SmartGit Single Sign On (SSO)

Single Sign-On (SSO) in Repository

You can access the Repository providers that use authentication protocol for single sign-on (SSO) by authenticating through an identity provider (IdP).SSO helps you maintain control of your identity and contributions, while giving organizations a centralized and secure way of controlling access to their resources on Repository. The flow diagram below shows the steps used for authenticating the user.

• User tries to Login into repository providers like GitHub, Bitbucket, SmartGit, etc.
• The Repository sends the request to the miniOrange Identity Provider for authenticating the user. miniOrange supports different authentication protocols - SAML, Oauth, OIDC, WS-Fed and many more. The SSO tool requests an encrypted token from the Identity Provider.
• Identity Provider intercepts the request and sends a response to the repository provider after authenticating the user credentials.
• The encrypted authentication token generated from the Identity Provider allows the user to login in a repository provider. The user gets logged in and can access the repository contents.

Single Sign-On (SSO) in SmartGit

miniOrange helps you to log in into SmartGit application. SmartGit supports Oauth authentication protocol for Signle Sign-On with the identity providers. User will put on his app IdP credentials and will be authenticated to access the repository.

• The user tries to Login into the SmartGit desktop application using Identity Provider credentials.
• SmartGit sends a request to the repository provider.
• Repository Provider intercepts the request and then forwards it to the Identity Provider through API calls.
• Identity Provider sends a response to the repository provider after authenticating the user credentials. It generates the authentication token which is required for SSO.
• The repository provider reads the response and forwards it to the SmartGit.
• The authentication token generated allows the user to login into the SmartGit application.

GitHub Enterprise Integration

Authenticating to a GitHub Enterprise instance is slightly different than to github.com due to the nature of OAuth. Basically you have two options:

• using Personal Access Tokens: this approach can be performed by an individual user without needing administrative rights for the GitHub Enterprise instance. It's recommended if only a small number of your GitHub Enterprise users are using SmartGit
• configuring a Developer Application: this approach requires administrative rights for the GitHub Enterprise instance and changes to the SmartGit System Properties (which can be done on an administrative level for all users, too). It's recommended if you have a large number of SmartGit users.

Personal Access Token

Personal access tokens are working for GitHub Enterprise as well as for github.com. To create a personal access token, go to your Account settings and select Personal Access Tokens. Invoke Generate New Token, enter SmartGit for the Token Description and for Select scopes select the repo scope and the read:org scope.

After confirming with Generate Token, you will see the new token in your list of tokens. Copy the token to the clipboard and paste it into the Token field of SmartGit's GitHub configuration dialog.

Developer Application

To use SmartGit's OAuth authentication with your GitHub Enterprise instance, SmartGit has to be configured as Developer Application in your GitHub Enterprise instance. This can be done by every GitHub Enterprise user, from the Personal Settings, OAuth Applications, Developer Applications.

You have to provide an Application name, a Homepage URL and the Authorization callback URL to which GitHub Enterprise will redirect during authentication and pass the generated token to.

GitHub will automatically create a Client ID and a Client Secret which have to be passed to SmartGit using system properties smartgit.github.enterprise.oauth.id and smartgit.github.enterprise.oauth.secret. For the example application from the screenshot, this would be:

     smartgit.github.enterprise.oauth.id=0174f225fb6578a19e02

     smartgit.github.enterprise.oauth.secret=54a1f910b0c50c172a33938677ca91e4dad22a8d