title: Configuring GitLab to use SAML OmniAuth with an Active Directory IdP
body: <p>I am in the process of altering an existing <code>GitLab</code> installation to use <code>SAML</code> rather than <code>LDAP</code> for authentication. </p>
  
  <p>At this point, users can successfully sign into the Web application using the 'Sign in with Saml' button. I am unclear, however, about what seems to be a difference between the LDAP and SAML approaches: users with accounts created via an LDAP sign-in can then access Git repositories (e.g. using clone, push, ...) using their LDAP usernames and passwords, but users with accounts created via a SAML sign-in cannot. </p>
  
  <p>Through experimentation, I’ve found that users can access the Git repositories if they use the GitLab UI to set a separate GitLab account password on the account that is created during the initial <code>SAML</code> interaction. I was pointed in this direction by a GitLab message that appeared after creating a project under one of the new user accounts: 'You won't be able to pull or push project code via HTTPS until you set a password on your account'. </p>
  
  <p>It seems possible that this separate password configuration is only necessary because I’ve misconfigured the SAML integration somehow. So, my question is whether I am wrong to expect that authenticating access to the GitLab-hosted Git repositories would work the same regardless of whether <code>SAML</code> or <code>LDAP</code> is used? If not, does anyone know of relevant SAML configuration settings that I should review?</p>
  
  <p>In case it’s of interest: I have posted a similar question to the <code>GitLab Google</code> group, but I have not received any responses there yet.</p>