GitLab Feature Walkthroughs, 3 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Feature Preview: Group SAML Just-in-time Provisioning

Description

Preview of the new Group SAML just-in-time provisioning feature planned for GitLab 13.7.

Issue https://gitlab.com/gitlab-org/gitlab/-/issues/268142

A

Hi everyone, my name, is drew blessing. I'm a back end engineer for get lab. I want to take a few moments and give you a preview of a feature that we will ship in 13.7, which is just in time provisioning for group saml for gitlab.com.

A

What this means is that if a user comes to sign in with their groups sso provider- and there is not an existing account on gitlab.com with that same email address- we will automatically create that user for them.

A

Currently what happens is the user is brought back to the general gitlab.com sign-in page and then they either have to sign in with an existing account or create a new account in order to to link their saml provider?

A

Let me share my screen and we'll take a look.

A

For reference, this is the issue that I'm uh giving a preview of issue number 268142.

A

Let's go over to this local gitlab instance that I have set up already with saml sso. If a new user comes and clicks sign in with single sign-on for their group they're redirected to their sso provider. In this case, I've already authenticated there, and now I'm brought back to gitlab and the account is created for me.

A

You will notice that users will still have to verify their email address sometime within, I believe the first three days of using gitlab.com, but there was no manual signup process or sign in process to go through here.

A

Very quickly, just for reference I'll show another workflow as well, and that is if a user already exists in gitlab.com with that email address and they sign in.

A

For the first time with group sample, I made a quick change on the back end that unlinked, that new account that I just created so we'll click sign in again go through this loop and this time I'm brought back to the sign in page where I can either sign into an existing account or sign up with a new account in order to link that- and that is because that conflict exists with the email address.

A

All right, that was a quick preview. Please look for this feature in 13.7 and watch that issue for further updates. Thank you.