Integrating a SAML 2.0 Identity Provider

Coverity on Polaris
Version
latest
SAML authentication allows users to log in to Coverity on Polaris using an identity provider's single sign-on (SSO) authentication service. The organization administrator is responsible for enabling SAML authentication. SAML (Security Assertion Markup Language) is a standard for messages between service providers (like Coverity on Polaris) and identity providers like Okta to support user authentication.

Enabling SAML authentication requires the following.

  • The service provider gives information about itself to the identity provider.
  • The identity provider gives information about itself to the service provider.
In the present case, the service provider is Coverity on Polaris, and the identity provider is any provider that implements SAML 2.0 authentication. When each party has valid information about the other, SAML authentication is enabled, and the user can sign in using whatever password authenticates them in their normal work context, without having to create a special password for Coverity on Polaris.
Note: Once the Service Provider metadata is updated it takes 10 minutes for the changes to take effect.
  1. Log in to the identity provider.
  2. Retrieve the following metadata from the identity provider.
    • Single sign-on URL
    • Identity provider issuer
    • Organization email domain
    • Public vendor certificate in PEM format

    Generally all the of above can be obtained by downloading an XML metadata file.

    Warning: The certificate created by your identity provider will expire after a period of time. Schedule periodic rotation of SAML certificates. When updating the certificates, you must repeat this procedure from start to finish, with the exception that you are updating the IP record rather than creating it.
  3. Log in to Coverity on Polaris and select MY ORGANIZATION > SAML 2.0
  4. If you need to download information about the service provider (Coverity on Polaris), you can do so here. You might need to do this to provide the information to your identity provider.

    The information available from Coverity on Polaris includes the following.

    • Service provider metadata
    • A certificate for Coverity on Polaris
    • A signing request for Coverity on Polaris
  5. Click the + Add button.
  6. Enter the information that you have gathered from the provider in the form.
    For more information about what data to use for each field, see the topic Completing the Form: Add SAML Account

    This form must be completed to add a SAML account.
  7. Verify that you want Coverity on Polaris to inherit groups from your SAML provider. When this option is checked in the form described above, you will not be able to create groups through Coverity on Polaris without turning the feature off and will rely on your SAML provider as the source of truth for group membership. The default state for this feature is "on".

    Check the box to sync with your SAML provider.

    Please note that when inheritance is checked "on":

    • Users can be removed from groups, if they were not added through your SAML identity provider.
    • Groups created in Coverity on Polaris before or after inheritance was turned on will become empty as soon as Coverity on Polaris communicates with the identity provider.
  8. Click Save.

When SAML configuration is complete, users who log in with an email address that has a domain corresponding to the identity provider will be seamlessly passed off to the identity provider to complete logging in. Users do not have to be explicitly created in Coverity on Polaris; they can be managed in the identity provider solution instead.

Note: Users might not be visible on Coverity on Polaris to the Organization Administrator until the first time they log in. Information related to a user is transmitted from the IDP after the first sign-in.