Skip to main content

Enable SSO login

Enable SSO login when organization users sign in to NineData through an identity provider (IdP). This guide covers the NineData-side configuration and an Azure AD IdP example.

Before you begin​

  • You have already created or joined an organization, and the organization has subscribed to DevOps Enterprise. Please ensure that your annual or monthly subscription is still active. For more information, please refer to Manage Organizations.
  • Your current account has been switched to the target organization. For more information, please refer to Switching to an Organization.
  • Your role is a system administrator. For details, see Roles.
  • An IdP application has been registered. This guide uses Azure AD as an example.

Notes​

  • After SSO login is enabled, the identity of the current organization changes from ORG to SSO. Except for Administrator, all members can sign in to the organization only through SSO.
  • After SSO login is enabled, Administrator cannot add members by inviting users. Add members by creating SSO users or by enabling automatic SSO user join.
  • To disable SSO, the organization must have a Administrator user whose Account Type is General. Otherwise, SSO cannot be disabled.

Procedure​

  1. Sign in to the NineData Console.

  2. Open Account > Organization.

  3. On the Organization Info page, click the toggle switch next to Login With SSO to enable SSO login, and then configure the settings in the table.

    Parameter
    		Description
    Open Login With SSOEnable SSO functionality.
    Protocol TypeSupports two protocols: SAML 2.0 and OAuth 2.0.
    • SAML 2.0: An XML-based open standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP).
    • OAuth 2.0: An authorization framework that lets users grant third-party applications access to their resources without exposing their username and password.
    Organization domainEnter your organization domain. Use your organization name if it matches your SSO naming policy.
    Org Login URLNineData generates Org Login URL based on Organization domain. Users use this link to sign in directly to the target organization.
    OAuth Service Provider Metadata (OAuth 2.0)NineData generates Identifier (Entity ID) and Reply URL (Assertion URL) based on Organization domain. Use these values on the IdP configuration page. For details, see DingTalk integration with NineData SSO.
    Parameters (OAuth 2.0)Enter the information obtained from the IdP. For details, see DingTalk integration with NineData SSO.
    SAML Service Provider Metadata (SAML 2.0)NineData generates Identifier (Entity ID) and Reply URL (Assertion URL) based on Organization domain. Click Download next to SAML Service Provider Metadata, and use the downloaded XML file in the IdP console to obtain the metadata required for SSO login. For details, see Feishu integration with NineData SSO.
    Metadata (SAML 2.0)Enter the certificate information obtained from the IdP for Identifier (Entity ID), Login URL, Logout URL, and Certificate. To populate the metadata fields automatically, click Upload File to Auto-recognition and upload the Federation Metadata XML file downloaded from the IdP. For details, see Feishu integration with NineData SSO.
    Allow SSO Account Auto-join (Optional)Enable this option when NineData should add SSO users during their first sign-in. If this option is disabled, create SSO users in advance. For details, see Create SSO users.
    Note: If an administrator disables SSO login later, SSO users in the organization can no longer sign in. General users are not affected.
    Default Role (Optional)Optional when Allow SSO Account Auto-join is enabled. Specify the default role or roles for newly joined SSO users. Single and multiple selections are supported.
    User information mapping (Optional)Use this option after enabling SSO to write user fields returned by the IdP into the NineData user profile. Field mapping can populate basic information, such as email, phone number, and username, during the user's first SSO sign-in.

  4. Click Save.

Result​

SSO login is enabled for the organization after both the NineData and IdP configurations are saved. Users can sign in through the configured SSO entry after their SSO accounts are created or auto-join is allowed.

Appendix: Configure an application in Azure AD​

  1. Sign in to the Azure portal using an administrator account.

  2. In the top search bar, type Enterprise applications and click Enterprise applications in the search results.

  3. Click New application and on the Browse Azure AD Gallery page, click Create your own application.

  4. In the panel on the right, enter an application name, select Integrate any other application you don't find in the gallery (Non-gallery), and then click Create.

  5. After the application is created, Azure opens the application overview page. Go to Single sign-on, and select SAML as the sign-in method.

  6. On the Set up Single Sign-On with SAML page, click Upload metadata file, select the XML file downloaded in Enable SSO login, and click Add.

  7. On the Basic SAML Configuration panel, click Save.

  8. Scroll down to the third section (SAML Certificate) and click Download next to Federation Metadata XML.

    tip

    The XML file contains metadata information required for SSO login, including Azure AD Identifier, Login URL, Logout URL, and Certificate. If you do not download this XML file, manually record the metadata information in the fourth section and download the certificate (base64) in the third section.