Connection & Authentication
ARM SSO Certificate Rotation
Service Notice: Metadata Download Issue: We are currently investigating an issue where downloading the SAML metadata file from within ARM results in an empty file. Please note: a link in the format https://[your-instance].autorabit.com/?basic-auth=true/saml/metadata was previously shared, but this should be disregarded.
Workaround: Please replace [your-instance] with your own instance URL and use this format instead: https://[your-instance].autorabit.com/saml/metadata
You can determine your instance URL by checking the current URL you are using to access ARM.
Example: https://na1.autorabit.com/saml/metadata
We will update this banner once the issue is resolved. Thank you for your patience.
Overview
AutoRABIT will rotate its internal SSL certificate as part of routine maintenance. This impacts certain Single Sign-On (SSO) and Salesforce DX (SFDX) configurations in AutoRABIT.
Date: Saturday, August 23, 2025
Time: 12:00 AM PST
Expected Duration: ~1 hour
When to Take Action: After the maintenance window (from ~1:00 AM PST onward)
Who Needs to Take Action?
There are two scenarios where action is required:
1. Using SSO with SAML Encryption Enabled in Your Identity Provider (IDP)
Steps to Take:
Navigate to Admin > My Account > SSO Configuration in AutoRABIT.
Download the AutoRABIT SSO Metadata File.
Upload this metadata file to your IDP.
Impact if No Action Taken:
Users will be unable to log in to AutoRABIT via SSO.
How to Verify:
Contact your IDP administrator to confirm if SAML encryption is enabled.
2. Using the SFDX Module (DevHub Orgs)
Steps to Take:
Go to SFDX Module > Hub Management in AutoRABIT.
Select all registered DevHub Orgs.
Re-authenticate each org.
Impact if No Action Taken:
Automated CI jobs depending on DevHubs will fail to execute.
How do I download the SSO metadata file without access to the UI?
The SSO metadata file can be downloaded without access to the UI:
Enter the following format in your browser: https://<your-instanceURL>.autorabit.com/saml/metadata. For example, if your instance is https://pilot.autorabit.com/, then the payload URL would be https://pilot.autorabit.com/saml/metadata
Who Does Not Need to Take Action?
If you use SSO without SAML encryption enabled, and
You do not use the SFDX module or have DevHub orgs registered.
Additional Information
SFDX-enabled repositories are not impacted by this certificate rotation.
AutoRABIT will not issue a new SSO/SAML signing certificate.
The existing respective IDP generated certificate will continue to be used for SSO authentication.
This change only impacts AutoRABIT’s internal SSL certificates.
Support
If you have questions or face login issues after the rotation:
Contact AutoRABIT Support: [[email protected]]
Or reach out to your Customer Success Manager (CSM)
In Summary:
Action required only if you use SSO with SAML encryption or SFDX DevHub Orgs.
Perform the steps after August 23, 2025, 1:00 AM PST.
Not taking action will result in login failures (SSO) or failed CI jobs (SFDX).
Azure Hosting Migration
To our valued Customer,
AutoRABIT is working to modernize and standardize our infrastructure to provide a better experience for you, as we to innovate in our ARM product.
As part of that effort, we are deprecating our Azure hosting option in September in favor of our standard AWS hosting offering, now that AWS provides service in the UAE, and will be migrating all the services (which will impact your tenant).
This migration activity is planned for Sunday, September 28 (with a backup date of October 5), at 8:30AM (Dubai local time). The instance will be unavailable for up to 10 hours as we complete this activity.
We will also need your assistance to complete this migration.
Your action (right away – if applicable) :
Whitelist the following IP addresses for the new instance
o IP Addresses:
3.28.164.9 51.112.70.124
§ Only needed if you have whitelisting in place for the current instance (for security purposes, or if required for your Salesforce and GitHub, Gitlab, etc. related access)
We will be providing a new login URL for the new instance; the following will need to be done in the new instance, closer to the migration date.:
Your Actions in the new instance
Re-setup SSO if you are currently using it to access your account (KB article)
Re-setup your webhooks for the new URL (KB Article)
Reauthenticate your Salesforce Org (KB Article)
Share the new instance URL with your team
After the migration, they will need to use the new link to access their accounts.
What you need to know:
There is no change to the application, nor will your data/configurations be impacted.
During and post the migration activity, all data will stay in the UAE.
We will set up a meeting, closer to the migration date, to review and coordinate the activities we identified.
If you need any help with preparing for this change:
Technical assistance with completing any of the above activities, please submit a ticket via the support portal.
Questions or concerns about the migration, please contact your Account Manager.
How do I register GitHub repositories with two-factor authentication?
To use two-factor authentication in GitHub, create a personal access token first.
Create a personal access token and use it in place of a password when performing Git operations over HTTPS with GIT on the command line or the API. For detailed information, refer to https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token
Register your GitHub Repository in ARM using the same token.
How do I rectify the GOLDENDOODLE vulnerability?
Short-term solution: Disable support for CBC encryption ciphers. Follow the procedures below to disable weak ciphers:
Run the following command to list the ciphers: - sshd -T | grep ciphers | perl -pe 's/,/\n/g' | sort -u
Edit the file - /etc/ssh/sshd_config and add what strong ciphers you want to have or place in this file as shown in the example below- Ciphers aes128-ctr,aes192-ctr,aes256-ctr
Now, restart your sshd service using the command: service sshd restart
Long-term solution: Enable the TLS 1.3 protocol.
Why am I not able to authenticate JIRA with my account?
Make sure you are entering the JIRA API token in the Password field while registering your JIRA plugin for the first time in the ARM application.
How do I generate a new API token for JIRA?
Follow the steps below to generate a new API token for JIRA:
Go to the link: https://id.atlassian.com/manage/api-tokens.
Click on Create API Token and provide the label name and click on Create.
Once the token is created, you will be able to see the Your new API token popup. Click on the Copy to Clipboard.
Use the copied token as a password for creating/updating the credential in AutoRABIT.
Once updated please use the same credential to authenticate the JIRA.
How can I add a repository to AutoRABIT if one already exists?
Follow the below steps to register the repository:
Log in to your repository and click on Clone. It will give you an https and an ssh link.
To register the repository, copy the https link and paste it into ARM.
Make sure the repo clone you see before https isn't included in the link you paste in ARM.
Input the URL that begins with https.
How does an SSH Key differ from an SSH Certificate?
While SSH Key-based authentication uses public key cryptography, SSH Certificate-based authentication attaches a signed certificate to each key to verify identity. By using a certificate signed by a trusted Certificate Authority, users can do away with the passwords (which are not secure, given that passwords can either be stolen or cracked via brute force) and leverage a partially automated trust-based certificate authentication process to gain access to systems.
Why am I unable to register a GitHub repository using SSH keys and getting an 'invalid private key' error?
This is because you used invalid SSH keys to register your repository. Please use the correct SSH keys and try again.
How do I validate the 'src' folder under branch settings?
When you try to create a new branch you must validate the master branch's 'src' folder path, then select the parent branch as master, and the 'src' folder path will be automatically set to the newly created branch.
Last updated
Was this helpful?