gitlab-org--gitlab-foss/doc/integration/gitlab.md

stage	group	info
Manage	Authentication and Authorization	To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments

Integrate your server with GitLab.com (FREE SELF)

Import projects from GitLab.com and login to your GitLab instance with your GitLab.com account.

To enable the GitLab.com OmniAuth provider you must register your application with GitLab.com. GitLab.com generates an application ID and secret key for you to use.

1. Sign in to GitLab.com.

2. In the top-right corner, select your avatar.

3. Select Edit profile.

4. On the left sidebar, select Applications.

5. Provide the required details for Add new application.

   • Name: This can be anything. Consider something like <Organization>'s GitLab or <Your Name>'s GitLab or something else descriptive.
   • Redirect URI:

   http://your-gitlab.example.com/import/gitlab/callback
   http://your-gitlab.example.com/users/auth/gitlab/callback
   

   The first link is required for the importer and second for authentication.

   If you:

   • Plan to use the importer, you can leave scopes as they are.
   • Only want to use this application for authentication, we recommend using a more minimal set of scopes. read_user is sufficient.

6. Select Save application.

7. You should now see an Application ID and Secret. Keep this page open as you continue configuration.

8. On your GitLab server, open the configuration file.

   For Omnibus package:

   sudo editor /etc/gitlab/gitlab.rb
   

   For installations from source:

   cd /home/git/gitlab
   
   sudo -u git -H editor config/gitlab.yml
   

9. See Configure initial settings for initial settings.

10. Add the provider configuration:

    For Omnibus installations authenticating against GitLab.com:

    gitlab_rails['omniauth_providers'] = [
      {
        name: "gitlab",
        # label: "Provider name", # optional label for login button, defaults to "GitLab.com"
        app_id: "YOUR_APP_ID",
        app_secret: "YOUR_APP_SECRET",
        args: { scope: "read_user" } # optional: defaults to the scopes of the application
      }
    ]
    

    Or, for Omnibus installations authenticating against a different GitLab instance:

    gitlab_rails['omniauth_providers'] = [
      {
        name: "gitlab",
        label: "Provider name", # optional label for login button, defaults to "GitLab.com"
        app_id: "YOUR_APP_ID",
        app_secret: "YOUR_APP_SECRET",
        args: { scope: "read_user" # optional: defaults to the scopes of the application
              , client_options: { site: "https://gitlab.example.com" } }
      }
    ]
    

    For installations from source authenticating against GitLab.com:

    - { name: 'gitlab',
        # label: 'Provider name', # optional label for login button, defaults to "GitLab.com"
        app_id: 'YOUR_APP_ID',
        app_secret: 'YOUR_APP_SECRET',
    

    Or, for installations from source to authenticate against a different GitLab instance:

    - { name: 'gitlab',
        label: 'Provider name', # optional label for login button, defaults to "GitLab.com"
        app_id: 'YOUR_APP_ID',
        app_secret: 'YOUR_APP_SECRET',
        args: { "client_options": { "site": 'https://gitlab.example.com' } }
    

    NOTE: In GitLab 15.1 and earlier, the site parameter requires an /api/v4 suffix. We recommend you drop this suffix after you upgrade to GitLab 15.2 or later.

11. Change 'YOUR_APP_ID' to the Application ID from the GitLab.com application page.

12. Change 'YOUR_APP_SECRET' to the secret from the GitLab.com application page.

13. Save the configuration file.

14. Based on how GitLab was installed, implement these changes by using the appropriate method:

    • Omnibus GitLab: reconfigure GitLab.
    • Source: restart GitLab.

On the sign-in page, there should now be a GitLab.com icon following the regular sign-in form. Select the icon to begin the authentication process. GitLab.com asks the user to sign in and authorize the GitLab application. If everything goes well, the user is returned to your GitLab instance and is signed in.

Reduce access privileges on sign in

• Introduced in GitLab 14.8 with a flag named omniauth_login_minimal_scopes. Disabled by default.
• Enabled on GitLab.com in GitLab 14.9.
• Feature flag omniauth_login_minimal_scopes removed in GitLab 15.2

If you use a GitLab instance for authentication, you can reduce access rights when an OAuth application is used for sign in.

Any OAuth application can advertise the purpose of the application with the authorization parameter: gl_auth_type=login. If the application is configured with api or read_api, the access token is issued with read_user for login, because no higher permissions are needed.

The GitLab OAuth client is configured to pass this parameter, but other applications can also pass it.