SSO/SAML

Follow these instructions to enable Enterprise Single Sign-On (SSO) with SAML via BoxyHQ for your Greptile application.

​

Prerequisites

Ensure the following services are operational:

• web (Greptile web application)
• jackson (BoxyHQ SSO service)

​

Configure Jackson Service

Set these environment variables for the Jackson service:

​

Set Up Database Entries

1. Log in to your PostgreSQL database.

2. Create or locate an existing Organization.

3. Generate an InternalApiKey:

   openssl rand -base64 36
   

4. Insert a new SamlConnection:

   • Set org_id to your Organization ID.
   • Set tenant_id to your user’s email domain (e.g., example.com).

​

Configure SSO Connection

1. Visit the Jackson admin console (https://sso.greptile.com).
2. Log in using admin credentials configured earlier.
3. Navigate to Enterprise SSO → Connections.
4. Click New Setup Link.
   • Set tenant to user’s email domain.
   • Set product as greptile.
   • Allowed redirect URL: https://app.greptile.com
   • Default redirect URL: https://app.greptile.com/login/saml
5. Generate the setup link.
6. Share the setup link with your customer for SSO provider configuration.

​

Completing SSO Setup

Once your customer has completed the configuration:

• Users can log in via their SSO provider at your web application.
• New SSO users will automatically be added to your Organization.

​

Testing

For local testing, use MockSAML with tenant set to example.com.

​

Important Notes

• AUTH_BOXYHQ_SAML_SECRET in your web service must match Jackson’s CLIENT_SECRET_VERIFIER and should not include special characters.