Configure Identity Provider (IdP)

Note
This section is only available for Sonatype Cloud.

1. In my.sonatype.com, navigate to Settings → Organizations, and select the Organization you'd like to manage.

2. Select the Identity Management tab.

3. Select the Connect IDP button and follow the on-screen instructions to link your instance’s URL to your IdP.

After setting up an IdP, you can remove it or edit it from this tab.

Select the Enable Identity Provider Groups checkbox to manage access via IdP groups rather than individual users.

Note that you also need to configure your specific IdP to send group membership (for example, a groups claim) in its token/assertion. If the IdP isn’t configured (or permissions/consent are missing), group sync may fail and users may see an IdP permissions error during sign-in.

Configuring Specific IdPs

Note
Sonatype’s self-service single sign-on (SSO) is powered by Auth0. For background and the most up-to-date details, see Auth0’s official documentation:

• How self-service SSO works

• Enterprise identity providers supported by Auth0

Microsoft Entra ID

Note
For provider-specific configuration details and troubleshooting, see Auth0’s official documentation for Microsoft Entra ID / Azure AD Enterprise connections.

Step-by-Step Entra ID Instructions

Step 1: Create Application

To connect your Entra ID tenant as an identity provider, you must create an OIDC application.

1. Navigate to App Registration. Then, select New Registration.

2. Enter a name for the application.

3. Under Selected account types, choose Accounts in this organization directory only (Default Directory only - Single tenant).

4. Select Register.

5. Copy your Application (client) ID. You will use it in the next step to configure your connection.

6. Under Redirect URIs, select Add a Redirect URI.

7. Under Platform Configurations, select Add a platform and choose Web as the platform.

8. Add the Callback URL in the Redirect URIs field.
   Callback URL. https://identity.sonatype.com/login/callback

9. Select Configure.

10. Select Certificates & secrets in the left-hand navigation, and then select New client secret.

11. Enter a Description and set the expiration.

12. Click Add then copy the Value.

13. Click Add then copy the client secret Value.

Step 2: Configure Connection

Establish a connection between your identity provider and Sonatype.

1. Open the organization to set up an IdP.

2. Click the Identity Provider tab.

3. Click the Connect IDP button, and select Entra ID.

Microsoft Entra ID Domain

Your Entra ID domain (e.g., example.onmicrosoft.com).

Client ID

The Application (client) ID you copied from the Azure portal.

Client Secret

The client secret value you copied from the Azure portal.

Step 3: Claims Mapping

Claims mapping ensures that the correct user attributes are applied from the identity provider to the service provider.

Required Claims. Add the following claims in Entra ID:

• groups - Groups the user belongs to. They can be used from product to assigning product roles.
• email - User's email address.

Optional Claims. Your users will be able to log in without mapping these claims but providing them will enhance the end user experience:

• family_name - User's last name
• given_name - User's first name
• name - User's full name

Note
For more information on adding claims, see Microsoft's documentation.

Step 4: Assign Access

Grant users or groups access to Sonatype.

1. Navigate to Enterprise applications and select the application you created. Then, select User and groups.

2. Select Add user/group.

3. Under Users, select None selected.

4. Select the users you want to assign access to this application.

5. Click Select.

6. Select Assign.

Step 5: Test SSO and Enable Connection

Test the connection to ensure SSO setup is successful.

1. Select Test Connection. This will open a new window and redirect you to log in with Entra ID. You'll receive an OIDC response in return.

Important
Please do not close out the window while testing.

2. After successfully testing the connection, select Enable Connection to activate SSO for your organization.

Notes for Configuring Entra ID

• As part of the onscreen setup you will be prompted to add Group Claims and Optional Claims. Refer to Microsoft Entra documentation for detailed guidance.
• The Identity Provider Groups feature requires the following Entra ID configuration:

1. After selecting your application, go to Manage > API Permissions > Add a Permission to open the Request API Permissions drawer.

2. Under the APIs my organization uses tab, select Microsoft Graph

3. Select Delegated Permissions. In the Select Permissions search bar, type Directory.Read.All. Then, expand the Directory section, check Directory.Read.All, and select Add permissions.

