kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss

Alias GitHub and BitBucket OAuth2 callback URLs

To prevent an OAuth2 covert redirect vulnerability, this commit adds and
uses an alias for the GitHub and BitBucket OAuth2 callback URLs to the
following paths:

GitHub: /users/auth/-/import/github
Bitbucket: /users/auth/-/import/bitbucket

This allows admins to put a more restrictive callback URL in the OAuth2
configuration settings. Instead of https://example.com, admins can now use:

https://example.com/users/auth

It's possible but not trivial to change Devise and OmniAuth to use a
different prefix for callback URLs instead of /users/auth. For now,
aliasing the import URLs under the /users/auth namespace should suffice.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/56663

2019-01-31 16:52:48 +01:00

5.4 KiB

Raw Blame History

Integrate your GitLab server with Bitbucket Cloud

NOTE: Note: You need to enable OmniAuth in order to use this.

Import projects from Bitbucket.org and login to your GitLab instance with your Bitbucket.org account.

Overview

You can set up Bitbucket.org as an OAuth2 provider so that you can use your credentials to authenticate into GitLab or import your projects from Bitbucket.org.

To use Bitbucket.org as an OmniAuth provider, follow the Bitbucket OmniAuth provider section.
To import projects from Bitbucket, follow both the Bitbucket OmniAuth provider and Bitbucket project import sections.

Bitbucket OmniAuth provider

Note: GitLab 8.15 significantly simplified the way to integrate Bitbucket.org with GitLab. You are encouraged to upgrade your GitLab instance if you haven't done so already. If you're using GitLab 8.14 or below, use the previous integration docs.

To enable the Bitbucket OmniAuth provider you must register your application with Bitbucket.org. Bitbucket will generate an application ID and secret key for you to use.

Sign in to Bitbucket.org.
Navigate to your individual user settings (Bitbucket settings) or a team's settings (Manage team), depending on how you want the application registered. It does not matter if the application is registered as an individual or a team, that is entirely up to you.
Select OAuth in the left menu under "Access Management".
Select Add consumer.

Provide the required details:

Item	Description
Name	This can be anything. Consider something like `<Organization>'s GitLab` or `<Your Name>'s GitLab` or something else descriptive.
Application description	Fill this in if you wish.
Callback URL	The URL to your GitLab installation, e.g., `https://gitlab.example.com/users/auth`.
URL	The URL to your GitLab installation, e.g., `https://gitlab.example.com`.

NOTE: Be sure to append /users/auth to the end of the callback URL to prevent a OAuth2 convert redirect vulnerability.

NOTE: Starting in GitLab 8.15, you MUST specify a callback URL, or you will see an "Invalid redirect_uri" message. For more details, see the Bitbucket documentation.

And grant at least the following permissions:

Account: Email, Read
Projects: Read
Repositories: Read
Pull Requests: Read
Issues: Read
Wiki: Read and Write

Select Save.
Select your newly created OAuth consumer and you should now see a Key and Secret in the list of OAuth consumers. Keep this page open as you continue the configuration.

On your GitLab server, open the configuration file:

# For Omnibus packages
sudo editor /etc/gitlab/gitlab.rb

# For installations from source
sudo -u git -H editor /home/git/gitlab/config/gitlab.yml

Add the Bitbucket provider configuration:

For Omnibus packages:

gitlab_rails['omniauth_enabled'] = true

gitlab_rails['omniauth_providers'] = [
  {
    "name" => "bitbucket",
    "app_id" => "BITBUCKET_APP_KEY",
    "app_secret" => "BITBUCKET_APP_SECRET",
    "url" => "https://bitbucket.org/"
  }
]

For installations from source:

omniauth:
  enabled: true
  providers:
    - { name: 'bitbucket',
        app_id: 'BITBUCKET_APP_KEY',
        app_secret: 'BITBUCKET_APP_SECRET',
        url: 'https://bitbucket.org/' }

Where BITBUCKET_APP_KEY is the Key and BITBUCKET_APP_SECRET the Secret from the Bitbucket application page.

Save the configuration file.
For the changes to take effect, reconfigure GitLab if you installed via Omnibus, or restart if installed from source.

On the sign in page there should now be a Bitbucket icon below the regular sign in form. Click the icon to begin the authentication process. Bitbucket will ask the user to sign in and authorize the GitLab application. If everything goes well, the user will be returned to GitLab and will be signed in.

Bitbucket project import

Once the above configuration is set up, you can use Bitbucket to sign into GitLab and start importing your projects.

If you want to import projects from Bitbucket, but don't want to enable signing in, you can disable Sign-Ins in the admin panel.

5.4 KiB Raw Blame History

Integrate your GitLab server with Bitbucket Cloud

Overview

Bitbucket OmniAuth provider

Bitbucket project import

5.4 KiB

Raw Blame History