GitLab Deep Dives, 7 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SCIM Deep Dive (Support) 2020-12-07

Description

Taking a closer look at the SCIM feature for GitLab.com with focus on how to troubleshoot Support tickets. Presented and facilitated by Cynthia "Arty" Ng, Senior Support Engineer

Ref: https://gitlab.com/gitlab-com/support/support-team-meta/-/issues/2885

A

Hi everyone: this is the skim deep dive. um I am cynthia ing, also known as argitran um senior support engineer in the americas, and today is december. The 7th 2020, if you're, an amer or december, the 8th, if you're in apac, um welcome to the past for those who are back, um uh I wanted to just very quickly note the current version of git lab, which is at the bottom of the slide, which is 13 7 pre.

A

This is a version of gitlab.com which is for skim the most important part, because it's only in dot com right now, I will get to that in just a second. uh So what I'd like to do today is cover um like obviously, what is scale? What are we talking about uh a bit about how it works? It's gonna be a fairly simplified version um of that and I I've included a diagram slightly more complex, but we probably won't get too into weeds to it. um We're going to also talk a bit about like okay.

A

How is that different from saml? What does it mean when you have both configured um we'll go through a little bit of what it means to do configurations in skim and what skin configurations require? I want to talk a little bit about how to troubleshoot common skin issues so to start off. What is skim.

A

Skim is yet another acronym that we all get to learn. um I don't know anyone who actually knows what it stands for offhand. It's kind of like asking someone what a samo stands for.

A

Most people don't actually remember off the top of their heads and that's fine, but it does stand for a system for cross-domain identity management, so it is used for managing users automatically um we'll get into a little bit about how that's a little bit different from some of the similar features that we see for authentication and authorization.

A

But the idea is that the app is set up in an identity provider. So, right now for skim, we have azure octa and one login uh the odd thing about it is that it may or may not be a separate app from the saml app. It depends on the provider so we'll get to that.

A

As well a little bit, uh what we currently support in terms of what it does is creation of new users that don't already exist in gitlab uh when they're added, when the user is added to the skim, app, the skim, identity, creation of existing git lab users and then a removal of users from a group when they're removed from the scan map. So you remove a user from the skim app and then the user should be automatically removed from the group, the next time, the app syncs.

A

So right now it's available on gitlab.com silver plus, which basically means silver and gold. I did include a link in here to self-managed, so those of you who focus or work with self-managed, especially any kind of authorization or authentication tickets.

A

You might want to keep an eye on issue 128 g3, because that's the one where product and dev are tracking implementation of skim in.

A

Self-Managed, so here's a very kind of simplified version of how it works. um So you see that if a user is created, there's a get call and then there's a check whether the user is present. uh This happens in gitlab right, and so, uh if yes, there can be a put or patch. This is kind of weird in the way it's implemented in gitlab, actually because it only applies to azure.

A

I'm actually not sure if this applies to one-on-one, but it doesn't apply to octa, and so uh I'm not gonna get too into the weeds. Actually, don't honestly know all the very specific implementations of why that is in terms of technical implementation.

A

But if you check our docs, that is actually what it says um and then, if the user doesn't exist, then it will create it using a post call. So this is kind of a very simplified version um I've. This is. This is mostly important to kind of know when we get to talking about what to search for in the longs, because in the longs you'll want to know looking at the api logs like okay, what would it get be doing? What would a post be doing? What would a patch be doing so?

A

This is why I wanted to make sure we covered this get patch and post in a kind of simple diagram.

A

I did include a more complex version, which um is based, which I actually took from the azure documentation.

A

um But again I don't. This is oh, yes and then there's the the one that the one thing that the simplified version in the previous slide didn't include as the delete. So all the way at the bottom here number six on this one. It tells you about the delete, so the delete is to remove the user from the group.

A

um So that's the one additional one that that wasn't covered any questions so far. I know I went through that fairly quickly.

A

Of course, if there are any uh questions that you think of the either you want to save your lighter or that you think of later, um please put it in the dock.

A

So what's the difference between sample and skim, this is kind of where I wanted to focus actually, because it can be really confusing for a lot of people, especially since okay. Well, a lot of people are familiar with saml, but how is that different from skim? And what does it do? What does what does it not do in relation to skin so, especially in com on gitlab.com, and the way that it's implemented for groups right now is that saml is used purely for authentication. It's not used for member management. That is what skim is for.

A

So when someone signs in using and say like especially if uh you know sso sign in is enforced, so the gitlab user visits their gitlab.com group, uh if they're not already signed in it, will redirect them to their identity provider so say octa for example, and then, when they sign in to opta, you know, octa will say hey. This is the user's id gitlab will say: hey that matches or not that uses saddle that uses the saml identity.

A

So this is what I mean by it checks the name id against the gitlab silo identity, which we in the api we call extern uid and the git lab users. Api you'll see that the user's identity's extra new id on sign in so when they're signing in octa or whatever identity provider is sending the name id that is matched against a gitlab, extern uid and if it matches gitlab, says, go ahead and we identify you as this gitlab.com user.

A

These identities are created when the user is initially linked to the group, so the first time that the user signs into the group, that's when the saml identity is created, the sample identity is deleted when the user is removed from the group. Now that might be through skim and through auto memory management, but it might also be manually. So if someone like an owner removes the user manually from the group and that user is removed from the group altogether right, then the samo identity gets deleted with it.

A

It doesn't matter how that user is removed from the group. Their xaml identity will be deleted. This also at the moment cannot be edited by owners. It can be edited by admins, so that means gitlab support. Team members do have access to edit and identity, but currently it's not editable by owners in any manner.

A

There is a feature request for this and I can find the link to it, um but- and I will make sure to update the slides with a link to the feature request for that, but it's not there yet now. Skim on the other hand, is not used for authentication. It is used purely for member management.

A

So what happens? Is that it's matching the name id on sync so say: let's you know just use octa again.

A

As an example octa says: hey I have a new user added to my skim, app I'm going to send that information to gitlab git lab says: oh, this user, like just there's no user with this email address gitlab, creates the user and will actually create the skim identity and the sample identity at the same time when creating a new user and tying it to the group when removing the user right so octa says hey, I need to remove this user.

A

Gitlab will say: okay, you're, removing the user that has this id. It will only use the id to match against what which user should be removed and it will remove the user from that group.

A

What's interesting about this is that the identity is created when you link to the group, but when the user is removed from the group, the steam identity isn't deleted, it is deactivated.

A

So there's a field called active and it'll just be false. Instead of true.

A

The scheme identity can also be identi edited through the skim api.

A

Group owners have access to this a skim. They can generate a skim token in their in their settings page and that's what they would use uh as the authentication token for the skin api, so they can edit them now. The docs does say at the top of the page that it's not meant for users to use themselves. It's meant as kind of almost like an internal api for the system to use, but it can be done if, like absolutely required, we just don't recommend it.

A

Any questions on this part before we move on ellen.

B

Hey, I got a quick question. Sorry, what's the practical difference between being deleted um and being deactivated um like uh does it is there like a practical, like you know, like a practical difference between being deactivated.

A

Or deleted yes, actually, um so, first of all to clarify the reason why it's done that way is because of the spec, so the developers are following the the skim specification in the way that they've implemented this. um So I want to clarify that it's not a weird thing that gitlab is doing and the way we've implemented it.

A

This is following the specifications kind of the difference, and- and we can talk about this a little bit more when we get to troubleshooting is what happens if the identity that is being sent like the extra new id or the name id is different from what git lab has right. So if you say okay, my user has this name id in skim and then gitlab says wait.

A

But this user has a different name id then there's a conflict and then, even if the even if octa says, oh, I need or actually sorry, let's use the zor in this case because octa doesn't have the doesn't, have the same update function. But if azure says okay, I need to update this user right. Then, if the name id or the external id doesn't match, then gitlab will say well, your name id doesn't match. I'm not going to do anything with this information.

A

I'm going to let you know that I don't have a matching id and that's it like gitlab will not update that information. um So if it can cause some issues in that way, um and really the only fix for it if, for some reason, someone's name id has changed, is to delete their skin identity.

A

And then they get re-added in one way or another, so yeah I don't know I mean I don't I don't know which way is really better, but I I will say I've been told at least that this is implemented this way, because that's what the spec tells you to do, I I I um the one anything. Actually I wanted to touch on that.

A

I kind of skipped a little bit is the badging so in point two for each one and kind of point out that when someone is connected with saml and has a samo identity, there's badging in the members ui, so in the list of members, if you look at, you know who's a member of your group. If someone has a sample identity for your group, it'll have a sample batch next to it right that user will just it'll just say next to that user. Much like a 2fa.

A

If someone has 2fa enabled it'll, say 2fa, there's no batting for skim. So the the only way to know that a user has a skim identity is to check the logs or to check through rails console.

A

Currently, I know of no way to check through the admin ui or the ui in general,.

A

All right, so when it comes to configuring skim, um I'm gonna say it's: it's not exactly simple. It's it's straightforward! If you follow the docs exactly the the problem comes when um people don't necessarily follow the docs exactly or they don't read the docs or um the docs they're a little. The instructions are quite different depending on the provider, so you have to make sure you're actually looking at the right one as well, and some people sometimes look at one and then not the other. So there's two pages right.

A

So when it comes to sso and gitlab.com for groups, there's the samoan configuration and there's skim configuration.

A

So you you, you kind of have to go through both the way that our docs lay it out. Otherwise, things can kind of go wrong and that's where the second point comes in right. So skim requires the saml app to be configured with the same name id or extern uid or in some cases we call it the user identity, um and that is because we use these uh ids in order to match people against their identity, and this can in actually both azor and opta.

A

um They can be configured to be different, but if you configure it to be different, things will just go wrong.

A

So I would say close to probably easily 80, maybe even 90, plus of the tickets that we get and someone says something has gone wrong uh with the samo or even skim configuration it's because they haven't followed our docs exactly.

A

Because again, there are specific instructions for each provider in azure, there's a minor amount of flexibility, because everything is configured manually, but because everything is configured manually, it's also prone to errors in octa. What's confusing is that currently, the skim app is separate from the saml app and there are a couple of things that you can configure in the sample depending on what you want. But if you don't configure it exactly like how we've written it in the docs, the schemat won't work.

A

So we have had one or two customers who said oh, but we need this field and saml to be whatever they want it to be configured to, and then we say in our docs that it has to be configured to something else in order for skin to work so they're sitting in this position, where they can get saddled to work and they're trying to get skin to work, but it won't work because they're not following their our docs.

A

I did link to um the feature request issue where the developers are working on it. So there's a single app for opta to configure both sample and skim coming soon. So take a look at 216173 if you want to follow along um the last thing. I'll note about skim configuration is that the one login apps exist.

A

To be honest, I haven't gone through it and that's personally because the docs are not in yet both the apps and the docs are being the apps were done, and then the docs are being done actually by one login, so one login is actually contributing the docs to git lab, which is great.

A

We thank the people who are contributing this at one log in to us, but I actually haven't gone through it myself. To be quite honest because we don't have the docs yet, um but I do would like to do it and do a demo or something like that once once we actually get those docs.

A

In so most importantly, troubleshooting- um this, I admit, is I don't know if there's a better way to do this in our docs, but I will say that a lot of our error messages are covered under the sample troubleshooting and again. That's because most people are trying to configure both saml and skim. At the same time, and sometimes they'll say it's a skim issue, but it's actually a saml issue or vice versa.

