gitlab-org--gitlab-foss/doc/integration/azure.md

stage	group	info
Ecosystem	Integrations	To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments

Microsoft Azure OAuth 2.0 OmniAuth Provider (FREE SELF)

NOTE: Per Microsoft, this provider uses the older Azure Active Directory v1.0 endpoint. Microsoft documentation suggests that you should use the OpenID Connect protocol to use the v2 endpoints for new projects. To use v2 endpoints via OmniAuth, please follow Microsoft Azure OAuth 2.0 OmniAuth Provider v2 instructions.

To enable the Microsoft Azure OAuth 2.0 OmniAuth provider, you must register your application with Azure. Azure generates a client ID and secret key for you to use.

Sign in to the Azure Portal, and follow the instructions in the Microsoft Quickstart documentation.

As you go through the Microsoft procedure, keep the following in mind:

• If you have multiple instances of Azure Active Directory, you can switch to the desired tenant.
• You're setting up a Web application.
• The redirect URI requires the URL of the Azure OAuth callback of your GitLab installation. For example, https://gitlab.mycompany.com/users/auth/azure_oauth2/callback. The type dropdown should be set to Web.
• The client ID and client secret are terms associated with OAuth 2.0. In some Microsoft documentation, the terms may be listed as Application ID and Application Secret.
• If you have to generate a new client secret, follow the Microsoft documentation for creating a new application secret.
• Save the client ID and client secret for your new app, as the client secret is only displayed one time.

1. On your GitLab server, open the configuration file.

   For Omnibus GitLab:

   sudo editor /etc/gitlab/gitlab.rb
   

   For installations from source:

   cd /home/git/gitlab
   
   sudo -u git -H editor config/gitlab.yml
   

2. Refer to Configure initial settings for initial settings.

3. Add the provider configuration:

   For Omnibus GitLab:

   gitlab_rails['omniauth_providers'] = [
     {
       name: "azure_oauth2",
       # label: "Provider name", # optional label for login button, defaults to "Azure AD"
       args: {
         client_id: "CLIENT ID",
         client_secret: "CLIENT SECRET",
         tenant_id: "TENANT ID",
       }
     }
   ]
   

   For installations from source:

   - { name: 'azure_oauth2',
       # label: 'Provider name', # optional label for login button, defaults to "Azure AD"
       args: { client_id: 'CLIENT ID',
       client_secret: 'CLIENT SECRET',
       tenant_id: 'TENANT ID' } }
   

   The base_azure_url is optional and can be added for different locales; such as base_azure_url: "https://login.microsoftonline.de".

4. Replace CLIENT ID, CLIENT SECRET and TENANT ID with the values you got above.

5. Save the configuration file.

6. Reconfigure or restart GitLab, depending on your installation method:

   • If you installed from Omnibus GitLab, reconfigure GitLab.
   • If you installed from source, restart GitLab.

On the sign-in page, you should now see a Microsoft icon below the regular sign-in form. Click the icon to begin the authentication process. Microsoft then asks you to sign in and authorize the GitLab application. If successful, you are returned to GitLab and signed in.

Read Enable OmniAuth for an Existing User for information on how existing GitLab users can connect to their newly-available Azure AD accounts.

Microsoft Azure OAuth 2.0 OmniAuth Provider v2

To use v2 endpoints provided by Microsoft Azure Active Directory you must to configure it via Azure OAuth 2.0 OmniAuth Provider v2.

Registering an Azure application

To enable the Microsoft Azure OAuth 2.0 OmniAuth provider, you must register your application with Azure. Azure generates a client ID and secret key for you to use.

Sign in to the Azure Portal, and follow the instructions in the Microsoft Quickstart documentation.

As you go through the Microsoft procedure, keep the following in mind:

• If you have multiple instances of Azure Active Directory, you can switch to the desired tenant.
• You're setting up a Web application.
• The redirect URI requires the URL of the Azure OAuth callback of your GitLab installation. For example, https://gitlab.example.com/users/auth/azure_activedirectory_v2/callback. The type dropdown should be set to Web.
• The client ID and client secret are terms associated with OAuth 2.0. In some Microsoft documentation, the terms may be listed as Application ID and Application Secret.
• If you have to generate a new client secret, follow the Microsoft documentation for creating a new application secret.
• Save the client ID and client secret for your new app, as the client secret is only displayed one time.

Adding API permissions (scopes)

After you have created an application, follow the Microsoft Quickstart documentation to expose a web API. Be sure to add the following delegated permissions under the Microsoft Graph API:

• email
• openid
• profile

Alternatively, add the User.Read.All application permission.

Configuring GitLab

1. On your GitLab server, open the configuration file.

   For Omnibus GitLab:

   sudo editor /etc/gitlab/gitlab.rb
   

   For installations from source:

   cd /home/git/gitlab
   
   sudo -u git -H editor config/gitlab.yml
   

2. Refer to Configure initial settings for initial settings.

3. Add the provider configuration:

   For Omnibus GitLab:

   gitlab_rails['omniauth_providers'] = [
     {
       "name" => "azure_activedirectory_v2",
       "label" => "Provider name", # optional label for login button, defaults to "Azure AD v2"
       "args" => {
         "client_id" => "CLIENT ID",
         "client_secret" => "CLIENT SECRET",
         "tenant_id" => "TENANT ID",
       }
     }
   ]
   

   For installations from source:

   - { name: 'azure_activedirectory_v2',
       label: 'Provider name', # optional label for login button, defaults to "Azure AD v2"
       args: { client_id: "CLIENT ID",
       client_secret: "CLIENT SECRET",
       tenant_id: "TENANT ID" } }
   

   The base_azure_url is optional and can be added for different locales; such as base_azure_url: "https://login.microsoftonline.de".

   The scope parameter is optional and can be added to args. Default scope is: openid profile email.

4. Replace CLIENT ID, CLIENT SECRET, and TENANT ID with the values you got above.

5. Save the configuration file.

6. Reconfigure or restart GitLab, depending on your installation method:

   • If you installed from Omnibus GitLab, reconfigure GitLab.
   • If you installed from source, restart GitLab.

On the sign-in page, you should now see a Microsoft icon below the regular sign-in form. Select the icon to begin the authentication process. Microsoft then asks you to sign in and authorize the GitLab application. If successful, you are returned to GitLab and signed in.

Read Enable OmniAuth for an Existing User for information on how existing GitLab users can connect to their newly available Azure AD accounts.