Configure SAML-based single sign-on between a custom identity provider and CodeRabbit from your organization’s account management page.
Use this guide to configure a SAML 2.0 identity provider that is not covered by a provider-specific CodeRabbit guide. The account management SSO wizard provides the CodeRabbit service provider values, expected SAML attributes, metadata configuration step, test flow, and activation step.After SSO is activated, users with a verified email domain must sign in to CodeRabbit through your identity provider.
Critical: You must have an invitation to your CodeRabbit organization from your CodeRabbit account team before starting this setup.
Organization admin access in the CodeRabbit account management page
Administrator access to your identity provider
Permission to create and configure SAML 2.0 applications in your identity provider
Access to your DNS provider if your email domain still needs verification
The users, groups, or organizational units that should be allowed to sign in through SSO
If you do not see the Security section or the Start configuration button in your organization profile, contact your CodeRabbit account team. Your organization must be prepared for self-serve SSO before the account management SSO wizard appears.
Accept your CodeRabbit organization invitation and sign in to the account management page. Open the organization switcher, find the invited organization, and click Manage.In the organization profile, select Security, and click Start configuration.
Start SSO configuration from the Security section
2
Add and verify your email domain
In Domains, enter the email domain that should use your identity provider for CodeRabbit sign-in, then click Add.If the wizard asks you to add a DNS record, add the generated TXT record in your DNS provider and wait for the domain to show Verified before continuing.
Continue after the email domain shows Verified
3
Select Custom SAML Provider
In Connection, select Custom SAML Provider as the identity provider.
Select Custom SAML Provider as the identity provider
4
Create a SAML app in your identity provider
In your identity provider, create a new SAML 2.0 application for CodeRabbit. Use a clear app name such as CodeRabbit.Copy the CodeRabbit service provider values from the account management SSO wizard into the matching fields in your identity provider:
Identity provider field
Value
Assertion consumer service URL, ACS URL, single sign-on URL, or reply URL
Copy the Assertion consumer service (ACS) URL from the account management SSO wizard
Entity ID, audience URI, or SP Entity ID
Copy the Entity ID from the account management SSO wizard
Name ID or subject
Use the user’s primary email address if your identity provider requires this field
Copy the service provider values into your SAML application
5
Map SAML attributes
Configure your identity provider so the SAML response includes the attributes CodeRabbit expects. Attribute names are case-sensitive.
Attribute name
User attribute
mail
Primary email
firstName
First name
lastName
Last name
The mail attribute is required. firstName and lastName are optional, but adding them helps CodeRabbit populate user profile details correctly.
Review the required and optional SAML attributes
6
Assign users or groups to the SAML app
In your identity provider, assign the users, groups, or organizational units that should be allowed to sign in to CodeRabbit through SSO.Users cannot complete SSO sign-in until they are assigned to the SAML application in your identity provider.
Assign users or groups before testing SSO
7
Add identity provider metadata
In your identity provider’s SAML application, retrieve the metadata URL.Return to the account management SSO wizard. In Configure identity provider metadata, keep Add via metadata selected, paste the metadata URL, and continue.If your identity provider does not provide a metadata URL, select Configure manually and enter the SAML metadata values from your identity provider.
Paste the metadata URL from your identity provider
8
Test the SSO connection
In Test, click Open test URL and complete the sign-in flow with a user who has access to the SAML app and whose email matches your verified domain.Return to the account management SSO wizard and click Refresh logs until the latest test result shows Success. Do not activate SSO while the latest result is Pending or failed.
Open the test URL and refresh logs until the result succeeds
9
Activate SSO
In Activate, review the activation message and click Activate SSO.
Activation changes sign-in behavior for the verified domain. After activation, users with that email domain must sign in to CodeRabbit through your identity provider.