A

So if you are looking at tickets- and they say they get a specific error message- please check both the saml and the skim troubleshooting section to see whether it's already covered.

A

As I mentioned earlier, the majority of the issues are configuration you can compare links to their screenshot, to example, screenshots that we have the reason why, though, those screenshots are on a separate page, there's warnings everywhere. That says these may or may not be absolutely up to date according to our dogs.

A

um So if, for some reason you find that it's not either update them or create a docs issue to get them updated, um but the the link itself to the screenshot is under the verifying configuration troubleshooting section on the saml page. So again, a lot of people are configuring these, both at the same time so they're linked from the saml troubleshooting they're, actually not linked from the skim troubleshooting um yeah, and then I mentioned before that you can use kibana to search our blogs for the skim api endpoint. It is fairly simple.

A

It is just api scan, slash, v2, slash group, slash the group path, you're, always looking at the parent group, because you're never going to be looking at subgroups for the skim api uh and then just a quick reminder that if it's, if it's throwing a specific error, you can always try to find it in century and file. A bug issue with the full stack trace through sentry, very useful, and then the last that I wanted to mention just kind of more generally.

A

Is that, as I said before, checking the name id in skim requires either the customer to provide us a copy of the api response, or it does require console access right now.

A

So you can see the samo identity in the user administration area or on the group saml settings page, but not the skim external.

A

Id uh the last line, I think I think this is the last slide that I have.

C

A

um Is just an example of what it looks like in kibana, so you can see that I just did an example search for gitlab silver. You can see that this is a get response and then so you can see um what the skim name id is being sent from the identity provider, um and you can see the status is maybe kind of hard to see, but all the way at the bottom it'll it says 200..

A

So this is just a very quick example kind of what it looks like in cabana.

A

uh Yes and then the template slide, of course all right, um so I'm just gonna take a quick look here: the docs. uh If you haven't added yourself to the list of attendees, please do.

A

Okay, I don't know who put this in someone want to identify themselves.

A

You want to vocalize your question.

D

Hi uh in the first part, I just wanted to clarify some uh sample the differences between samoa and stim, so steam is basically able to do what samuel does, but not vice versa.

A

um Okay, I'm gonna go back to I'm gonna reshare and go back to this slide.

A

Okay, so this this tells you the difference, and I I kind of said it earlier, and I want to make it clear that they are two completely separate things. Basically, you configure them together and actually actually really don't you can configure saml in order to configure skim, you have to have saml configured.

A

But not the other way around and they do. They have two different roles. This is also why they have two separate identities, so there's a saml identity and there's a skim identity for each user and actually for each group.

A

So if a user is part of multiple groups that are using saml in the skim, they will have a saml and skim identity for each group and the two have different functions. Saml is used for authentication every time. A user logs in their saml identity is checked against the identity. Provider's.

A

Information, the skim identity is never used for authentication. So this is the interesting thing that sometimes happens is that when someone configures saml and then later configure skim, this actually often happens, or at least this happened. This has happened multiple times. Someone will configure saml and say use their email address as the name id for saml and then when they go to configure skin, they follow our documentation. Our documentation tells you not to use. Email, tells you to use an id of some sort like an internal id.

A

The person can still log in or actually sorry and but then, depending on what they've changed. If they haven't changed the saml name id, then the person can still log in but rem, adding or removing them from the skim. App won't do anything.

A

To their membership because their name id doesn't match, skim is only used for adding and removing users kind of in theory, the only kind of difference in the way that it's implemented from that kind of cut and dry line is that when you add a user to skim, if the user doesn't already exist, gitlab does a whole bunch of things.

A

It will create the user, it will add a saml identity and it will add a skip identity.

A

That's the only kind of difference from just like this cut and dry line of this is what samuel does, and this is what skim does it's because of the way we've implemented, adding a new user, but in but overall they have different roles, so one does not really do something that the other can or cannot do.

