From 209619de7d012177214b7f970531c2ce4aab8610 Mon Sep 17 00:00:00 2001 From: Evan Read Date: Tue, 20 Nov 2018 15:36:07 +1000 Subject: [PATCH] Fix markdown to render correctly --- doc/integration/shibboleth.md | 144 +++++++++++++++++----------------- 1 file changed, 72 insertions(+), 72 deletions(-) diff --git a/doc/integration/shibboleth.md b/doc/integration/shibboleth.md index 41fa63ae6f2..616f3a76b2c 100644 --- a/doc/integration/shibboleth.md +++ b/doc/integration/shibboleth.md @@ -4,92 +4,95 @@ This documentation is for enabling shibboleth with omnibus-gitlab package. In order to enable Shibboleth support in gitlab we need to use Apache instead of Nginx (It may be possible to use Nginx, however this is difficult to configure using the bundled Nginx provided in the omnibus-gitlab package). Apache uses mod_shib2 module for shibboleth authentication and can pass attributes as headers to omniauth-shibboleth provider. +To enable the Shibboleth OmniAuth provider you must configure Apache shibboleth module. +Installation and configuration of module it self is out of scope of this document. +Check for more info. -To enable the Shibboleth OmniAuth provider you must: +You can find Apache config in gitlab-recipes (). -1. Configure Apache shibboleth module. Installation and configuration of module it self is out of scope of this document. -Check https://wiki.shibboleth.net/ for more info. +The following changes are needed to enable Shibboleth: -1. You can find Apache config in gitlab-recipes (https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/apache) +1. Protect omniauth-shibboleth callback URL: -Following changes are needed to enable shibboleth: + ``` + + AuthType shibboleth + ShibRequestSetting requireSession 1 + ShibUseHeaders On + require valid-user + -protect omniauth-shibboleth callback URL: -``` - - AuthType shibboleth - ShibRequestSetting requireSession 1 - ShibUseHeaders On - require valid-user - + Alias /shibboleth-sp /usr/share/shibboleth + + Satisfy any + - Alias /shibboleth-sp /usr/share/shibboleth - - Satisfy any - + + SetHandler shib + + ``` - - SetHandler shib - -``` -exclude shibboleth URLs from rewriting, add "RewriteCond %{REQUEST_URI} !/Shibboleth.sso" and "RewriteCond %{REQUEST_URI} !/shibboleth-sp", config should look like this: -``` - # Apache equivalent of Nginx try files - RewriteEngine on - RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f - RewriteCond %{REQUEST_URI} !/Shibboleth.sso - RewriteCond %{REQUEST_URI} !/shibboleth-sp - RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA] - RequestHeader set X_FORWARDED_PROTO 'https' -``` +1. Exclude shibboleth URLs from rewriting. Add `RewriteCond %{REQUEST_URI} !/Shibboleth.sso` and `RewriteCond %{REQUEST_URI} !/shibboleth-sp`. Config should look like this: -1. Edit /etc/gitlab/gitlab.rb configuration file to enable OmniAuth and add -Shibboleth as an OmniAuth provider. User attributes will be sent from the -Apache reverse proxy to GitLab as headers with the names from the Shibboleth -attribute mapping. Therefore the values of the `args` hash -should be in the form of `"HTTP_ATTRIBUTE"`. The keys in the hash are arguments -to the [OmniAuth::Strategies::Shibboleth class](https://github.com/toyokazu/omniauth-shibboleth/blob/master/lib/omniauth/strategies/shibboleth.rb) -and are documented by the [omniauth-shibboleth gem](https://github.com/toyokazu/omniauth-shibboleth) -(take care to note the version of the gem packaged with GitLab). If some of -your users appear to be authenticated by Shibboleth and Apache, but GitLab -rejects their account with a URI that contains "e-mail is invalid" then your -Shibboleth Identity Provider or Attribute Authority may be asserting multiple -e-mail addresses. In this instance, you might consider setting the -`multi_values` argument to `first`. + ``` + # Apache equivalent of Nginx try files + RewriteEngine on + RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f + RewriteCond %{REQUEST_URI} !/Shibboleth.sso + RewriteCond %{REQUEST_URI} !/shibboleth-sp + RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA] + RequestHeader set X_FORWARDED_PROTO 'https' + ``` -File should look like this: -``` -external_url 'https://gitlab.example.com' -gitlab_rails['internal_api_url'] = 'https://gitlab.example.com' +1. Edit `/etc/gitlab/gitlab.rb` configuration file to enable OmniAuth and add + Shibboleth as an OmniAuth provider. User attributes will be sent from the + Apache reverse proxy to GitLab as headers with the names from the Shibboleth + attribute mapping. Therefore the values of the `args` hash + should be in the form of `"HTTP_ATTRIBUTE"`. The keys in the hash are arguments + to the [OmniAuth::Strategies::Shibboleth class](https://github.com/toyokazu/omniauth-shibboleth/blob/master/lib/omniauth/strategies/shibboleth.rb) + and are documented by the [omniauth-shibboleth gem](https://github.com/toyokazu/omniauth-shibboleth) + (take care to note the version of the gem packaged with GitLab). If some of + your users appear to be authenticated by Shibboleth and Apache, but GitLab + rejects their account with a URI that contains "e-mail is invalid" then your + Shibboleth Identity Provider or Attribute Authority may be asserting multiple + e-mail addresses. In this instance, you might consider setting the + `multi_values` argument to `first`. -# disable Nginx -nginx['enable'] = false + The file should look like this: -gitlab_rails['omniauth_allow_single_sign_on'] = true -gitlab_rails['omniauth_block_auto_created_users'] = false -gitlab_rails['omniauth_enabled'] = true -gitlab_rails['omniauth_providers'] = [ - { - "name" => "'shibboleth"', - "label" => "Text for Login Button", - "args" => { - "shib_session_id_field" => "HTTP_SHIB_SESSION_ID", - "shib_application_id_field" => "HTTP_SHIB_APPLICATION_ID", - "uid_field" => 'HTTP_EPPN', - "name_field" => 'HTTP_CN', - "info_fields" => { "email" => 'HTTP_MAIL'} - } - } -] + ``` + external_url 'https://gitlab.example.com' + gitlab_rails['internal_api_url'] = 'https://gitlab.example.com' -``` + # disable Nginx + nginx['enable'] = false -1. [Reconfigure][] or [restart GitLab][] for the changes to take effect if you + gitlab_rails['omniauth_allow_single_sign_on'] = true + gitlab_rails['omniauth_block_auto_created_users'] = false + gitlab_rails['omniauth_enabled'] = true + gitlab_rails['omniauth_providers'] = [ + { + "name" => "'shibboleth"', + "label" => "Text for Login Button", + "args" => { + "shib_session_id_field" => "HTTP_SHIB_SESSION_ID", + "shib_application_id_field" => "HTTP_SHIB_APPLICATION_ID", + "uid_field" => 'HTTP_EPPN', + "name_field" => 'HTTP_CN', + "info_fields" => { "email" => 'HTTP_MAIL'} + } + } + ] + + ``` + +1. [Reconfigure](../administration/restart_gitlab.md#omnibus-gitlab-reconfigure) or [restart](../administration/restart_gitlab.md#installations-from-source) GitLab for the changes to take effect if you installed GitLab via Omnibus or from source respectively. -On the sign in page there should now be a "Sign in with: Shibboleth" icon below the regular sign in form. Click the icon to begin the authentication process. You will be redirected to IdP server (Depends on your Shibboleth module configuration). If everything goes well the user will be returned to GitLab and will be signed in. +On the sign in page, there should now be a "Sign in with: Shibboleth" icon below the regular sign in form. Click the icon to begin the authentication process. You will be redirected to IdP server (depends on your Shibboleth module configuration). If everything goes well the user will be returned to GitLab and will be signed in. ## Apache 2.4 / GitLab 8.6 update + The order of the first 2 Location directives is important. If they are reversed, you will not get a shibboleth session! @@ -135,6 +138,3 @@ you will not get a shibboleth session! RequestHeader set X_FORWARDED_PROTO 'https' RequestHeader set X-Forwarded-Ssl on ``` - -[reconfigure]: ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure -[restart GitLab]: ../administration/restart_gitlab.md#installations-from-source