Setting up Okta SSO for Bitrise

This guide provides step-by-step instructions on setting up Bitrise as a SAML application on Okta.

This requires:

• an Okta administrator who is logged into Okta
• a Bitrise Workspace owner who is logged into his/her Bitrise Workspace (with Velocity subscription)

Adding Bitrise to Okta ⚓

Bitrise is not an integrated app in Okta. You have to add Bitrise manually to Okta first, then you can configure SAML SSO on it.

We will be jumping back and forth from the Bitrise Workspace account to the Okta so make sure both pages are available. In practice this means the Workspace owner should be logged into Bitrise and the Okta admin should be logged into Okta.

1. Log into Okta and click Admin.

   

2. On your Dashboard click Add Applications under Shortcuts.

   

3. Click the green Create New App button.

   

   The Create a New Application Integration screen is displayed.

4. Select SAML 2.0 option at Sing on method and click Create.

   

5. At General Settings step, type Bitrise into the App name field. (Optionally, you can add an app logo if you wish.) Click Next.

   

6. Head over to your Bitrise Workspace and click the Single Sign On tab on the left menu.

7. Click the Copy Link button to copy the Single Sign-On URL.

   

8. Head back to Okta’s SAML Settings and paste the copied URL to the Single sign on URL input field.

9. Type Bitrise at the Audience URI (SP Entity ID).

   You can download the Okta certificate file now and paste its content in the Certificate field on your Bitrise org’s Single Sign On page. Even easier if you leave it for later as you will need the Identity provider sign-on URL from Okta anyway. You will fetch this while configuring Bitrise as a SAML app.

   

10. Click Next.
11. Select the answer at Feedback as best it suits your organization. Hit Finish.

Congrats! Bitrise has been successfully added to Okta as an app.

Configuring Bitrise as a SAML app ⚓

1. Click the Assignments tab of your Bitrise app.

   Here you can assign Bitrise to individuals/groups. Make sure you assign Bitrise to all org members who will access the Bitrise org through SAML.

   

2. Click the Sign-On tab of your Bitrise app. You will see that SAML setup is not completed yet. Click View Setup Instructions.

   The How to Configure SAML 2.0 for Bitrise application page is displayed. It summarizes all the information you need to set up the SAML connection between Bitrise and Okta.

   

3. Copy the Identity Provider Single Sign-On URL and paste it in your Bitrise Workspace’s Identity provider sign-on URL.

   If you haven’t pasted the Certificate into the respective field of your Bitrise Workspace yet, you can do so now as it is displayed on this page.

4. Click Configure SSO on your Bitrise Workspace.

Enabling SAML SSO on Bitrise ⚓

Once SAML SSO has been set up between the app and the identity provider, all Workspace members (including the Workspace owner) must enable their SAML SSO connection to the respective Workspace to use SAML SSO as a secure login method.

1. Check your mailbox (one associated with your Bitrise account) for an email notification sent by Bitrise (letsconnect@bitrise.io). Everyone who has been invited to the Bitrise Workspace receives this email from Bitrise.
2. Click Sign In via SSO. This link will take you to an authorization page where you have to click Authorize.

If all went well, you should be landing on your Bitrise Dashboard. If you go to the Groups tab the Workspace, you can see that you are automatically added as a SAML user. All org members, who enable SAML SSO, appear here automatically.

Please note that at this stage, SAML SSO has not been enforced as the only gateway to the Bitrise org. You can only enforce it if all org members have completed the above steps. You can check each org member’s status (enabled or disabled) if you click the Review Users button on the org’s Single Sign-On tab.

Enforcing SAML SSO on the Workspace ⚓

To be able to sign into Bitrise exclusively via SAML SSO, you have to enforce SAML on the Workspace. Mind you! You can only enforce SAML SSO on the org, if all org members have enabled their SAML SSO connection.

1. Toggle the Enforce SAML SSO switch to the right on the Single Sign On tab of the org.
2. Click Save Changes.

From now on, org members will be able to log in exclusively via SAML SSO.