Setting up Azure AD SSO for Bitrise

Abstract

Add SAML SSO to your Bitrise Workspace using Azure AD.

SAML SSO restrictions

SAML SSO is only available for a Workspace with the Velocity or Enterprise Build plans.

Since the SAML SSO feature is tied to the above plans, if you decide to downgrade, you will lose this feature. All Workspace members will receive an email about the downgrade and you’ll have two weeks to re-upgrade if you wish to use SAML SSO in your Workspace again.

Before connecting SAML SSO to your Workspace:

Make sure an Azure AD administrator who is logged into Azure AD is at hand.
Be aware that only the Workspace owner can set up SAML SSO to a Bitrise Workspace.
Your account on Bitrise has a Workspace with the Velocity or Enterprise plan.

You will need to:

Adding Bitrise to Azure AD as a new application

Log into Microsoft Azure as an admin.
Click the Azure Active Directory icon on the Azure services page.
Click Enterprise applications under Manage.
Click New Application to add Bitrise as a new app to your account.
Type Bitrise in the What’s the name of your app? field. The Integrate any other application you don’t find in the gallery button should be automatically selected. Hit Create.

You will find your newly created app listed on the All Applications page.
Click the Bitrise app to go to its Overview page.
Continue with configuring Bitrise as a SAML app.

Adding users/ groups to the app on Azure AD

Before setting up SAML to the app, you have to add all the users/groups to the app in Azure AD who will use SAML SSO to log into the Bitrise Workspace. In other words, every Bitrise Workspace member must be added as user in Azure AD.

Select Users and groups from the left menu.
Click + Add user/group.
On the Users page of Add Assignment, select users from the list and click Select. Once it’s done, you can select a role for users under the Select a role dropdown.
On the Add Assignment page, click Assign to finish adding users.

Setting up SAML SSO between Bitrise and Azure AD

Click Single sign-on on the left menu. Select SAML.
You will land on the Set up Single Sign-On with SAML page.
Click the pencil symbol at Basic SAML Configuration to edit two fields.
Add Bitrise as the Identifier (Entity ID). Leave this window open! We will come back to it with some information from Bitrise in a second.
Head back to your Workspace on Bitrise.
Click the Single Sign On tab and click the Copy Link button to copy the Assertion Consumer Service URL (ACS URL) from Bitrise.
Let’s head back to the Basic SAML Configuration window of Azure AD.
Paste the Assertion Consumer Service URL from Bitrise to the Reply URL field on the Basic SAML Configuration page of Azure AD.
Click Save and close the Basic SAML Configuration window.
On the Single sign-on page of Azure AD, scroll down to the Set up Bitrise section.
Copy the Login URL and paste it to the SAML SSO provider Single Sign-On URL (SSO URL) field on Bitrise.
On the Single sign-on page of Azure AD, scroll up a bit to the SAML Signing Certificate section.
Click Download next to Certificate (Base64) to download the certificate to your local computer.
Open the certificate file and copy/paste its content into the SAML SSO provider certificate field of Bitrise or you can upload the file itself from your local computer too.

(If manually adding the content, you will need the full content (including ----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- as well).
Hit Configure SSO on Bitrise.