Okta

You can configure SSO using either the GitGuardian app from the Okta Integration Network (recommended) or a custom SAML app.

Prerequisites

• An Okta account with administrator privileges
• A GitGuardian workspace with Owner or Manager role
• Your GitGuardian Workspace ID (found in your dashboard URL or workspace settings)

Supported features

• SP-initiated SSO: Users can sign in to GitGuardian directly from the application URL
• IdP-initiated SSO: Users can sign in to GitGuardian from the Okta dashboard
• Just-in-Time (JIT) provisioning: New users are automatically created in GitGuardian on first login

tip

GitGuardian also supports SCIM provisioning for Okta. See the SCIM configuration guide for setup instructions.

SP-initiated SSO

Users can sign in directly to GitGuardian without going through Okta first:

1. Navigate to your GitGuardian dashboard URL (e.g., https://dashboard.gitguardian.com).
2. Enter your email address.
3. If your email domain is reserved, you will be automatically redirected to Okta for authentication.
4. After authenticating with Okta, you will be redirected back to GitGuardian.

Okta OIN app

The GitGuardian app is available in the Okta Integration Network.

1. In Okta, go to Applications > Applications and click Browse App Catalog.

2. Search for "GitGuardian" and select the GitGuardian app.

3. Click Add Integration.

4. On the General Settings page, configure the following:

   • Application label: Enter a name for the app (e.g., "GitGuardian").
   • GitGuardian Workspace ID: Enter your GitGuardian workspace ID.
   • GitGuardian API FQDN: Enter api.gitguardian.com or api.eu1.gitguardian.com (or your self-hosted API domain).
   • GitGuardian Dashboard FQDN: Enter dashboard.gitguardian.com or dashboard.eu1.gitguardian.com (or your self-hosted dashboard domain).

   

5. Click Done to create the application.

6. Go to the Sign On tab to view the SAML configuration.

7. Scroll down to find the SAML metadata and copy the following values:

   • Sign on URL
   • Issuer
   • Signing Certificate (download or copy)

   

8. In your GitGuardian dashboard, navigate to Settings > Authentication and click Configure.

   

9. Configure the Identity Provider with the values from the previous step:

   • Entity Id: paste the Issuer value
   • Single Sign-On URL: paste the Sign on URL value
   • X509 Cert: paste the Signing Certificate content
   • Ensure that the checkbox I have mapped the attributes first_name and last_name in my IdP is checked

   

10. Assign users to the app in the Assignments tab.

11. Important: Reserve your email domain to enable automatic SSO discovery.

Okta custom SAML app

If you prefer to create a custom SAML application, follow these steps:

1. First, go to https://$YOUR_OKTA_DOMAIN-admin.okta.com/admin/apps/add-app, then click on "Create New App".
2. You will land on this page, where you can set the general information for your SAML app that users will see when logging in.
3. Click "Next". You can now configure basic settings:
   • Single sign on URL field is filled with the ACS URL value on GitGuardian dashboard.
   • Audience URI (SP Entity ID) field is filled with the SP Entity ID value on GitGuardian dashboard.
   • Default RelayState is left blank
   • Name ID format must be set to EmailAddress
4. Click on "Show Advanced Settings". Here make sure that both Response and Assertion Signature are signed, and that Signature and Digest Algorithm are respectively set to RSA-SHA256 and SHA256. Assertions are not encrypted.
5. Now, some straightforward mapping needs to done:
   • first_name is mapped the user first name
   • last_name is mapped the user last name
6. Finish your app configuration.
7. Finally, we need to configure the Identity Provider in GitGuardian dashboard. First, click on "View Setup Instructions", then use these values:
   • Entity Id field is filled with the Identity Provider Issuer
   • Single Sign-On URL field is filled with the Identity Provider Single Sign-On URL
   • X509 Cert field is filled with the X.509 Certificate
   • Ensure that the checkbox I have mapped the attributes first_name and last_name in my IdP is checked
8. Important: Don't forget to reserve your email domain to enable automatic SSO discovery.