Item	Details
Prior Confirmation	Prior configuration in GitLab is required. Members' "Last Name" and "First Name" are synced only when a new GitLab account is created. They are not synced on subsequent logins. For the latest setup instructions, please check the manual provided by GitLab.
Name ID	〇	Email address
		Custom attribute　Note: For instructions on how to configure a custom attribute, click here
SP-side Configuration	〇	Configured by the administrator
		Request configuration from the SP
Provisioning		Provisioning via API supported (account management possible in TrustLogin)
	〇	SAML JIT provisioning supported (account management possible in TrustLogin; user deletion not supported)
		None (accounts are created in each system)
Access Method	〇	SP-Initiated SSO
	〇	IdP-Initiated SSO
Verified Operation by Device	〇	PC - Browser
	ー	PC - Desktop App
	〇	iOS - Standard Browser (Safari)
	〇	iOS - TrustLogin Mobile App In-App Browser
	ー	iOS - Native App
	〇	Android - Standard Browser (Chrome)
	〇	Android - TrustLogin Mobile App In-App Browser
	ー	Android - Native App

TrustLogin Admin Page Settings

1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register App" button in the upper right of the screen.
   
   
   
2. Search on the "Register Company App" screen and select "GitLab (SAML)".
   
   
   
3. Note down the value of "Identity Provider URL" under "Identity Provider Information", and download the certificate using the "Get Certificate" button.
   
   
   
4. Change the file extension of the downloaded certificate to [.cer] and open the file.
   
   
   
   Note down the value of the "Thumbprint" field on the "Details" tab.
   

Now, switch to configuring GitLab.
Do not click the "Register" button yet — open GitLab in a separate window.

GitLab Settings

1. From the left menu, select the group for which you want to configure SSO, and open "Settings > SAML SSO".
   
   
   
2. Use the copy button to note down the values of "Assertion consumer service URL" and "Identifier" under "SAML Single Sign On".
   
   
   Note: The "GitLab single sign-on URL" is the URL used for SP-Initiated SSO. Note it down if needed.
   
   
3. Configure each item under "Configuration" as follows, and save with the "Save Changes" button.
   

   Enable SAML authentication for this group	Turn the checkbox ON
   Enforce SSO-only authentication for web activity for this group	Turn the checkbox OFF (recommended) Note: This setting controls whether users' authentication method is restricted to SSO only. If you want to restrict the login method to SSO only, we recommend leaving this OFF here and switching it ON after verifying that SSO works correctly and notifying your users.
   Identity provider single sign-on URL	The "Identity Provider URL" obtained from TrustLogin
   Certificate fingerprint	The value of the "Thumbprint" from the "Certificate" obtained from TrustLogin
   Default membership role	Select the role to be assigned by default to users newly created via user provisioning

   
   

Return to the TrustLogin Admin Page again.

TrustLogin Admin Page Settings (Continued)

1. Configure "Service Provider Settings" as follows.
   

   Entity ID	The "Identifier" obtained from GitLab
   ACS URL to Service	The "Assertion consumer service URL" obtained from GitLab

   
   
   
   
2. Save by clicking the "Register" button.

TrustLogin User Settings

① When a user adds the app from My Page

1. Click the "Add App" button on "My Page".
2. On the "Register App" screen, select "GitLab (SAML)" and click the "Next" button in the upper right of the screen.
3. If you want to change the "Display Name", enter it and click the "Register" button.

②When an administrator adds members

1. Search for and click the "GitLab (SAML)" app in the "Admin Page > App" menu.
2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.

Behavior on First SSO Login

For Members Already Registered in the SSO Target Group

The first time you perform SSO, you will need to authenticate using your GitLab account ID and password.
After authentication, a screen will appear requesting permission to sign in to the SSO target group. Click the "Authorize" button to continue.

For Members Not Yet Registered in the SSO Target Group

① If you have a GitLab account
When a member who is not yet registered in the SSO target group performs SSO for the first time, a group invitation confirmation email will be sent. Click the link in the email to log in with your GitLab account.


② If you do not have a GitLab account
If you do not have a GitLab account, you will receive a sign-up completion email. Clicking the "Confirm your account" link in the email will take you to the SSO screen for the group, allowing you to log in.