GitLab SAML SSO with Microsoft Entra ID
Configuring self-managed GitLab as a SAML app in Entra ID: mapping Entra fields to gitlab.rb settings, the certificate thumbprint, group claims for admin and external users, and pairing it with SCIM.
GitLab authentication and user management
Connecting self-managed GitLab to corporate identity: SAML with Entra ID, Okta or Google, LDAP group sync, SCIM provisioning and enforced two-factor authentication.
GitLab SAML SSO with Okta
Setting up Okta SAML for self-managed GitLab: the app settings GitLab documents, required groups to restrict sign-in, group attributes for admin and auditor roles and Okta SCIM provisioning.
GitLab SAML SSO with Google Workspace
Signing in to self-managed GitLab with Google Workspace SAML: the custom SAML app, the certificate fingerprint, name ID format and what Google Workspace cannot provision without SCIM.
GitLab LDAP and Active Directory group sync
Mapping Active Directory or LDAP groups to GitLab group roles in Premium: group_base, admin_group and audit_group, hourly sync timing and planning for large directories.
Troubleshooting blocked LDAP users in GitLab
Why GitLab blocks LDAP users after directory outages or rate limits, how ldap_blocked state clears, resyncing single users and setting up monitoring so a directory hiccup does not lock everyone out.
GitLab SCIM user provisioning with Okta or Entra ID
Automating GitLab account creation and blocking from Okta or Entra ID with SCIM in Premium, SCIM group sync, and how deprovisioned users keep their SAML identity for reactivation.
Enforcing two-factor authentication in self-managed GitLab
Rolling out mandatory 2FA instance-wide, for administrators only or per group: grace periods, TOTP and WebAuthn, the API settings for automation and handling users locked on the setup page.
GitLab SAML admin, auditor and external groups
Controlling GitLab administrator, auditor and external user status from SAML group attributes, where the settings must live in gitlab.rb, and what happens when the groups attribute is missing.
GitLab Kerberos and smart card authentication
Passwordless sign-in for government and enterprise networks: Kerberos sign-in, smart card certificate login, and how both sit alongside LDAP for the same users.
GitLab sign-in with generic OAuth 2.0 and OmniAuth providers
Using the generic OAuth 2.0 and OmniAuth providers GitLab supports for sign-in when SAML is not an option, just-in-time account creation and the one-provider-per-type limit.
