Commit eddd12d4 authored by Marcin Sedlak-Jakubowski's avatar Marcin Sedlak-Jakubowski

Merge branch 'alanrich-master-patch-18047' into 'master'

Edit navigation steps in SAML SSO docs

See merge request gitlab-org/gitlab!73899
parents 0cbbfe7c eb672864
...@@ -35,9 +35,10 @@ The following identity providers are supported: ...@@ -35,9 +35,10 @@ The following identity providers are supported:
Once [Group Single Sign-On](index.md) has been configured, we can: Once [Group Single Sign-On](index.md) has been configured, we can:
1. Navigate to the group and click **Administration > SAML SSO**. 1. On the top bar, select **Menu > Groups** and find your group.
1. Click on the **Generate a SCIM token** button. 1. On the left sidebar, select **Settings > SAML SSO**.
1. Save the token and URL so they can be used in the next step. 1. Select **Generate a SCIM token**.
1. Save the token and URL for use in the next step.
![SCIM token configuration](img/scim_token_v13_3.png) ![SCIM token configuration](img/scim_token_v13_3.png)
...@@ -50,14 +51,14 @@ Once [Group Single Sign-On](index.md) has been configured, we can: ...@@ -50,14 +51,14 @@ Once [Group Single Sign-On](index.md) has been configured, we can:
The SAML application that was created during [Single sign-on](index.md) setup for [Azure](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/view-applications-portal) now needs to be set up for SCIM. The SAML application that was created during [Single sign-on](index.md) setup for [Azure](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/view-applications-portal) now needs to be set up for SCIM.
1. Set up automatic provisioning and administrative credentials by following the 1. Enable automatic provisioning and administrative credentials by following the
[Azure's SCIM setup documentation](https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups#provisioning-users-and-groups-to-applications-that-support-scim). [Azure's SCIM setup documentation](https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups#provisioning-users-and-groups-to-applications-that-support-scim).
During this configuration, note the following: During this configuration, note the following:
- The `Tenant URL` and `secret token` are the ones retrieved in the - The `Tenant URL` and `secret token` are the items retrieved in the
[previous step](#gitlab-configuration). [previous step](#gitlab-configuration).
- It is recommended to set a notification email and check the **Send an email notification when a failure occurs** checkbox. - We recommend setting a notification email and selecting the **Send an email notification when a failure occurs** checkbox.
- For mappings, we only leave `Synchronize Azure Active Directory Users to AppName` enabled. - For mappings, we only leave `Synchronize Azure Active Directory Users to AppName` enabled.
`Synchronize Azure Active Directory Groups to AppName` is usually disabled. However, this `Synchronize Azure Active Directory Groups to AppName` is usually disabled. However, this
does not mean Azure AD users cannot be provisioned in groups. Leaving it enabled does not break does not mean Azure AD users cannot be provisioned in groups. Leaving it enabled does not break
...@@ -113,29 +114,27 @@ Make sure that the Okta setup matches our documentation exactly, especially the ...@@ -113,29 +114,27 @@ Make sure that the Okta setup matches our documentation exactly, especially the
configuration. Otherwise, the Okta SCIM app may not work properly. configuration. Otherwise, the Okta SCIM app may not work properly.
1. Sign in to Okta. 1. Sign in to Okta.
1. If you see an **Admin** button in the top right, click the button. This will 1. Ensure you are in the Admin section by selecting the **Admin** button located in the top right. The admin button is not visible from the admin page.
ensure you are in the Admin area.
NOTE: NOTE:
If you're using the Developer Console, click **Developer Console** in the top If you're using the Developer Console, select **Developer Console** in the top
bar and select **Classic UI**. Otherwise, you may not see the buttons described bar and then select **Classic UI**. Otherwise, you may not see the buttons described in the following steps:
in the following steps:
1. In the **Application** tab, click **Add Application**. 1. In the **Application** tab, select **Add Application**.
1. Search for **GitLab**, find and click on the 'GitLab' application. 1. Search for **GitLab**, find and select on the 'GitLab' application.
1. On the GitLab application overview page, click **Add**. 1. On the GitLab application overview page, select **Add**.
1. Under **Application Visibility** select both checkboxes. Currently the GitLab application does not support SAML authentication so the icon should not be shown to users. 1. Under **Application Visibility** select both checkboxes. Currently the GitLab application does not support SAML authentication so the icon should not be shown to users.
1. Click **Done** to finish adding the application. 1. Select **Done** to finish adding the application.
1. In the **Provisioning** tab, click **Configure API integration**. 1. In the **Provisioning** tab, select **Configure API integration**.
1. Select **Enable API integration**. 1. Select **Enable API integration**.
- For **Base URL** enter the URL obtained from the GitLab SCIM configuration page - For **Base URL** enter the URL obtained from the GitLab SCIM configuration page
- For **API Token** enter the SCIM token obtained from the GitLab SCIM configuration page - For **API Token** enter the SCIM token obtained from the GitLab SCIM configuration page
1. Click 'Test API Credentials' to verify configuration. 1. Select 'Test API Credentials' to verify configuration.
1. Click **Save** to apply the settings. 1. Select **Save** to apply the settings.
1. After saving the API integration details, new settings tabs appear on the left. Choose **To App**. 1. After saving the API integration details, new settings tabs appear on the left. Select **To App**.
1. Click **Edit**. 1. Select **Edit**.
1. Check the box to **Enable** for both **Create Users** and **Deactivate Users**. 1. Select the **Enable** checkbox for both **Create Users** and **Deactivate Users**.
1. Click **Save**. 1. Select **Save**.
1. Assign users in the **Assignments** tab. Assigned users are created and 1. Assign users in the **Assignments** tab. Assigned users are created and
managed in your GitLab group. managed in your GitLab group.
...@@ -147,8 +146,8 @@ application described above. ...@@ -147,8 +146,8 @@ application described above.
### OneLogin ### OneLogin
OneLogin provides a "GitLab (SaaS)" app in their catalog, which includes a SCIM integration. As the developers of this app, OneLogin provides a "GitLab (SaaS)" app in their catalog, which includes a SCIM integration.
As the app is developed by OneLogin, please reach out to OneLogin if you encounter issues. Please reach out to OneLogin if you encounter issues.
## User access and linking setup ## User access and linking setup
...@@ -177,8 +176,8 @@ As long as [Group SAML](index.md) has been configured, existing GitLab.com users ...@@ -177,8 +176,8 @@ As long as [Group SAML](index.md) has been configured, existing GitLab.com users
- By following these steps: - By following these steps:
1. Sign in to GitLab.com if needed. 1. Sign in to GitLab.com if needed.
1. Click on the GitLab app in the identity provider's dashboard or visit the **GitLab single sign-on URL**. 1. In the identity provider's dashboard select the GitLab app or visit the **GitLab single sign-on URL**.
1. Click on the **Authorize** button. 1. Select the **Authorize**.
We recommend users do this prior to turning on sync, because while synchronization is active, there may be provisioning errors for existing users. We recommend users do this prior to turning on sync, because while synchronization is active, there may be provisioning errors for existing users.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment