To configure Sourcegraph to use SAML authentication, you'll need to do 2 things:
- Add application configuration to your identity provider (e.g., Auth0) describing Sourcegraph.
- Add configuration to Sourcegraph describing your identity provider.
1. Add application configuration to your identity provider
Your identity provider should provide documentation on how to register a new SAML application. Here are links to docs for common identity providers:
- Ping Identity
- Salesforce Identity
- We have vendor-specific instructions for Okta, Azure AD, and Microsoft ADFS
If you do not see your identity provider in the list above or otherwise have trouble with SAML configuration, please reach out to [email protected].
Ensure the following values are set for the application configuration in the identity provider. (Note: the exact names and labels may vary slightly for different identity providers)
- Assertion Consumer Service URL, Recipient URL, Destination URL, Single sign-on URL:
externalURLfrom your site configuration)
- Service Provider (issuer, entity ID, audience URI, metadata URL):
externalURLfrom your site configuration). Some identity providers require you to input these metadata values manually, instead of fetching everything from one URL. In that case, navigate to
https://sourcegraph.example.com/.auth/saml/metadataand transcribe the values in the XML to the identity provider configuration.
- Attribute statements (claims): Sourcegraph requires that an attribute
login(optional): the user's username
displayName(optional): the full name of the user
- Name ID: