Issues with SAML SSO Setup

[ChristopherMank]

We just recently stood up SonarQube Developer Edition Version 9.8. We are trying to set up SAML SSO to Azure AD but are running into issues. Here is what we have configured so far:

• Reverse Proxy set up in IIS as described here.

• SAML SSO configured to Azure AD as described here.

• Server Base URL configured to: https://sonarqube.DOMAIN.com

When we click the Test Configuration button, we get the following error:

I’ve turned on DEBUG logging for the web.log and captured the SAML-specific entries. I don’t see any errors but only see one entry for SAML (log below).

Also worth noting that when I click on the Log in with SAML button on the login page, it attempts to login with a Loading page and then just comes back to the Log in with SAML button. We have double/triple checked all the settings in the IIS reverse proxy and Azure AD/SAML configuration. Are there other configurations that are needed to get this to work?

[ganncamp (G Ann Campbell)]

Hi,

Welcome to the community!

@ChristopherMank

When we click the Test Configuration button, we get the following error:

That suggests to me a misconfiguration. Per the docs:

verify that the configuration is correct by clicking on Test Configuration . A SAML login will be initiated and useful information about the SAML response obtained from the Identity provider will be returned.

You should double-check your IDP settings.

 
HTH,
Ann

[ChristopherMank]

After much searching through the community, this is what did it for me. This should be put in the main SonarQube documentation.

Single Sign-On (SSO) not going to Microsoft?

Colin is the MVP here, thankyou so much Colin! So in summary, I needed to perform 5 actions as follows: 1 - In IIS settings, under Application Request Routing > Proxy settings, uncheck the box “Reverse rewrite in response headers” 2 - In IIS settings, under URL Rewrite > View Server Variables, add HTTP_X_FORWARDED_PROTO as an allowed server variable. 3 - In IIS settings, under URL Rewrite > Edit inbound rule, add HTTP_X_FORWARDED_PROTO for https (I did this in addition to X_FORWARDED_PROTO). …

[kevin.hinz]

Hi @ChristopherMank,

Thanks for linking this together; your reply helped us cross-connect a few threads that will contribute to an improvement and formalization of Colin’s Community guide into a new docs article!