Documentation

Unity Version Control

DevOps

On-prem

Gluon

Editor plug-in

Open Unity Dashboard

Unity Version Control

Introduction to SAML authentication with Microsoft Entra ID

Understand how Unity Version Control On-Prem uses SAML authentication with Microsoft Entra ID, how SAML tokens work, and the steps to set it up.
Read time 2 minutesLast updated a day ago
Use the Security Assertion Markup Language (SAML) protocol to add Microsoft Entra ID single sign-on (SSO) as an identity provider for Unity Version Control (UVCS) On-Prem.
With SAML authentication, your team uses their existing Microsoft credentials to authenticate with UVCS in the command-line interface (CLI), the desktop application, and the web application. UVCS uses the Microsoft Graph API to read users and groups from Microsoft Entra ID.
For more information about SAML, refer to SAML authentication and SAML protocol (Microsoft).
Note
SAML authentication with Microsoft Entra ID is available from Unity Version Control On-Prem version 11.0.16.8622. This version enables SAML authentication by default and ignores the 
SAMLAuthenticationEnabled
feature flag.

SAML tokens

The SAML protocol targets web environments, so UVCS handles sessions differently from the standard SAML workflow.
When you authenticate, UVCS generates an internal token that you use to perform authenticated operations against your on-premises UVCS server. The token is valid for a set number of days, which is the absolute session duration. You can set a maximum duration for these tokens in your UVCS server settings.
To renew a token, authenticate against Microsoft Entra ID in your web browser. The desktop application prompts you to renew your token when it expires, and the CLI displays a link that you can open to renew it.
If a user becomes inactive in Microsoft Entra ID, or changes their password during an active UVCS session, UVCS automatically revokes the token.

SAML authentication setup

To set up SAML authentication, complete the following tasks in order:
  1. Configure Microsoft Entra ID for SAML authentication: Create an app registration, set up endpoints, create a client secret, and set Microsoft Graph API permissions.
  2. Configure the server for SAML authentication: Configure SAML on your UVCS server with the web administration console or command line.
  3. Configure clients for SAML authentication: Connect the CLI, desktop application, or Gluon to the server in SAML mode.

Additional resources