This guide provides step-by-step instructions on setting up Bitrise as a SAML application on Okta.
This requires:
- an Okta administrator who is logged into Okta
- a Bitrise organization owner who is logged into his/her Bitrise organization (with Org Elite subscription)
Adding Bitrise to Okta ⚓
Bitrise is not an integrated app in Okta. You have to add Bitrise manually to Okta first, then you can configure SAML SSO on it.
We will be jumping back and forth from the Bitrise organization account to the Okta so make sure both pages are available. In practice this means the organization owner should be logged into Bitrise and the Okta admin should be logged into Okta.
-
Log into Okta and click
Admin
. -
On your Dashboard click
Add Applications
underShortcuts
. -
Click the green
Create New App
button.The
Create a New Application Integration
screen is displayed. -
Select
SAML 2.0
option atSing on method
and clickCreate
. -
At
General Settings
step, type Bitrise into theApp name
field. (Optionally, you can add an app logo if you wish.) ClickNext
. - Head over to your Bitrise organization and click the
Single Sign On
tab on the left menu. -
Click the
Copy Link
button to copy the Single Sign-On URL. - Head back to Okta’s
SAML Settings
and paste the copied URL to theSingle sign on URL
input field. -
Type Bitrise at the
Audience URI (SP Entity ID)
.You can download the Okta certificate file now and paste its content in the
Certificate
field on your Bitrise org’sSingle Sign On
page. Even easier if you leave it for later as you will need theIdentity provider sign-on URL
from Okta anyway. You will fetch this while configuring Bitrise as a SAML app. - Click
Next
. - Select the answer at Feedback as best it suits your organization. Hit
Finish
.
Congrats! Bitrise has been successfully added to Okta as an app.
Configuring Bitrise as a SAML app ⚓
-
Click the
Assignments
tab of your Bitrise app.Here you can assign Bitrise to individuals/groups. Make sure you assign Bitrise to all org members who will access the Bitrise org through SAML.
-
Click the
Sign-On
tab of your Bitrise app. You will see that SAML setup is not completed yet. ClickView Setup Instructions
.The
How to Configure SAML 2.0 for Bitrise application
page is displayed. It summarizes all the information you need to set up the SAML connection between Bitrise and Okta. -
Copy the
Identity Provider Single Sign-On URL
and paste it in your Bitrise org’sIdentity provider sign-on URL
.If you haven’t pasted the Certificate into the respective field of your Bitrise org yet, you can do so now as it is displayed on this page.
-
Click
Configure SSO
on your Bitrise org.
Enabling SAML SSO on Bitrise ⚓
Once SAML SSO has been set up between the app and the identity provider, all org members (including the org owner) must enable their SAML SSO connection to the respective org to use SAML SSO as a secure login method.
- Check your mailbox (one associated with your Bitrise account) for an email notification sent by Bitrise (
letsconnect@bitrise.io
). All org members who have been invited to the Bitrise org receive this email from Bitrise. - Click
Sign In via SSO
. This link will take you to an authorization page where you have to clickAuthorize
if you trust the organization.
If all went well, you should be landing on your Bitrise Dashboard. If you go to the Groups
tab the organization, you can see that you are automatically added as a SAML user. All org members, who enable SAML SSO, appear here automatically.
Please note that at this stage, SAML SSO has not been enforced as the only gateway to the Bitrise org. You can only enforce it if all org members have completed the above steps. You can check each org member’s status (enabled or disabled) if you click the Review Users
button on the org’s Single Sign-On
tab.
Enforcing SAML SSO on the organization ⚓
To be able to sign into Bitrise exclusively via SAML SSO, you have to enforce SAML on the organization. Mind you! You can only enforce SAML SSO on the org, if all org members have enabled their SAML SSO connection.
- Toggle the
Enforce SAML SSO
switch to the right on theSingle Sign On
tab of the org. - Click
Save Changes
.
From now on, org members will be able to log in exclusively via SAML SSO.