GitLab Manage Stage, 1 Oct 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Manage:Access - Minimal Access with SSO for Gitlab.com

Description

Melissa Ushakov shows new functionality that allows group administrators to have more flexibility in their SAML SSO setup.

Issue Link: https://gitlab.com/gitlab-org/gitlab/-/issues/220203

A

Hi, I'm melissa usherkopf from the access team, and I wanted to show you a super, exciting new feature that we just launched it's around saml sso for gitlab.com and a way to be more fine-grained about what your users can see.

A

So let me share my screen and I'll give you some background, as well, so for gitlab.com when you set up sso you're, basically establishing that in a top level group, and when you do that, when a user follows a saml sso link, they're, basically added to that top level group and before they were added with the um role of guest by default, we've made that customizable. So now you can add them with any role and we've added this new role called uh minimal access.

A

I'll show you first, what being a guest looks like and why it's problematic?

A

So you see here we have a user called chica, usha club and I've added her as a guest in my top level group for saml sso purposes right, so she needs to be present in this top-level group and in reality this user only needs access to one project which is.

A

This secret and roof project right, so I'm going to jump over here. Let me go back because I was messing with this uh here. So in this window, I'm following and again this group has sso, so this is chica we'll be trying to access this group, so you see she's a guest and she can see all of this information because she's a guest at the ishikov group sharing and she's a developer here in the secret android project.

A

So now I'm going to go back over here and I'm going to change chica to be a minimal access user right, so she's minimal access at the top level group and she's a developer in that secret android project.

A

So now I'm going back over here to chica's, login and refreshing, and you see now. The only thing I see is this uh secret android project and I can still use sso to access this group. um So this change and again this also is basically you can choose the default role to be minimal access.

A

So, basically, anybody that follows a sso link into the sushi cub group sharing group will be added as a minimal access user to the top level group, which allows you to really limit what they can see and then later down the line. They can be added to projects below and basically limit what you see.

A

So this is a really exciting change for customers using gitlab.com sso that want to be really fine-grained about what their users can see so I'll link in the description, the issue where this functionality was added- and please ping me if you have any questions thanks.