, then click on Save.
    (URL: https://api.gitkraken.com/oauth/sso/callback))

13. Click on the toggle button so the users would have access to your application.

14. Click on Attributes then add email as your new attribute.

15. Time to add the group we created in Step 8.

16. Select the pencil icon pictured below.

17. Click on the plus icon to add the group, then click on Save.

18. Go to the Configuration tab to copy your IDP Metadata URL and download your metadata (Download Metadata button).

19. On app.gitkraken.com, go to your organization and click on SSO then click on Enable SSO. Type in your domain in Organization Domain Name with .com . Then click on Configure SSO Connection.

20. Click on Add Using Metadata and type in a Connection name and from the Identity Provider select Ping Identity. Then use the IDP Metadata URL and Metadata from step 18 for IdP Metadata URL and IdP Metadata. Click on Create Connection

21. Now the users who were added in step 7 can Sign in with SSO.