A

Does that make sense?

A

Does that answer your question? Yeah.

E

So if you've got a gitlab user and you've set up saml and skin, there will be a sample record. One sample record for that user. So identity and one scheme record for each group that the user's in.

A

Both will have one for each group.

A

Every group that a user is tied to with samo has a separate saml identity and that's.

E

A

For skim as well, because the way that it works is that, like um so I have a group, so let's call it git lab silver. That's one of our test groups right, so I've set up sso for gitlab silver, so the identities that are you know surrounding a user and how they log in and how they're managed within gitlab silver is tied around the way that I set it up for the provider and the app that I've set up. So that's why and then they'll have a gitlab silver saml identity.

A

They'll have a git laps over skim identity. If we then set up saml and gitlab gold right, we could set gitlab gold with a completely different identity provider right and we could actually have different completely different configuration.

A

So that's why? If there's a single user account but they're logging into two different groups, they'll have separate saml and skim identities, because every group can set up whatever someone's given out they want and again it can be a completely different provider if they really want.

E

Not one-to-many semi-skim, it's one to one and then it's.

A

E

One big group yeah.

E

Do we have um guidance on how to fix up the sample if the, if the customer has done what's likely to be done, that they've set up this ammo with an email identifier and then they'd follow the docs for skim and, oh now, all their samples wrong?

E

A

The troubleshooting section kind of covers how a user can do it themselves, um so a user for example.

A

This is how most identity problems are solved. Actually is that the user can de-link or unlink themselves from the group, it does remove them from the group altogether and then they can sign back in and then because remember when you remove the user uh from the group, even if they remove themselves right, their samoan identity gets deleted. So then, when they sign in again it recreates the samoa identity with the new identity, whatever it's been changed to, and so that will kind of fix it on its own.

A

Now, in cases where you're talking about like 50 100 000 users right, you can imagine customers not going to want to do that at the moment.

A

um As I said, because customers can't do it themselves, we will do it. We have scripts. We have scripts already written to do that as long as they provide the information we need, which for the most part, is basically, it is very basic right.

A

We ask them for an email address, that's just to kind of confirm that we're changing it for the correct user, um and then we ask them for the old identity, which is what we'll match on and then we'll ask them for the new identity, which is what we'll change it to so the email and the old identity is to find the user and verify we're changing or modifying the correct user identity and then the new id, which is what they need it changed to in order to make sure that they can actually log in it is a pain.

A

So, as I mentioned earlier, there is very much a feature request to allow group owners to do it themselves instead of relying on us.

A

The other thing is that if you have admin access- and you don't have console access, if it's just like one or two for some reason, if you absolutely have to change it on behalf of the customer, you can do it through the admin ui.

A

um If you look at the user, um I kind of want to be able to make this public, so I don't really want to be showing you the admit ui.

A

But basically, if you go to the users admin area and you look for their identity, you can actually click on edit and then or delete. So you can delete their user saml identity or you can click edit and then change what their identity is.

E

A

I had a test user melissa. You must have a test user that I can bring up and admin.

A

If, if you have one, I can quickly show it, I just need any test user that has a saml identity.

A

Which I'm going to quickly look at my test.

F

C

I put one in chat that you can use already.

A

A

You of having melissa here, thank you for joining.

A

Oh there's no identities on this one.

A

At least they're not seeing any.

A

Okay, well, if, if melissa finds one that has an identity tied I'll I'll, bring it up in the meantime, any other question anton: I see you have one: do you want to vocalize.

F

Yeah sure so uh I've actually been doing some work on ldap this morning. Just before this call- and I just had a question about that so skim- does it actually synchronize any user attributes once um the user's been provisioned and get lab like later on, or is it basically once it's been created, that's it until it's either deactivated or deleted on the identity provider. End.

A

um Yeah, so the the way that you're you're right in that, basically, what happens is it's only really used on creation?

