Skip to content

Commit c98e4de

Browse files
sachillessachilles
authored
Merge pull request sameersbn#2953 from molnarpe/omniauth-oidc
Add support for Omniauth OpenID Connect login.
2 parents 32d6120 + b35d4f2 commit c98e4de

File tree

4 files changed

+90
-1
lines changed

4 files changed

+90
-1
lines changed

‎README.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
- [Crowd](#crowd)
4747
- [Microsoft Azure](#microsoft-azure)
4848
- [Generic OAuth2](#Generic-OAuth2)
49+
- [OpenID Connect](#openid-connect)
4950
- [Gitlab Pages](#gitlab-pages)
5051
- [External Issue Trackers](#external-issue-trackers)
5152
- [Host UID / GID Mapping](#host-uid--gid-mapping)
@@ -725,6 +726,30 @@ As an example this code has been tested with Keycloak, with the following variab
725726

726727
See [GitLab documentation](https://docs.gitlab.com/ee/integration/oauth2_generic.html#sign-into-gitlab-with-almost-any-oauth2-provider) and [Omniauth-oauth2-generic documentation](https://gitlab.com/satorix/omniauth-oauth2-generic) for more details.
727728

729+
##### OpenID Connect
730+
731+
To enable OpenID Connect provider, you must register your application with your provider. You also need to confirm OpenID Connect provider app's ID and secret, the client options and the user's response structure.
732+
733+
To use OIDC set at least `OAUTH_OIDC_ISSUER` and `OAUTH_OIDC_CLIENT_ID`.
734+
735+
| GitLab setting | environment variable | default value |
736+
|--------------------------------|-------------------------------------|--------------------------------|
737+
| `label` | `OAUTH_OIDC_LABEL` | `OpenID Connect` |
738+
| `icon` | `OAUTH_OIDC_ICON` | |
739+
| `scope` | `OAUTH_OIDC_SCOPE` | `['openid','profile','email']` |
740+
| `response_type` | `OAUTH_OIDC_RESPONSE_TYPE` | `code` |
741+
| `issuer` | `OAUTH_OIDC_ISSUER` | |
742+
| `discovery` | `OAUTH_OIDC_DISCOVERY` | `true` |
743+
| `client_auth_method` | `OAUTH_OIDC_CLIENT_AUTH_METHOD` | `basic` |
744+
| `uid_field` | `OAUTH_OIDC_UID_FIELD` | `sub` |
745+
| `send_scope_to_token_endpoint` | `OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP` | `false` |
746+
| `pkce` | `OAUTH_OIDC_PKCE` | `true` |
747+
| `client_options.identifier` | `OAUTH_OIDC_CLIENT_ID` | |
748+
| `client_options.secret` | `OAUTH_OIDC_CLIENT_SECRET` | `secret` |
749+
| `client_options.redirect_uri` | `OAUTH_OIDC_REDIRECT_URI` | `http://${GITLAB_HOST}/users/auth/openid_connect/callback` or `https://${GITLAB_HOST}/users/auth/openid_connect/callback` depending on the value of `GITLAB_HTTPS` |
750+
751+
See [GitLab OIDC documentation](https://docs.gitlab.com/ee/administration/auth/oidc.html) and [OmniAuth OpenID Connect documentation](https://github.com/omniauth/omniauth_openid_connect/).
752+
728753
#### Gitlab Pages
729754

730755
Gitlab Pages allows a user to host static websites from a project. Gitlab pages can be enabled with setting the envrionment variable `GITLAB_PAGES_ENABLED` to `true`.

‎assets/runtime/config/gitlabhq/gitlab.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1031,6 +1031,23 @@ production: &base
10311031
client_id: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_CLIENT_ID}}',
10321032
client_secret: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_CLIENT_SECRET}}',
10331033
tenant_id: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_TENANT_ID}}' } }
1034+
- { name: 'openid_connect',
1035+
label: '{{OAUTH_OIDC_LABEL}}',
1036+
icon: '{{OAUTH_OIDC_ICON}}',
1037+
args: {
1038+
name: 'openid_connect',
1039+
scope: {{OAUTH_OIDC_SCOPE}},
1040+
response_type: '{{OAUTH_OIDC_RESPONSE_TYPE}}',
1041+
issuer: '{{OAUTH_OIDC_ISSUER}}',
1042+
discovery: {{OAUTH_OIDC_DISCOVERY}},
1043+
client_auth_method: '{{OAUTH_OIDC_CLIENT_AUTH_METHOD}}',
1044+
uid_field: '{{OAUTH_OIDC_UID_FIELD}}',
1045+
send_scope_to_token_endpoint: {{OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP}},
1046+
pkce: {{OAUTH_OIDC_PKCE}},
1047+
client_options: {
1048+
identifier: '{{OAUTH_OIDC_CLIENT_ID}}',
1049+
secret: '{{OAUTH_OIDC_CLIENT_SECRET}}',
1050+
redirect_uri: '{{OAUTH_OIDC_REDIRECT_URI}}' } } }
10341051

10351052
# SSO maximum session duration in seconds. Defaults to CAS default of 8 hours.
10361053
# cas3:

‎assets/runtime/env-defaults‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,28 @@ OAUTH2_GENERIC_AUTHORIZE_PARAMS_SCOPE=${OAUTH2_GENERIC_AUTHORIZE_PARAMS_SCOPE:-}
537537
OAUTH2_GENERIC_LABEL=${OAUTH2_GENERIC_LABEL:-}
538538
OAUTH2_GENERIC_NAME=${OAUTH2_GENERIC_NAME:-}
539539

540+
### OpenID Connect
541+
OAUTH_OIDC_LABEL=${OAUTH_OIDC_LABEL:-'OpenID Connect'}
542+
OAUTH_OIDC_ICON=${OAUTH_OIDC_ICON:-}
543+
OAUTH_OIDC_SCOPE=${OAUTH_OIDC_SCOPE:-"['openid','profile','email']"}
544+
OAUTH_OIDC_RESPONSE_TYPE=${OAUTH_OIDC_RESPONSE_TYPE:-'code'}
545+
OAUTH_OIDC_ISSUER=${OAUTH_OIDC_ISSUER:-}
546+
OAUTH_OIDC_DISCOVERY=${OAUTH_OIDC_DISCOVERY:-true}
547+
OAUTH_OIDC_CLIENT_AUTH_METHOD=${OAUTH_OIDC_CLIENT_AUTH_METHOD:-'basic'}
548+
OAUTH_OIDC_UID_FIELD=${OAUTH_OIDC_UID_FIELD:-sub}
549+
OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP=${OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP:-false}
550+
OAUTH_OIDC_PKCE=${OAUTH_OIDC_PKCE:-true}
551+
OAUTH_OIDC_CLIENT_ID=${OAUTH_OIDC_CLIENT_ID:-}
552+
OAUTH_OIDC_CLIENT_SECRET=${OAUTH_OIDC_CLIENT_SECRET:-'secret'}
553+
case $GITLAB_HTTPS in
554+
true)
555+
OAUTH_OIDC_REDIRECT_URI=${OAUTH_OIDC_REDIRECT_URI:-https://${GITLAB_HOST}/users/auth/openid_connect/callback}
556+
;;
557+
false)
558+
OAUTH_OIDC_REDIRECT_URI=${OAUTH_OIDC_REDIRECT_URI:-http://${GITLAB_HOST}/users/auth/openid_connect/callback}
559+
;;
560+
esac
561+
540562
## ANALYTICS
541563

542564
### GOOGLE

‎assets/runtime/functions‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -793,6 +793,30 @@ gitlab_configure_oauth_azure_ad_v2() {
793793
fi
794794
}
795795

796+
gitlab_configure_oauth_oidc() {
797+
if [[ -n ${OAUTH_OIDC_ISSUER} && \
798+
-n ${OAUTH_OIDC_CLIENT_ID} ]]; then
799+
echo "Configuring gitlab::oauth::oidc..."
800+
OAUTH_ENABLED=${OAUTH_ENABLED:-true}
801+
update_template ${GITLAB_CONFIG} \
802+
OAUTH_OIDC_LABEL \
803+
OAUTH_OIDC_ICON \
804+
OAUTH_OIDC_SCOPE \
805+
OAUTH_OIDC_RESPONSE_TYPE \
806+
OAUTH_OIDC_ISSUER \
807+
OAUTH_OIDC_DISCOVERY \
808+
OAUTH_OIDC_CLIENT_AUTH_METHOD \
809+
OAUTH_OIDC_UID_FIELD \
810+
OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP \
811+
OAUTH_OIDC_PKCE \
812+
OAUTH_OIDC_CLIENT_ID \
813+
OAUTH_OIDC_CLIENT_SECRET \
814+
OAUTH_OIDC_REDIRECT_URI
815+
else
816+
exec_as_git sed -i "/name: 'openid_connect'/,/{{OAUTH_OIDC_REDIRECT_URI}}/d" ${GITLAB_CONFIG}
817+
fi
818+
}
819+
796820
gitlab_configure_oauth() {
797821
echo "Configuring gitlab::oauth..."
798822

@@ -810,6 +834,7 @@ gitlab_configure_oauth() {
810834
gitlab_configure_oauth_auth0
811835
gitlab_configure_oauth_azure
812836
gitlab_configure_oauth_azure_ad_v2
837+
gitlab_configure_oauth_oidc
813838

814839
OAUTH_ENABLED=${OAUTH_ENABLED:-false}
815840
update_template ${GITLAB_CONFIG} \
@@ -823,7 +848,7 @@ gitlab_configure_oauth() {
823848
OAUTH_ALLOW_BYPASS_TWO_FACTOR
824849

825850
case ${OAUTH_AUTO_SIGN_IN_WITH_PROVIDER} in
826-
cas3|google_oauth2|facebook|twitter|github|gitlab|bitbucket|saml|crowd|azure_oauth2|azure_activedirectory_v2|oauth2_generic|$OAUTH2_GENERIC_NAME)
851+
cas3|google_oauth2|facebook|twitter|github|gitlab|bitbucket|saml|crowd|azure_oauth2|azure_activedirectory_v2|oauth2_generic|$OAUTH2_GENERIC_NAME|oidc)
827852
update_template ${GITLAB_CONFIG} OAUTH_AUTO_SIGN_IN_WITH_PROVIDER
828853
;;
829854
*)

0 commit comments

Comments
 (0)