Note
After adding permissions, ensure your tenant admin grants consent if required by your organization’s policy.

Okta

Note
For provider-specific configuration details and troubleshooting, see Auth0’s official documentation for Okta Enterprise connections.

These steps assume you’ve already created a new IdP configuration in my.sonatype.com, and you’re now entering the corresponding values in your IdP admin console.

Step-by-Step Okta Instructions

Step 1: Create Application

To connect your Okta tenant as an identity provider, you must create an OIDC application.

1. Select Applications > Applications, and Create App Integration.

2. Select Create New App.

3. Choose OIDC as the Sign-in method. Choose Web Application as your Application Type.

4. Select Next.

5. Enter your App integration name.

6. Add the callback URL in the Sign-in redirect URIs field. Callback URL. https://identity.sonatype.com/login/callback

7. Select Save. Make sure to copy your Client ID and Client Secret as you will use them in the next step to configure your Okta connection.

Step 2: Configure Connection

Establish a connection between Okta and Sonatype.

1. Open the organization to set up an IdP.

2. Click the Identity Provider tab.

3. Click the Connect IDP button, and select Okta.

Okta Domain

Enter your Okta domain (e.g., domain-name.okta.com).

For help finding your Okta domain, see: Where do I find the Okta domain?

Client ID

Unique identifier for the client application or service integration.

For help finding your Client ID, see: Where do I find the Client ID?

Client Secret

Confidential token used for client authentication.

For help finding your Client Secret, see: Where do I find the Client Secret?

Step 3: Claims Mapping

Claims mapping ensures that the correct user attributes are applied from the identity provider to the service provider.

Required Claims. Add the following claims in Okta:

• groups
• email

Important
When configuring the groups claim in Okta, ensure that the claim is returned as a comma-separated string, not as a JSON array. If Okta returns groups as an array, users may authenticate successfully but receive no external role mappings.

Optional Claims. Your users will be able to log in without mapping these claims but providing them will enhance the end user experience:

• family_name
• given_name
• name

Step 4: Assign Access

Grant users or groups access to Sonatype.

1. Select Assignments in the horizontal tabs within the application you just created in Okta.

2. Select Assign, then Assign to Groups.

3. Select Assign for the groups you want to assign access to this application.

4. Select Done

Step 5: Test SSO and Enable Connection

Test the connection to ensure SSO setup is successful.

1. Select Test Connection. This will open a new window and redirect you to log in with Okta. You'll receive an OIDC response in return.

Important
Please do not close out the window while testing.

2. After successfully testing the connection, select Enable Connection to activate SSO for your organization.

Google Workspace

Note
For provider-specific configuration details and troubleshooting, see Auth0’s official documentation for Google Workspace / Google SSO Enterprise connections.

Step 1: Create Application

To connect your Google tenant as an identity provider, you must create an OIDC application.

1. Go to the Google Developer Console and choose the project to add your new application to or create a new project.

2. Select APIs & Services from the dashboard, then Credentials in the left-hand navigation.

3. Click Create Credentials and select OAuth client ID.

4. Choose Web application as your Application type.

5. Enter a Name for the application and add the Authorized Javascript Origins and Authorized Redirect URIs below. Authorized Javascript Origins URI. https://identity.sonatype.com Authorized Redirect URI. https://identity.sonatype.com/login/callback

6. Select Create.

7. Make sure to copy your Client ID and Client secret as you will use them in the next step to configure your Google connection.

Step 2: Configure Connection

Establish a connection between Google Workspace and Sonatype.

1. Open the organization to set up an IdP.

2. Click the Identity Provider tab.

3. Click the Connect IDP button, and select Google Workspace.

Google Workspace Domain.

Your Google Workspace domain (e.g., example.com).

For more information, see Where do I find the Google Workspace Domain?

Client ID.

Copy the client ID you created in the Google Cloud Console (API & Services → Credentials).

Client Secret.

Copy the corresponding Client Secret from the Credentials page.

