Gitfence
Start free

Single sign-on

Set up SAML 2.0 or OpenID Connect for Okta, Google Workspace or Microsoft Entra ID, verify an email domain and turn on Require SSO.

Short answer: Gitfence supports SAML 2.0 and OpenID Connect with Okta, Google Workspace and Microsoft Entra ID. SSO is Enterprise; you can require it.

Steps

  1. Copy your Gitfence details. Go to Settings → Single sign-on:
    • SP Entity ID: https://gitfence.dev/sso/<org-id>/saml/metadata
    • ACS URL: https://gitfence.dev/sso/<org-id>/saml/acs
    • Metadata URL: https://gitfence.dev/sso/<org-id>/saml/metadata
    • OIDC redirect URI: https://gitfence.dev/sso/<org-id>/oidc/callback
  2. Configure the provider.
    • Okta: Applications → Create App Integration → SAML 2.0, or OIDC - Web Application. For SAML, set Single sign-on URL to the ACS URL, Audience URI (SP Entity ID) to the SP Entity ID, Name ID format to EmailAddress and Application username to Email. For OIDC, set Sign-in redirect URI to the OIDC redirect URI. On Sign On, copy the Metadata URL, or note the issuer, client ID and secret.
    • Google Workspace: Admin console → Apps → Web and mobile apps → Add app → Add custom SAML app. Download the IdP metadata (Option 1). Set ACS URL and Entity ID, choose EMAIL and Basic Information > Primary email as the Name ID. Turn User access on and paste the metadata XML into Gitfence.
    • Microsoft Entra ID: Entra admin center → Enterprise applications → New application → Create your own application (non-gallery), then Single sign-on → SAML. In Basic SAML Configuration, set Identifier (Entity ID) and Reply URL (ACS). Keep user.userprincipalname or user.mail as the unique identifier. Copy App Federation Metadata Url into Gitfence.
  3. Save it. Under Identity provider, choose SAML 2.0 or OpenID Connect. For SAML, choose Metadata URL or Paste XML, then Save SAML settings. For OIDC, enter Issuer URL, Client ID and Client secret, then Save OIDC settings.
  4. Verify an email domain. Under Email domains, choose Add domain, then add its DNS TXT record: _gitfence-challenge.<domain> with gitfence-domain-verification=<token>. Choose Verify. Only verified domains route Continue with SSO.
  5. Test and enforce. Choose Test sign-in, then tick Require SSO.

First sign-in

Gitfence asks the person to connect GitHub: Continue with GitHub, then confirm Link to @. An email match can suggest an account, never link one.

Require SSO and recovery

Require SSO needs an owner, a provider, a successful test, the owner's SSO sign-in and a verified domain. Git and MCP tokens keep working.

Turning it on returns eight recovery codes, shown once. Each works once for one hour, after the owner signs in with GitHub and uses Can't reach your identity provider? (owners). Create new recovery codes invalidates the old ones. An owner can always turn Require SSO off, including after a recovery code.

Gotchas

  • Replacing the provider or removing SSO requires turning Require SSO off first.

Next: SCIM provisioning.

Related guides