Commit d9ade0ee authored by Gerardo Gutierrez's avatar Gerardo Gutierrez Committed by Evan Read

Update NameID format recommendation

parent 50deb225
...@@ -57,6 +57,7 @@ Once users have signed into GitLab using the SSO SAML setup, changing the `NameI ...@@ -57,6 +57,7 @@ Once users have signed into GitLab using the SSO SAML setup, changing the `NameI
#### NameID Format #### NameID Format
We recommend setting the NameID format to `Persistent` unless using a field (such as email) that requires a different format. We recommend setting the NameID format to `Persistent` unless using a field (such as email) that requires a different format.
Most NameID formats can be used, except `Transient` due to the temporary nature of this format.
### Assertions ### Assertions
...@@ -489,12 +490,13 @@ If you do not wish to use that GitLab user with the SAML login, you can [unlink ...@@ -489,12 +490,13 @@ If you do not wish to use that GitLab user with the SAML login, you can [unlink
### Message: "SAML authentication failed: User has already been taken" ### Message: "SAML authentication failed: User has already been taken"
The user that you're signed in with already has SAML linked to a different identity. The user that you're signed in with already has SAML linked to a different identity, or the NameID value has changed.
Here are possible causes and solutions: Here are possible causes and solutions:
| Cause | Solution | | Cause | Solution |
| ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| You've tried to link multiple SAML identities to the same user, for a given identity provider. | Change the identity that you sign in with. To do so, [unlink the previous SAML identity](#unlinking-accounts) from this GitLab account before attempting to sign in again. | | You've tried to link multiple SAML identities to the same user, for a given identity provider. | Change the identity that you sign in with. To do so, [unlink the previous SAML identity](#unlinking-accounts) from this GitLab account before attempting to sign in again. |
| The NameID changes everytime the user requests SSO identification | Check the NameID is not set with `Transient` format, or the NameID is not changing on subsequent requests.|
### Message: "SAML authentication failed: Email has already been taken" ### Message: "SAML authentication failed: Email has already been taken"
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment