Use Security Assertion Markup Language (SAML) single sign-on (SSO) to authenticate users in a private Polygraph deployment. Your identity provider verifies the user's identity, then sends a signed SAML response to Polygraph.
Authentication and repository access
Section titled “Authentication and repository access”SAML controls who can sign in to Polygraph. Repository access still follows the user's permissions in your version control system (VCS). A user must pass both checks:
- The identity provider must authenticate the user.
- The user must have access to the repository through the VCS provider.
Disabling either source prevents new access, but it doesn't revoke credentials that Polygraph has already issued.
Offboard a user
Section titled “Offboard a user”A complete offboarding flow closes existing access and prevents the user from signing in again:
- Deactivate or unassign the user in the identity provider.
- Use Universal Logout to revoke the user's active Polygraph sessions and credentials.
- Remove the user from the relevant VCS organizations and repositories.
Universal Logout is optional. It sends a server-to-server request from the identity provider to Polygraph, so it doesn't depend on the user's browser being open. Polygraph revokes the user's browser sessions, CLI credentials, connector credentials, device authorizations, and cloud agent access.
Universal Logout isn't a replacement for System for Cross-domain Identity Management (SCIM). It doesn't provision users, synchronize groups, or delete user records and audit history.
Configure an identity provider
Section titled “Configure an identity provider”Polygraph currently documents SAML authentication and Universal Logout with Okta. See Okta SAML authentication for the setup steps.