Troubleshooting Group SAML and SCIM (PREMIUM SAAS)

These are notes and screenshots regarding Group SAML and SCIM that the GitLab Support Team sometimes uses while troubleshooting, but which do not fit into the official documentation. GitLab is making this public, so that anyone can make use of the Support team's collected knowledge.

Please refer to the GitLab Group SAML docs for information on the feature and how to set it up.

When troubleshooting a SAML configuration, GitLab team members will frequently start with the SAML troubleshooting section.

They may then set up a test configuration of the desired identity provider. We include example screenshots in this section.

SAML and SCIM screenshots

This section includes relevant screenshots of the following example configurations of Group SAML and Group SCIM:

WARNING: These screenshots are updated only as needed by GitLab Support. They are not official documentation.

If you are currently having an issue with GitLab, you may want to check your support options.

Azure Active Directory

Basic SAML app configuration:

Azure AD basic SAML

User claims and attributes:

Azure AD user claims

SCIM mapping:

Azure AD SCIM Provisioning Azure AD SCIM Attribute Mapping

Group Sync:

Azure Group Claims

Google Workspace

Basic SAML app configuration:

Google Workspace basic SAML

User claims and attributes:

Google Workspace user claims

IdP links and certificate:

Google Workspace Links and Certificate

Okta

Basic SAML app configuration:

Okta basic SAML

User claims and attributes:

Okta Attributes

Advanced SAML app settings (defaults):

Okta Advanced Settings

IdP Links and Certificate:

Okta Links and Certificate

Sign on settings:

Okta SAML settings

Self-managed instance example:

Okta admin panel view

Setting the username for the newly provisioned users when assigning them the SCIM app:

Assigning SCIM app to users on Okta

OneLogin

Application details:

OneLogin application details

Parameters:

OneLogin application details

Adding a user:

OneLogin user add

SSO settings:

OneLogin SSO settings