debian-mirror-gitlab/doc/integration/omniauth.md

358 lines
12 KiB
Markdown
Raw Normal View History

2021-01-29 00:20:46 +05:30
---
2021-02-22 17:27:13 +05:30
stage: Create
group: Ecosystem
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2021-01-29 00:20:46 +05:30
---
2014-09-02 18:07:02 +05:30
# OmniAuth
2016-06-02 11:05:42 +05:30
GitLab leverages OmniAuth to allow users to sign in using Twitter, GitHub, and
2020-10-24 23:57:45 +05:30
other popular services. [OmniAuth](https://rubygems.org/gems/omniauth/) is
"a generalized Rack framework for multiple-provider authentication, built on Ruby.
2014-09-02 18:07:02 +05:30
2016-06-02 11:05:42 +05:30
Configuring OmniAuth does not prevent standard GitLab authentication or LDAP
(if configured) from continuing to work. Users can choose to sign in using any
of the configured mechanisms.
2014-09-02 18:07:02 +05:30
- [Initial OmniAuth Configuration](#initial-omniauth-configuration)
- [Supported Providers](#supported-providers)
- [Enable OmniAuth for an Existing User](#enable-omniauth-for-an-existing-user)
2015-04-26 12:48:37 +05:30
- [OmniAuth configuration sample when using Omnibus GitLab](https://gitlab.com/gitlab-org/omnibus-gitlab/tree/master#omniauth-google-twitter-github-login)
2016-06-02 11:05:42 +05:30
- [Enable or disable Sign In with an OmniAuth provider without disabling import sources](#enable-or-disable-sign-in-with-an-omniauth-provider-without-disabling-import-sources)
2014-09-02 18:07:02 +05:30
2016-04-02 18:10:28 +05:30
## Supported Providers
This is a list of the current supported OmniAuth providers. Before proceeding
on each provider's documentation, make sure to first read this document as it
contains some settings that are common for all providers.
- [GitHub](github.md)
- [Bitbucket](bitbucket.md)
- [GitLab.com](gitlab.md)
- [Google](google.md)
- [Facebook](facebook.md)
- [Twitter](twitter.md)
- [Shibboleth](shibboleth.md)
- [SAML](saml.md)
2017-08-17 22:00:37 +05:30
- [Crowd](../administration/auth/crowd.md)
2016-04-02 18:10:28 +05:30
- [Azure](azure.md)
2016-06-02 11:05:42 +05:30
- [Auth0](auth0.md)
2017-08-17 22:00:37 +05:30
- [Authentiq](../administration/auth/authentiq.md)
- [OAuth2Generic](oauth2_generic.md)
2018-05-09 12:01:36 +05:30
- [JWT](../administration/auth/jwt.md)
2019-07-31 22:56:46 +05:30
- [OpenID Connect](../administration/auth/oidc.md)
2019-12-21 20:55:43 +05:30
- [Salesforce](salesforce.md)
2020-04-08 14:13:33 +05:30
- [AWS Cognito](../administration/auth/cognito.md)
2016-04-02 18:10:28 +05:30
2014-09-02 18:07:02 +05:30
## Initial OmniAuth Configuration
2016-06-02 11:05:42 +05:30
Before configuring individual OmniAuth providers there are a few global settings
that are in common for all providers that we need to consider.
2014-09-02 18:07:02 +05:30
2021-02-22 17:27:13 +05:30
NOTE:
2020-10-24 23:57:45 +05:30
Starting from GitLab 11.4, OmniAuth is enabled by default. If you're using an
2021-02-22 17:27:13 +05:30
earlier version, you must explicitly enable it.
2018-12-05 23:21:45 +05:30
2016-06-02 11:05:42 +05:30
- `allow_single_sign_on` allows you to specify the providers you want to allow to
automatically create an account. It defaults to `false`. If `false` users must
2021-02-22 17:27:13 +05:30
be created manually or they can't sign in via OmniAuth.
2021-01-03 14:25:43 +05:30
- `auto_link_ldap_user` can be used if you have [LDAP / ActiveDirectory](../administration/auth/ldap/index.md)
2020-05-24 23:13:21 +05:30
integration enabled. It defaults to `false`. When enabled, users automatically
2021-02-22 17:27:13 +05:30
created through an OmniAuth provider have their LDAP identity created in GitLab as well.