A

um The? What the and again actually our patch or put only applies to azure and my understanding uh on what that can do is change. Some potentially change some of the attributes that are in the skim identity, but there's really not much in there. To be honest, it's like the id uh some system dates like created, updated um the group id. uh But again, that's not something.

A

You'd expect the identity provider to be able to change like aside from the id there isn't really anything that I would expect the identity provider to be able to change, um but we do actually have the api call functionality.

A

um And if you look at the skim api docs, it actually gives you a good idea of what can be changed. um So if I'm just going to quickly share.

A

The docs page, so uh so this is this is the skim api and again you know I mentioned earlier: we've marked as a system. Only users are not really supposed to be using this directly, um but in the case of troubleshooting.

A

You know we have actually told people like if you want to remove someone's skin identity. This is really the only way to do it, so you they they can use it. We just generally don't recommend using it directly, except for troubleshooting purposes, when we actually tell people that this would be the only way to do it, so the api kind of gives you an idea of like one is.

A

You know not only, of course, what information you can just get from it uh in terms of reading what's in the identity, um but a little bit of kind of like the minimum required when creating a user- and this is the update the patch right. So this is what can be updated through the patch now what's weird about this.

A

A

A

As far as I know, if you update this, you can basically re-tie a user to a different identity, um but you generally, you wouldn't be doing. Actually, I don't know if you can do that.

A

I actually don't know now that I think about it in exact detail. um I might have to get back to whether that's possible. It's not a thing that like we would actually tell people to ever do right, and- um and so you what's interesting- is that here you can change the external id, so in theory and again, we've not tested this thoroughly, um but based on the api and whatnot in theory.

A

What you could do is change this right so that, um if you change the name id in azure in theory, azure could say: hey update this person's extern. Uid actually don't know how well it works.

A

I've we've not thoroughly tested this and again because it was meant for the system to follow the specs. It partly depends on what the spec would generally allow for.

A

Sorry, I yeah, I don't actually have a definitive answer for you, but the api definitely kind of gives you a bit more information about what we would expect in a in a patch response. But, like I say, octa, doesn't even have the put our patch functionality in our the way that gitlab has implemented into skim, and I'm not sure when, like it does either so azure would be the only one that could even potentially do this.

C

um Artie, I put another user. This one does have a sample identity. I double checked.

A

Yeah, okay, great so we're going to circle back a little bit to the question on identities. Here you go so thank you for giving me a test user and then so if we go to identities for this user, we can see hey. This is a group sample identity for this. This is the name of the group so um and it does link to the group. So I can go. Take a look at the group.

A

If I want to um the id here, is the provider id- and this is what you would see in the api, so the api, for example, for this user, would give you the the type which is group saml. It would actually give you the group id rather than the group name, and then it would give you the provider id and then this is their identifier, so you can either delete it and just remove the sample identifier.

A

But if you wanted to just update the identifier, you can literally just go in here change it to whatever you want and then save it and that's it um if, for some reason you wanted to create one, you can technically do that too.

A

The problem with this is that notice there's nowhere to put the group provider id, so you can actually, you cannot create sample identifiers. This way.

A

You can it can really only be created by the user signing into the.

A

A

A

Is there anything else around that mic that you wanted to see or ask about.

A

Any other questions.

G

uh Cynthia, I I think I have one on like slide six uh with the two identities and one you said that, for example, it says created when the user links to the group and the other one says created when linked to group. Can you please elaborate a little bit over that, because I don't think I understood.

A

Well, um linking to group basically the first time they means the first time that they sign in using ssl.

G

So let's say that I'm start working with a group that has sso and then I am creating my gitlab user. It will. That will be the one that will work with samo. That's the way it.

A

Works um depending on how you're, creating the user and, if you're, doing it through skim or just saml, so here's the thing.