Step 3: Assign Access

Grant users or groups access to Sonatype.

1. Go to the Google Admin Console and select Directory > Organizational units in the left-hand navigation.

2. If applicable, select Create organizational unit to create a unit under your primary unit.

3. Go to Directory > Users and add a new user or select an existing one.

4. Within the selected user, click Change organizational unit and choose the applicable unit.

5. Go to Security > Access and data control > API controls in the left-hand navigation and click Manage Third-Party App Access.

6. Select Add app, then OAuth App Name Or Client ID.

7. Paste the client ID from the application you created in the Search for OAuth app name or client ID field and Search.

8. Click Select on your application.

9. Click on the selected app and Access to Google data to assign organization units access and Save.

Step 4: Test SSO and Enable Connection

Test the connection to ensure SSO setup is successful.

1. Select Test Connection. This will open a new window and redirect you to log in with Google Workspace. You'll receive an OIDC response in return.

Important
Please do not close out the window while testing.

2. After successfully testing the connection, select Enable Connection to activate SSO for your organization.

PingFederate

Note
For provider-specific configuration details and troubleshooting, see Auth0’s official documentation for PingFederate Enterprise connections.

Step 1: Create SP Connection

To connect your PingFederate tenant as an identity provider, you must create a SAML SP connection.

1. Select Applications in the top navigation, then SP Connections.

2. Select Create Connection.

3. Select Do not use a template for this connection, then Next.

4. Select Browser SSO Profiles and SAML 2.0 as the Protocol, then click Next.

5. Proceed to the General Info page and enter the following Partner's Entity ID and a custom Connection Name. Partner's Entity ID. urn:auth0:sonatype:self-service-demo-trial

6. Select Next.

Step 2: Configure Browser SSO

To connect your PingFederate tenant as an identity provider, you must configure browser SSO.

1. You should now be on the Browser SSO page.

2. Select Configure Browser SSO.

3. Under Single Sign-On (SSO) Profiles, select SP-INITIATED SSO, then click Next.

Step 3: Configure Assertion Creation

To connect your PingFederate tenant as an identity provider, you must configure assertion creation.

1. Proceed to the Assertion Creation page and select Configure Assertion Creation.

2. On the Identity Mapping page, make sure STANDARD is selected, then click Next.

3. On the Attribute Contract page, select the SAML_SUBJECT as urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.

4. Under Extend the Contract, enter the following attributes and map them to the relevant Attribute Name Format. Click Add for each attribute.

Required Attributes. Map the following attribute statements in your identity provider:

groups

Groups the user belongs to. They can be used from product to assigning product roles.

email

User's email address.

Optional Attributes. Your users will be able to log in without mapping these attributes but providing them will enhance the end user experience:

family_name User's last name

given_name User's first name

name User's full name

5. Select Next.

6. On the Authentication Source Mapping page, select Map New Adapter Instance.

7. Select an existing Adapter Instance or create a new one.

8. Proceed with configurations relevant to your organization's authentication requirements, then select Done on the last page.

9. You should now be back on the Authentication Source Mapping page.

10. Select Map New Authentication Policy.

11. Select an existing Authentication Policy Contact or create a new one by selecting Manage Policy Contacts.

12. On the Mapping Method page, make sure USE ONLY THE AUTHENTICATION POLICY CONTRACT VALUES IN THE SAML ASSERTION is selected, then click Next.

13. On the Attribute Contract Fulfillment page, map each Attribute Contract to the corresponding Value.

14. Select Next. Then, proceed to the Summary and select Done.

Step 4: Configure Protocol Settings

To connect your PingFederate tenant as an identity provider, you must configure protocol settings.

1. On the Protocol Settings page, select Configure Protocol Settings and click Next.

2. On the Assertion Consumer Service URL page, add the following endpoint URL: Endpoint URL. https://identity.sonatype.com/login/callback?connection=self-service-demo-trial

3. Set the Binding to POST as the default, and ensure Allowable SAML Bindings includes both POST and REDIRECT.

4. Select Next through the remaining protocol settings screens, accepting the defaults.

Step 5: Configure Credentials

To connect your PingFederate tenant as an identity provider, you must configure credentials.

