How to Configure SAML 2.0 for Buildkite

Contents

• Supported Features
• Configuration Steps
• Notes

---

Supported Features

The Okta/Buildkite SAML integration currently supports the following features:

• SP-initiated SSO
• IdP-initiated SSO
• JIT (Just In Time) Provisioning

For more information on the listed features, visit the Okta Glossary.

---

Configuration Steps

1. Add the custom attributes admin and teams to the Buidkite application. In Okta, go to Directory > Profile Editor.

2. Search for your Buildkite app, then click the application icon:

   

3. Click Add Attribute, then enter the following:

   • Data type: Select boolean
   • Display name: Enter is Admin?
   • Variable name: Enter admin
   • Click Save and Add Another

   

   Note:

   Scope: If you check user personal, the current attribute will be available once you assign a single user to the Buildkite app and will not be available once you assign a group to the Buildkite app.

4. Enter the following:

   • Data type: Select string
   • Display name: Enter teams
   • Variable name: Enter teams
   • Click Save

   

5. Go to the Buildkite application configuration and assign the user on the Assignments tab.

6. Now you need to specify the admin and teams attributes:

   • Is Admin?: Select true, false, or leave undefined
   • teams: Enter the UUID of your Buildkite team from the REST API Integration section on the Team Settings page.

7. Log in to your Buildkite organisation as an administrator.

8. Go to Settings > Single Sign On.

9. Choose the Okta provider.



10. In the New Okta SSO Provider configuration, copy and paste the following into the Metadata URL field:

    Sign into the Okta Admin dashboard to generate this value.

11. Click Create Provider.



12. Done!

---

Notes

The following SAML attributes are supported:

Name	Value
name	user.firstName user.lastName
admin	appuser.admin
teams	appuser.teams

SP-initiated SSO

1. Go to https://buildkite.com/sso/[yourOrganizationName]

   Note: You can get your organization name from the Buildkite URL.

   For example: If you log into https://buildkite.com/organizations/acme/welcome/repository-provider

   Your organization name is acme and your SP-initiated SSO URL is https://buildkite.com/sso/acme

2. Click Sign in to Okta.