BigW Consortium Gitlab

omniauth.md 8.08 KB
Newer Older
1 2
# OmniAuth

3 4
GitLab leverages OmniAuth to allow users to sign in using Twitter, GitHub, and
other popular services.
5

6 7 8
Configuring OmniAuth does not prevent standard GitLab authentication or LDAP
(if configured) from continuing to work. Users can choose to sign in using any
of the configured mechanisms.
9

10 11 12
- [Initial OmniAuth Configuration](#initial-omniauth-configuration)
- [Supported Providers](#supported-providers)
- [Enable OmniAuth for an Existing User](#enable-omniauth-for-an-existing-user)
13
- [OmniAuth configuration sample when using Omnibus GitLab](https://gitlab.com/gitlab-org/omnibus-gitlab/tree/master#omniauth-google-twitter-github-login)
14
- [Enable or disable Sign In with an OmniAuth provider without disabling import sources](#enable-or-disable-sign-in-with-an-omniauth-provider-without-disabling-import-sources)
15

16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
## Supported Providers

This is a list of the current supported OmniAuth providers. Before proceeding
on each provider's documentation, make sure to first read this document as it
contains some settings that are common for all providers.

- [GitHub](github.md)
- [Bitbucket](bitbucket.md)
- [GitLab.com](gitlab.md)
- [Google](google.md)
- [Facebook](facebook.md)
- [Twitter](twitter.md)
- [Shibboleth](shibboleth.md)
- [SAML](saml.md)
- [Crowd](crowd.md)
- [Azure](azure.md)
32
- [Auth0](auth0.md)
33

34
## Initial OmniAuth Configuration
35

36 37
Before configuring individual OmniAuth providers there are a few global settings
that are in common for all providers that we need to consider.
38

39
- Omniauth needs to be enabled, see details below for example.
40 41 42 43 44 45
- `allow_single_sign_on` allows you to specify the providers you want to allow to
  automatically create an account. It defaults to `false`. If `false` users must
  be created manually or they will not be able to sign in via OmniAuth.
- `block_auto_created_users` defaults to `true`. If `true` auto created users will
  be blocked by default and will have to be unblocked by an administrator before
  they are able to sign in.
Patricio Cano committed
46 47 48 49 50 51 52

>**Note:**
If you set `block_auto_created_users` to `false`, make sure to only
define providers under `allow_single_sign_on` that you are able to control, like
SAML, Shibboleth, Crowd or Google, or set it to `false` otherwise any user on
the Internet will be able to successfully sign in to your GitLab without
administrative approval.
53 54

To change these settings:
55 56 57 58 59 60 61 62 63

* **For omnibus package**

    Open the configuration file:

    ```sh
    sudo editor /etc/gitlab/gitlab.rb
    ```

Patricio Cano committed
64
    and change:
65

66
    ```ruby
67
    gitlab_rails['omniauth_enabled'] = true
Patricio Cano committed
68 69 70 71 72 73

    # CAUTION!
    # This allows users to login without having a user account first. Define the allowed providers
    # using an array, e.g. ["saml", "twitter"], or as true/false to allow all providers or none.
    # User accounts will be created automatically when authentication was successful.
    gitlab_rails['omniauth_allow_single_sign_on'] = ['saml', 'twitter']
74
    gitlab_rails['omniauth_block_auto_created_users'] = true
75 76 77 78 79
    ```

* **For installations from source**

    Open the configuration file:
80 81 82 83 84 85 86

    ```sh
    cd /home/git/gitlab

    sudo -u git -H editor config/gitlab.yml
    ```

Patricio Cano committed
87
    and change the following section:
88

89
    ```yaml
90
     ## OmniAuth settings
91 92
      omniauth:
        # Allow login via Twitter, Google, etc. using OmniAuth providers
93
        enabled: true
94 95

        # CAUTION!
96 97
        # This allows users to login without having a user account first. Define the allowed providers
        # using an array, e.g. ["saml", "twitter"], or as true/false to allow all providers or none.
98
        # User accounts will be created automatically when authentication was successful.
99 100
        allow_single_sign_on: ["saml", "twitter"]

101 102 103
        # Locks down those users until they have been cleared by the admin (default: true).
        block_auto_created_users: true
    ```
104

