Ctrlk
SupportSnyk LearnAPI referenceProduct updatesSign up for free
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Set up single sign-on (SSO)

How to set up single sign-on (SSO) in Snyk API and Web

Learn how to configure your company's Single Sign-On to log in to the Snyk API & Web app.

Snyk API & Web uses the standard Security Assertion Markup Language (SAML) to exchange authentication and authorization information with an Identity Provider (IdP) to enable Single Sign-On (SSO) to the Snyk API & Web app. This means that if you have your company's SSO in place for your users to log in to your applications, you can also enable SSO to access the Snyk API & Web app.

When you do this, users from your account can choose the following option from the login screen to access Snyk API & Web:

Note:

  • If you already use SSO to log in to Snyk, you can log in to Snyk API & Web with your existing Snyk account, using the Log in with Snyk button:

  • If you already have a Snyk account but you do not use SSO, you can set up SSO with Snyk.

Learn more in Log in to Snyk API & Web.

The configuration of the SSO specific to Snyk API & Web involves two steps:

  1. Configure Snyk API & Web in your Identity Provider.

  2. Configure SSO in Snyk API & Web.

This article describes these steps in detail.

After you complete this setup, you can choose the following option from the login screen to access your account:

Step 1: Configure Snyk API & Web in your Identity Provider

In this first step, navigate to your Identity Provider and create an entry for Snyk API & Web using the following information:

  • Entity Identifier - The URL that identifies Snyk API & Web as the issuer of SAML requests, responses, or assertions: https://probely.com.

  • Assertion Consumer Service - The Snyk API & Web endpoint to do the SAML authentication and authorization: https://sso.plus.probely.app/sso/<organization-id>/complete/

In the endpoint, replace <organization-id> with a string that identifies your organization, using lowercase letters and hyphens only. For example, use the company name. If you need help, Snyk can suggest it for you.

  • Certificate - The SAML certificate for Snyk API & Web:

Step 2: Configure SSO in Snyk API & Web

With Snyk API & Web configured in your Identity Provider, the second part of the SSO configuration is on the Snyk API & Web side. For that, you must provide the following information:

  • Your Entity Identifier.

  • Your Certificate.

  • The URL of your SSO or the URL with the metadata.

  • The SAML claims with information about:

    • The first name.

    • The last name.

    • The email.

You can also map your SAML Groups to Snyk API & Web Roles and specific scopes (global to the account, a team, or a target). In this case, you must provide Snyk API & Web with the SAML claim with the information about the SAML Groups and tell Snyk API & Web how the mapping is done. Here is an example:

SAML Group
Snyk API & Web Role
Snyk API & Web Scope

probely_admin

Admin

Global (account)

teamX_admin

Admin

Team X

teamX_developers

Developer

Team X

portal_developers

Developer

Portal Target

This mapping produces the following results:

  • Users belonging to probely_admin receive Admin permissions to the whole Snyk API & Web account (global scope). They can view and take action on any target of your account.

  • Users belonging to the groups teamX_admin and teamX_developers only perform actions on targets of Team X, with permissions to do what the respective Admin and Developer roles allow.

  • Users belonging to portal_developers receive the permissions given by the Developer role and only perform actions on a single target: the Portal Target.

PreviousEnforce 2FA for all usersNextGenerate and use audit log reports

Last updated

Was this helpful?