A

The reason we you want skim in the first place is that it will create users that don't exist and the way that a customer would do. This is simply to add the user in the skim app so again say: let's take octa as an example, you have octa saml and after skim setup in the after skin. You add users right to say: hey this user should be in the should have access and should be part of the gitlab group.

A

So you add them to the optoscan app in or the gitlab skip app in octa after then ask gitlab hey: does this user exist if the user? If there's no user account with that email address already, which is actually in gitlab? The only restriction is that the email doesn't exist right then it will create the gitlab user account and it will create both actually the saml and skim identity automatically, but the identity itself.

A

For an existing user is not created until the first time that they sign in to the group through sso, so for an existing user. If you know octa says hey, I have this new user, git lab says: no can't do it. Their email address already exists, then the person would have to sign into their gitlab.com user account and then also sign in to the group through sso, specifically authorize the sending of their information to the identity provider and then their sample and their skim identities will be created.

A

So yes, I should I'll. Let me just very, very quickly update the slides that that is for.

A

That's for an existing.

A

H

And the same old scheme ids match each other correct they should they should okay sounds gonna, be my question too essentially, is um if the email address already exists on gitlab, you have to link it manually, like you explained, but that should also create the skim id, even though it wasn't provisioned via skim.

A

So what happens is when the user signs in through the sso for the first time, they'll see like a little box and a like a green button that says authorize so they what they, what they're doing is they're authorizing gitlab right to communicate with our identity provider um and basically say: okay, hey octa, give me the identity, the name id or the extra new id for this user right and then octa will send that back and then gitlab will use that to create it.

A

Where problems happen often is when um this happened more so when skim didn't exist, so someone the customer will have set up saml with a specific name id and then um you know once skin was implemented. They say: hey skim exists. Now, let's implement skim, they implement skim and they follow our docs, but they end up with a name id that is different than what they originally set up in saml. So then you get these conflicts, and this is why it's like okay, look!

A

If you're setting up sso your name id should match, follow our guidelines around what a name id should be. That's on the samoa page. The main thing is that it's something that should never change. This is why we actually don't recommend email, because someone changes their last name. They get married, they get divorced. I don't know whatever reason they change their lasting. Suddenly, their email address has changed too and then their name ideas, change, and then they can't log in anymore.

A

So we tell people, don't use email because that can change, whereas like an identity provider like id like an internal id for a user, doesn't change and that's why we tell people to try to use something like that, so we don't actually care exactly what you use as long as it follows the guidelines which the primary one is. It doesn't change over time for a user, regardless of what happens to them in their life.

A

You know and their time at their workplace and then so the name id needs to match between saml and skim and whatever you send to gitlab for both of those.

A

That's that's the main thing around samolin skin configuration you don't even care exactly what it is as long as it's um for azure. So this is the other thing. Is that because octa is not a single app yet after we actually do care?

A

What you set the name id to, if you're, implementing skim, if you're just implementing saml again saml is used for authentication as long as the name id matches to what's in gitlab, we don't actually care what it is, but once you involve skim and octa skin uses a very specific attribute with a very specific value. You cannot change that in the octa-skim app, so your octa-samus settings has to be exactly what we've documented in our docs so that it matches so that the name id matches.

A

I don't know how they have actually done it in one login I'll have to take a look when the docs are actually up there.

A

Does that answer your question, hopefully that clarifies it.

H

Yes, thank you.

A

Okay, I realized we're actually at time, um so I'm gonna end it there uh and I'm gonna stop the recording in just a second. I want to thank everyone for coming and joining asking questions. If you have any more questions, there are a couple of more follow-up q and a sessions, one which is a little more apac friendly one which is a little more emea friendly, but both of which are more or less in amer time.

A

So again, if you have any more questions, feel free to add them to the dog, um if you can't make it to the follow-ups for any reason feel free to just reach out ping me there's still the slack channel, um so you can also, please add it to your question to the doc. But you can, let me know in the slack channel that you posted it to the doc.

A

So I'm gonna go ahead and start to work.