1. On the Credentials page, select Configure Credentials and click Next.

2. On the Digital Signature Settings page, ensure the Signing Certificate is selected.

3. Verify that Include the certificate in the signature element is checked.

4. Select Next.

5. Review the summary and select Next.

6. On the Activation & Summary page, set the connection to Active and select Save.

Step 6: Configure Connection

Establish a connection between your identity provider and Sonatype.

1. Open the organization to set up an IdP.

2. Click the Identity Provider tab.

3. Click the Connect IDP button, and select PingFederate.

Single Sign-On Login URL

Endpoint for initiating secure authentication in SAML SSO connections.

To obtain the Single Sign-On Login URL, navigate to the SP Connections page and select Export Metadata. Look for the SingleSignOnService assertion tag in the metadata and copy the associated URL.

Example: https://your.PingFederate.server/idp/SSO.saml2

Signing Certificate

Digital credential used for secure identity authentication.

To obtain the Signing Certificate, navigate to SP Connections > SP Connection > Credentials > Certificate Management and select Export.

Advanced Settings. The following advanced settings are available for customizing your SAML connection:

Sign Request

When enabled, the SAML authentication request will be signed. Download the certificate and provide it to the SAMLP that will receive the signed assertion to validate the signature.

Custom OIDC

Note
For generic OIDC setup guidance (endpoints, scopes, claims, redirect URI rules), see Auth0’s official documentation for Custom OIDC (generic OpenID Connect) Enterprise connections.

Step 1: Create an Application

Create a generic OIDC application in your identity provider.

• Copy and paste the Callback URL in the corresponding field in your identity provider. Callback URL. https://identity.sonatype.com/login/callback

Destination where authentication and authorization responses are received, enabling secure user access handling. Also known as: Sign-in Redirect URI, Login Redirect URI.

Step 2: Configure Connection

Establish a connection between your identity provider and Sonatype.

1. Open the organization to set up an IdP.

2. Click the Identity Provider tab.

3. Click the Connect IDP button, and select OIDC.

OpenID Provider Configuration Endpoint

Enter the URL of the discovery document of the OpenID Connect provider you want to connect with.

Example: https://example.com/.well-known/openid-configuration

Communication Channel

Select whether authentication exchanges occur via server-to-server communication (Back Channel) or through the browser using Implicit Flow with Form Post (Front Channel).

Client ID

Unique identifier for client application or service integration.

Client Secret

Confidential token used for client authentication.

Custom SAML

Note
For generic SAML setup guidance (ACS/SSO URL, Entity ID, certificate, attribute mappings), see Auth0’s official documentation for Custom SAML Enterprise connections.

Step 1: Create an Application

Create a generic SAML application in your identity provider.

• Copy and paste the Single Sign-On URL and the Service Provider Entity ID in the corresponding field in your identity provider. Single Sign-On URL. https://identity.sonatype.com/login/callback?connection=self-service-demo-trial Service Provider Entity ID. urn:auth0:sonatype:self-service-demo-trial

Step 2: Configure Connection

Establish a connection between your identity provider and Sonatype.

1. Open the organization to set up an IdP.

2. Click the Identity Provider tab.

3. Click the Connect IDP button, and select SAML.

Metadata URL

Location to retrieve SAML SSO connection information for integration.

Example: https://example.com/samlp/metadata.xml

Advanced Settings. The following advanced settings are available for customizing your SAML connection:

Sign Request

When enabled, the SAML authentication request will be signed. Download the certificate and provide it to the SAMLP that will receive the signed assertion to validate the signature. This needs to be enabled first in the SAMLP. Once enabled, share the metadata URL for integration.

Request Protocol Binding

Choose between HTTP-Post or HTTP-Redirect for the SAML request protocol binding.

Note
For SAML connections, ensure the SAML assertion includes email as a required field. Users won’t be able to authenticate if email is missing.