Transitioning your enterprise to SAML SSO
With the Enterprise plan, you can transition your enterprise to SAML SSO.
Proceed as follows:
- Verify the user groups of the enterprise's organizations: see below.
- Register SonarCloud in the SAML identity provider.
- Configure SAML SSO for your enterprise in SonarCloud. This step must be performed by an enterprise admin.
- Perform post-configuration steps: see below.
Verifying the user groups of the enterprise's organizations
To ensure that the automatic group synchronization can take place properly, verify that:
- The user groups defined in your IdP service exist in the relevant organizations of your SonarCloud enterprise (i.e. a group with the same (context-sensitive) name exists in the relevant organization(s)).
- The user groups in SonarCloud have the correct permissions.
To manage the user groups in SonarCloud, see Managing the user groups in your organization.
Group definition example
The figure below shows a group definition example with Okta as IdP.
Microsoft Entra ID's SAML tokens have a limit regarding the number of groups a user can belong to (see the description of groups in the Claims in SAML Token table). In such cases, you might need to reduce the number of groups the user is in.
Post-configuration steps
- Test the SSO connection.
- Send the SSO login URL to invite enterprise users to sign in to SonarCloud with SSO. Once they have signed in, their SAML SSO account is created in SonarCloud and they have access to their organization(s) through the automatic group synchronization with the identity provider. They should:
- Check that they have access to their organization(s) and can perform their tasks as before.
- Generate their analysis tokens with their SAML SSO account. (They can still use their DevOps platform service (DOP) account tokens to execute analysis).
- Sign up with SonarCloud by using the enterprise’s SSO log in URL. Your SAML SSO account is created.
- Sign in to SonarCloud with your DOP account and grant your SAML SSO account the Administer Enterprise permission.
- Once the enterprise users have successfully transitioned to SAML SSO, you can remove their DOP accounts from the organizations and the users can delete their DOP account. We recommend that you don’t remove the admin DOP accounts since, with a SAML SSO account, you currently cannot bind a SonarCloud organization with the corresponding DOP organization.
When created, SAML SSO accounts will have no history. That means that comments on issues, favorite projects, etc., will not be transferred from the corresponding DOP account's history.
Was this page helpful?