Skip to main content
Single Sign-On (SSO) lets your team sign in to Gitar with the identity provider they already use, rather than a separate set of Gitar credentials.
SSO is available on the Enterprise plan. Contact developers@gitar.ai to enable SSO for your organization.

​
Choose a Protocol

Gitar supports OpenID Connect (OIDC) and SAML 2.0. We recommend OIDC, as it needs fewer values to exchange and has no certificates to rotate. Use SAML if your identity provider or security policy requires it. Okta is documented step by step below for both protocols. Other providers, including Microsoft Entra ID, Google Workspace, and OneLogin, follow the generic OIDC or SAML steps.

​
Send Credentials Securely

Never send a client secret by email, chat, or support ticket. Share it through 1Password or another secure secret-sharing tool your security team approves. Gitar will confirm the method with you before setup.
Client IDs, domains, SAML sign-in URLs, and SAML signing certificates are not secret and can be sent by email.

​
How Users Sign In

Users open Gitar from a tile on their identity provider’s app dashboard, for example in Okta. The tile opens a Gitar login link that Gitar sends you during setup. Starting SSO sign-in from the Gitar login page is not supported yet.

​
Okta Setup (OIDC)

1

Request SSO Configuration

Contact your Gitar account manager or email developers@gitar.ai to request OIDC SSO. Include the email domains your team signs in with, for example example.com.
2

Create Okta Application

In your Okta admin console, go to Applications > Applications and click Create App Integration. Select OIDC - OpenID Connect as the sign-in method and Web Application as the application type.
3

Configure the Application

Name the application “Gitar” and optionally use the Gitar logo at /assets/images/gitar-brand-logo-dark.png. Configure the following settings:Save the application.
4

Send Configuration to Gitar

Send the following values to your Gitar account manager:Send the Client Secret through a secure channel. Gitar will reply with your Initiate login URI.
5

Configure Login

On the application’s General tab, click Edit under Login and set:The Initiate login URI has the form https://app.gitar.ai/auth/login?connection=<connection>&organization=<organization>.
6

Assign Users

Assign the appropriate users and groups to the Gitar application in Okta. Gitar will confirm once the connection is active.

​
Okta Setup (SAML)

1

Request SSO Configuration

Contact your Gitar account manager or email developers@gitar.ai to request SAML SSO. Include the email domains your team signs in with. You will receive an email with your Single sign-on URL and Audience URI, which are required to set up the Okta integration.
2

Create Okta Application

In your Okta admin console, go to Applications > Applications and click Create App Integration. Select SAML 2.0. Name the application “Gitar” and optionally use the Gitar logo at /assets/images/gitar-brand-logo-dark.png.Check Do not display application icon to users. Users sign in through a bookmark tile you add in a later step.Okta SAML setup
3

Configure SAML Settings

Enter the values from the email you received from Gitar:Keep Use this for Recipient URL and Destination URL checked.
4

Set Attribute Mappings

Under Attribute statements, click Show legacy configuration, then click Edit next to Profile attribute statements and add the following attributes:Attribute mappings
5

Send Configuration to Gitar

Assign the appropriate users and groups to the Gitar application in Okta. Then open the application’s Sign On tab and click More details under SAML 2.0. Send the following to your Gitar account manager:Gitar will reply with your Gitar login link.
6

Add a Bookmark App

Go to Applications > Applications, click Browse App Catalog, and add the Bookmark App integration. Name it “Gitar” and set the URL to your Gitar login link.The link has the form https://app.gitar.ai/auth/login?connection=<connection>&organization=<organization>. Assign the bookmark to the same users and groups as the SAML application.

​
Generic OIDC Provider

  1. Contact developers@gitar.ai to request OIDC SSO, and include the email domains your team signs in with.
  2. Create a web application in your identity provider using the Authorization Code flow.
  3. Set the redirect URI to https://auth.sonarqube.us/login/callback.
  4. Allow the openid, profile, and email scopes.
  5. Send Gitar the Issuer URL, Client ID, and Client Secret. Send the Client Secret through a secure channel.
  6. Set the application’s initiate login URI, sometimes called the login or launch URL, to the Initiate login URI Gitar sends you.
The Issuer URL is the base URL that serves /.well-known/openid-configuration, for example https://login.example.com.

​
Generic SAML 2.0 Provider

  1. Contact developers@gitar.ai to request SAML SSO, and include the email domains your team signs in with. Gitar will send you an Assertion Consumer Service (ACS) URL and an Entity ID.
  2. Create a new SAML 2.0 application in your identity provider. Use the ACS URL as the single sign-on or reply URL, and the Entity ID as the audience or identifier.
  3. Set the Name ID format to email address.
  4. Map an email attribute to the user’s email address and a name attribute to the user’s display name.
  5. Send Gitar the Sign-in URL, sometimes called the SSO URL or login URL, and the X.509 signing certificate from your identity provider.
  6. Gitar will reply with your Gitar login link. Add it to your users’ app dashboard as a bookmark or link tile, and hide the SAML application’s own tile.

​
Troubleshooting

Verify that the affected users are assigned to the Gitar application in your identity provider. For SAML, check that the email and name attributes are mapped. Users must start sign-in from the Gitar tile on your identity provider’s app dashboard, not the Gitar login page. For SAML, that is the bookmark tile, not the SAML application’s tile.
For OIDC, check that the sign-in redirect URI in your identity provider is exactly https://auth.sonarqube.us/login/callback. For SAML, check that the Single sign-on URL matches exactly what Gitar sent you. Even small differences such as a trailing slash can cause redirect errors.
Contact developers@gitar.ai to update your SSO settings or rotate credentials. Send any new client secret through a secure channel. For SAML, send Gitar the new signing certificate before the old one expires.