Migrating from LDAP to Okta

[Robert_Redd]

Must-share information (formatted with Markdown):

• which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension) - 10.3
• how is SonarQube deployed: Helm
• what are you trying to achieve - Migrate from LDAP to SAML (Okta)
• what have you tried so far to achieve this - Still in planning stage

I’ve been through the documentation and a few community posts on this subject. I just have a few more questions.

1. Do I need to comment out the LDAP configuration before I configure and start using the Okta SAML configuration or will the SAML configuration just take precedence once enabled?

2. Do the users get prompted on initial login to migrate their account to SAML if they already have an account associated with the older LDAP config?

3. I can use the api to migrate existing individual LDAP users over to SAML automatically, but I’m assuming I only need to do that if I don’t want them to be prompted on next login if they already exist with an LDAP association. Is that correct?

[Colin]

Hey there.

@Robert_Redd

1. Do I need to comment out the LDAP configuration before I configure and start using the Okta SAML configuration or will the SAML configuration just take precedence once enabled?

A button will appear that allows users to login with SAML once you’ve enabled it! And the rest of the login will fall under a “more options” button.

@Robert_Redd

• Do the users get prompted on initial login to migrate their account to SAML if they already have an account associated with the older LDAP config?
• I can use the api to migrate existing individual LDAP users over to SAML automatically, but I’m assuming I only need to do that if I don’t want them to be prompted on next login if they already exist with an LDAP association. Is that correct?

You, the admin, must migrate the users before they can login with SAML. SonarQube doesn’t identify the user is the same and help out. This guide I wrote should help.

Migrating SonarQube Users Between Identity Providers (with a focus on LDAP → SAML)

Introduction SonarQube allows delegating authentication to a number of Identity Providers (LDAP, SAML, GitHub, GitLab, etc). It can happen that after some time, a SonarQube administrator may need to change the Identity Provider that their users authenticate with. In particular, there are many organizations making the switch from LDAP Authentication to SAML Authentication for their applications. This guide aims to make it clear how to migrate those users from one Identity Provider to another, f…

[Robert_Redd]

@Colin Thanks for the responses. That clears it up.

• Robert