105 106
Now we can choose one or more of the [Supported Providers](#supported-providers)
listed above to continue the configuration process.
107 108

## Enable OmniAuth for an Existing User
109

110
Existing users can enable OmniAuth for specific providers after the account is
Patricio Cano committed
111
created. For example, if the user originally signed in with LDAP, an OmniAuth
112 113
provider such as Twitter can be enabled. Follow the steps below to enable an
OmniAuth provider for an existing user.
114 115

1. Sign in normally - whether standard sign in, LDAP, or another OmniAuth provider.
116 117
1. Go to profile settings (the silhouette icon in the top right corner).
1. Select the "Account" tab.
118
1. Under "Connected Accounts" select the desired OmniAuth provider, such as Twitter.
119 120
1. The user will be redirected to the provider. Once the user authorized GitLab
   they will be redirected back to GitLab.
121 122

The chosen OmniAuth provider is now active and can be used to sign in to GitLab from then on.
123

124 125 126 127 128 129
## Configure OmniAuth Providers as External

>**Note:**
This setting was introduced with version 8.7 of GitLab

You can define which OmniAuth providers you want to be `external` so that all users
130 131 132 133 134 135 136 137 138
**creating accounts, or logging in via these providers** will not be able to have
access to internal projects. You will need to use the full name of the provider,
like `google_oauth2` for Google. Refer to the examples for the full names of the
supported providers.

>**Note:**
If you decide to remove an OmniAuth provider from the external providers list
you will need to manually update the users that use this method to login, if you
want their accounts to be upgraded to full internal accounts.
139 140 141 142 143 144 145 146 147 148 149 150 151 152

**For Omnibus installations**

```ruby
  gitlab_rails['omniauth_external_providers'] = ['twitter', 'google_oauth2']
```

**For installations from source**

```yaml
  omniauth:
    external_providers: ['twitter', 'google_oauth2']
```

Patricio Cano committed
153 154 155 156
## Using Custom Omniauth Providers

>**Note:**
The following information only applies for installations from source.
157

158 159 160 161
GitLab uses [Omniauth](http://www.omniauth.org/) for authentication and already ships
with a few providers pre-installed (e.g. LDAP, GitHub, Twitter). But sometimes that
is not enough and you need to integrate with other authentication solutions. For
these cases you can use the Omniauth provider.
162 163 164

### Steps

165 166
These steps are fairly general and you will need to figure out the exact details
from the Omniauth provider's documentation.
167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191

-   Stop GitLab:

        sudo service gitlab stop

-   Add the gem to your [Gemfile](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/Gemfile):

        gem "omniauth-your-auth-provider"

-   If you're using MySQL, install the new Omniauth provider gem by running the following command:

        sudo -u git -H bundle install --without development test postgres --path vendor/bundle --no-deployment

-   If you're using PostgreSQL, install the new Omniauth provider gem by running the following command:

        sudo -u git -H bundle install --without development test mysql --path vendor/bundle --no-deployment

    > These are the same commands you used in the [Install Gems section](#install-gems) with `--path vendor/bundle --no-deployment` instead of `--deployment`.

-   Start GitLab:

        sudo service gitlab start

### Examples

192 193
If you have successfully set up a provider that is not shipped with GitLab itself,
please let us know.
194

195 196 197
You can help others by reporting successful configurations and probably share a
few insights or provide warnings for common errors or pitfalls by sharing your
experience [in the public Wiki](https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations).
198

199 200
While we can't officially support every possible authentication mechanism out there,
we'd like to at least help those with specific needs.
201 202

## Enable or disable Sign In with an OmniAuth provider without disabling import sources
203

204
>**Note:**
205
This setting was introduced with version 8.8 of GitLab.
206 207 208 209

Administrators are able to enable or disable Sign In via some OmniAuth providers.

>**Note:**
210
By default Sign In is enabled via all the OAuth Providers that have been configured in `config/gitlab.yml`.
211

212
In order to enable/disable an OmniAuth provider, go to Admin Area -> Settings -> Sign-in Restrictions section -> Enabled OAuth Sign-In sources and select the providers you want to enable or disable.
213 214

![Enabled OAuth Sign-In sources](img/enabled-oauth-sign-in-sources.png)