2020-10-29 15:09:12 +00:00
---
2020-11-27 18:09:52 +00:00
stage: Create
group: Ecosystem
2020-11-26 06:09:20 +00:00
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2020-10-29 15:09:12 +00:00
---
2014-04-03 03:11:25 +00:00
# Google OAuth2 OmniAuth Provider
2017-10-05 16:15:12 +00:00
To enable the Google OAuth2 OmniAuth provider you must register your application
2020-11-19 18:09:13 +00:00
with Google. Google generates a client ID and secret key for you to use.
2017-10-05 16:15:12 +00:00
## Enabling Google OAuth
In Google's side:
1. Navigate to the [cloud resource manager ](https://console.cloud.google.com/cloud-resource-manager ) page
2017-10-06 12:41:43 +00:00
1. Select **Create Project**
2017-10-05 16:15:12 +00:00
1. Provide the project information:
2019-07-11 15:21:26 +00:00
- **Project name** - "GitLab" works just fine here.
- **Project ID** - Must be unique to all Google Developer registered applications.
Google provides a randomly generated Project ID by default. You can use
the randomly generated ID or choose a new one.
2017-10-05 16:15:12 +00:00
1. Refresh the page and you should see your new project in the list
1. Go to the [Google API Console ](https://console.developers.google.com/apis/dashboard )
2019-09-29 18:06:11 +00:00
1. Select the previously created project in the upper left corner
2017-10-06 12:41:43 +00:00
1. Select **Credentials** from the sidebar
1. Select **OAuth consent screen** and fill the form with the required information
1. In the **Credentials** tab, select **Create credentials > OAuth client ID**
2017-10-05 16:15:12 +00:00
1. Fill in the required information
2019-07-11 15:21:26 +00:00
- **Application type** - Choose "Web Application"
- **Name** - Use the default one or provide your own
- **Authorized JavaScript origins** -This isn't really used by GitLab but go
ahead and put `https://gitlab.example.com`
- **Authorized redirect URIs** - Enter your domain name followed by the
callback URIs one at a time:
2020-03-25 06:07:58 +00:00
```plaintext
2019-07-11 15:21:26 +00:00
https://gitlab.example.com/users/auth/google_oauth2/callback
https://gitlab.example.com/-/google_api/auth/callback
```
2014-04-24 22:48:22 +00:00
2017-10-06 12:41:43 +00:00
1. You should now be able to see a Client ID and Client secret. Note them down
2020-11-19 18:09:13 +00:00
or keep this page open as you need them later.
2018-04-27 03:12:47 +00:00
1. To enable projects to access [Google Kubernetes Engine ](../user/project/clusters/index.md ), you must also
enable these APIs:
- Google Kubernetes Engine API
- Cloud Resource Manager API
- Cloud Billing API
2014-04-24 22:48:22 +00:00
2019-09-30 09:06:31 +00:00
To do so you need to:
1. Go to the [Google API Console ](https://console.developers.google.com/apis/dashboard ).
1. Click on **ENABLE APIS AND SERVICES** button at the top of the page.
1. Find each of the above APIs. On the page for the API, press the **ENABLE** button.
It may take a few minutes for the API to be fully functional.
2017-10-05 16:15:12 +00:00
On your GitLab server:
2014-04-24 22:48:22 +00:00
2017-10-05 16:15:12 +00:00
1. Open the configuration file.
2015-02-13 22:49:19 +00:00
2019-07-11 15:21:26 +00:00
For Omnibus GitLab:
2015-02-13 22:49:19 +00:00
2020-01-30 15:09:15 +00:00
```shell
2019-07-11 15:21:26 +00:00
sudo editor /etc/gitlab/gitlab.rb
```
2015-02-13 22:49:19 +00:00
2019-07-11 15:21:26 +00:00
For installations from source:
2014-04-24 22:48:22 +00:00
2020-01-30 15:09:15 +00:00
```shell
2019-07-11 15:21:26 +00:00
cd /home/git/gitlab
sudo -u git -H editor config/gitlab.yml
```
2014-04-24 22:48:22 +00:00
2017-10-05 16:15:12 +00:00
1. See [Initial OmniAuth Configuration ](omniauth.md#initial-omniauth-configuration ) for initial settings.
1. Add the provider configuration:
2015-02-13 22:49:19 +00:00
2019-07-11 15:21:26 +00:00
For Omnibus GitLab:
2015-02-13 22:49:19 +00:00
2019-07-11 15:21:26 +00:00
```ruby
gitlab_rails['omniauth_providers'] = [
{
"name" => "google_oauth2",
"app_id" => "YOUR_APP_ID",
"app_secret" => "YOUR_APP_SECRET",
"args" => { "access_type" => "offline", "approval_prompt" => '' }
}
]
```
2014-04-24 22:48:22 +00:00
2019-07-11 15:21:26 +00:00
For installations from source:
2014-04-03 03:11:25 +00:00
2019-07-11 15:21:26 +00:00
```yaml
2020-10-02 06:08:27 +00:00
- { name: 'google_oauth2',
app_id: 'YOUR_APP_ID',
app_secret: 'YOUR_APP_SECRET',
args: { access_type: 'offline', approval_prompt: '' } }
2019-07-11 15:21:26 +00:00
```
2014-04-03 03:11:25 +00:00
2017-10-05 16:15:12 +00:00
1. Change `YOUR_APP_ID` to the client ID from the Google Developer page
1. Similarly, change `YOUR_APP_SECRET` to the client secret
2020-11-19 18:09:13 +00:00
1. Make sure that you configure GitLab to use a fully-qualified domain name, as Google doesn't accept
2017-10-05 16:15:12 +00:00
raw IP addresses.
2017-06-08 11:51:44 +00:00
2019-07-11 15:21:26 +00:00
For Omnibus packages:
2017-06-08 11:51:44 +00:00
2019-07-11 15:21:26 +00:00
```ruby
external_url 'https://gitlab.example.com'
```
2017-06-08 11:51:44 +00:00
2019-07-11 15:21:26 +00:00
For installations from source:
2017-06-08 11:51:44 +00:00
2019-07-11 15:21:26 +00:00
```yaml
gitlab:
host: https://gitlab.example.com
```
2017-06-08 11:51:44 +00:00
2019-07-11 15:21:26 +00:00
1. Save the configuration file.
2020-04-06 12:10:44 +00:00
1. [Reconfigure ](../administration/restart_gitlab.md#omnibus-gitlab-reconfigure ) or [restart GitLab ](../administration/restart_gitlab.md#installations-from-source ) for the changes to take effect if you
2019-07-11 15:21:26 +00:00
installed GitLab via Omnibus or from source respectively.
2014-04-03 03:11:25 +00:00
2017-10-05 16:15:12 +00:00
On the sign in page there should now be a Google icon below the regular sign in
2020-11-19 18:09:13 +00:00
form. Click the icon to begin the authentication process. Google asks the
2017-10-05 16:15:12 +00:00
user to sign in and authorize the GitLab application. If everything goes well
2020-11-19 18:09:13 +00:00
the user is returned to GitLab and is signed in.