kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss

Matus Banas f8ec9dd397 added omniauth-shibboleth gem for shibboleth support

added documentation for shibboleth omniauth provider
updated changelog

2014-09-09 22:16:05 +01:00

6 KiB

Raw Blame History

OmniAuth

GitLab leverages OmniAuth to allow users to sign in using Twitter, GitHub, and other popular services. Configuring

OmniAuth does not prevent standard GitLab authentication or LDAP (if configured) from continuing to work. Users can choose to sign in using any of the configured mechanisms.

Initial OmniAuth Configuration
Supported Providers
Enable OmniAuth for an Existing User

Initial OmniAuth Configuration

Before configuring individual OmniAuth providers there are a few global settings that need to be verified.

Open the configuration file.

cd /home/git/gitlab

sudo -u git -H editor config/gitlab.yml

Find the section dealing with OmniAuth. The section will look similar to the following.

  ## OmniAuth settings
  omniauth:
    # Allow login via Twitter, Google, etc. using OmniAuth providers
    enabled: false

    # CAUTION!
    # This allows users to login without having a user account first (default: false).
    # User accounts will be created automatically when authentication was successful.
    allow_single_sign_on: false
    # Locks down those users until they have been cleared by the admin (default: true).
    block_auto_created_users: true

    ## Auth providers
    # Uncomment the following lines and fill in the data of the auth provider you want to use
    # If your favorite auth provider is not listed you can use others:
    # see https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations
    # The 'app_id' and 'app_secret' parameters are always passed as the first two
    # arguments, followed by optional 'args' which can be either a hash or an array.
    providers:
    # - { name: 'google_oauth2', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET',
    #     args: { access_type: 'offline', approval_prompt: '' } }
    # - { name: 'twitter', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET'}
    # - { name: 'github', app_id: 'YOUR APP ID',
    #     app_secret: 'YOUR APP SECRET',
    #     args: { scope: 'user:email' } }
    # - {"name": 'shibboleth',
    #     args: { shib_session_id_field: "HTTP_SHIB_SESSION_ID",
    #     shib_application_id_field: "HTTP_SHIB_APPLICATION_ID",
    #     uid_field: "HTTP_EPPN",
    #     name_field: "HTTP_CN",
    #     info_fields: {"email": "HTTP_MAIL" } } }

Change enabled to true.
Consider the next two configuration options: allow_single_sign_on and block_auto_created_users.
- allow_single_sign_on defaults to false. If false users must be created manually or they will not be able to sign in via OmniAuth.
- block_auto_created_users defaults to true. If true auto created users will be blocked by default and will have to be unblocked by an administrator before they are able to sign in.
- Note: If you set allow_single_sign_on to true and block_auto_created_users to false please be aware that any user on the Internet will be able to successfully sign in to your GitLab without administrative approval.
Choose one or more of the Supported Providers below to continue configuration.

Supported Providers

Enable OmniAuth for an Existing User

Existing users can enable OmniAuth for specific providers after the account is created. For example, if the user originally signed in with LDAP an OmniAuth provider such as Twitter can be enabled. Follow the steps below to enable an OmniAuth provider for an existing user.

Sign in normally - whether standard sign in, LDAP, or another OmniAuth provider.
Go to profile settings (the silhouette icon in the top right corner).
Select the "Account" tab.
Under "Social Accounts" select the desired OmniAuth provider, such as Twitter.
The user will be redirected to the provider. Once the user authorized GitLab they will be redirected back to GitLab.

The chosen OmniAuth provider is now active and can be used to sign in to GitLab from then on.

Using Custom Omniauth Providers

GitLab uses Omniauth for authentication and already ships with a few providers preinstalled (e.g. LDAP, GitHub, Twitter). But sometimes that is not enough and you need to integrate with other authentication solutions. For these cases you can use the Omniauth provider.

Steps

These steps are fairly general and you will need to figure out the exact details from the Omniauth provider's documentation.

Stop GitLab:
```
sudo service gitlab stop
```
Add the gem to your Gemfile:
```
gem "omniauth-your-auth-provider"
```

If you're using MySQL, install the new Omniauth provider gem by running the following command:

sudo -u git -H bundle install --without development test postgres --path vendor/bundle --no-deployment

If you're using PostgreSQL, install the new Omniauth provider gem by running the following command:
```
sudo -u git -H bundle install --without development test mysql --path vendor/bundle --no-deployment
```
These are the same commands you used in the Install Gems section with --path vendor/bundle --no-deployment instead of --deployment.
Start GitLab:
```
sudo service gitlab start
```

Examples

If you have successfully set up a provider that is not shipped with GitLab itself, please let us know.

You can help others by reporting successful configurations and probably share a few insights or provide warnings for common errors or pitfalls by sharing your experience in the public Wiki.

While we can't officially support every possible authentication mechanism out there, we'd like to at least help those with specific needs.

6 KiB Raw Blame History