2016-06-02 11:05:42 +05:30
- `block_auto_created_users` defaults to `true`. If `true` auto created users will
2021-02-22 17:27:13 +05:30
be blocked by default and must be unblocked by an administrator before
2016-06-02 11:05:42 +05:30
they are able to sign in.
2021-02-22 17:27:13 +05:30
NOTE:
2020-10-24 23:57:45 +05:30
If you set `block_auto_created_users` to `false`, make sure to only
define providers under `allow_single_sign_on` that you are able to control, like
SAML, Shibboleth, Crowd or Google, or set it to `false` otherwise any user on
2021-02-22 17:27:13 +05:30
the Internet can successfully sign in to your GitLab without
2020-10-24 23:57:45 +05:30
administrative approval.
2021-02-22 17:27:13 +05:30
NOTE:
2020-10-24 23:57:45 +05:30
`auto_link_ldap_user` requires the `uid` of the user to be the same in both LDAP
and the OmniAuth provider.
2017-08-17 22:00:37 +05:30
2016-06-02 11:05:42 +05:30
To change these settings:
2015-04-26 12:48:37 +05:30
2019-12-04 20:38:33 +05:30
- **For Omnibus package**
2015-04-26 12:48:37 +05:30
2019-09-30 21:07:59 +05:30
Open the configuration file:
2015-04-26 12:48:37 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-09-30 21:07:59 +05:30
sudo editor /etc/gitlab/gitlab.rb
```
2015-04-26 12:48:37 +05:30
2019-09-30 21:07:59 +05:30
and change:
2015-04-26 12:48:37 +05:30
2019-09-30 21:07:59 +05:30
```ruby
# CAUTION!
2021-01-29 00:20:46 +05:30
# This allows users to sign in without having a user account first. Define the allowed providers
# using an array, for example, ["saml", "twitter"], or as true/false to allow all providers or none.
2019-09-30 21:07:59 +05:30
# User accounts will be created automatically when authentication was successful.
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml', 'twitter']
gitlab_rails['omniauth_auto_link_ldap_user'] = true
gitlab_rails['omniauth_block_auto_created_users'] = true
```
2015-04-26 12:48:37 +05:30
2019-03-02 22:35:43 +05:30
- **For installations from source**
2015-04-26 12:48:37 +05:30
2019-09-30 21:07:59 +05:30
Open the configuration file:
2014-09-02 18:07:02 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-09-30 21:07:59 +05:30
cd /home/git/gitlab
2014-09-02 18:07:02 +05:30
2019-09-30 21:07:59 +05:30
sudo -u git -H editor config/gitlab.yml
```
2014-09-02 18:07:02 +05:30
2019-09-30 21:07:59 +05:30
and change the following section:
2014-09-02 18:07:02 +05:30
2019-09-30 21:07:59 +05:30
```yaml
## OmniAuth settings
2021-01-03 14:25:43 +05:30
omniauth:
2021-01-29 00:20:46 +05:30
# Allow sign-in by using Twitter, Google, etc. using OmniAuth providers
2021-01-03 14:25:43 +05:30
# Versions prior to 11.4 require this to be set to true
# enabled: true
2014-09-02 18:07:02 +05:30
2021-01-03 14:25:43 +05:30
# CAUTION!
2021-01-29 00:20:46 +05:30
# This allows users to sign in without having a user account first. Define the allowed providers
# using an array, for example, ["saml", "twitter"], or as true/false to allow all providers or none.
2021-01-03 14:25:43 +05:30
# User accounts will be created automatically when authentication was successful.
allow_single_sign_on: ["saml", "twitter"]
2016-06-02 11:05:42 +05:30
2021-01-03 14:25:43 +05:30
auto_link_ldap_user: true
2017-08-17 22:00:37 +05:30
2021-01-03 14:25:43 +05:30
# Locks down those users until they have been cleared by the admin (default: true).
block_auto_created_users: true
2019-09-30 21:07:59 +05:30
```
2014-09-02 18:07:02 +05:30
2016-09-29 09:46:39 +05:30
Now we can choose one or more of the [Supported Providers](#supported-providers)
listed above to continue the configuration process.
2014-09-02 18:07:02 +05:30
## Enable OmniAuth for an Existing User
2016-06-02 11:05:42 +05:30
Existing users can enable OmniAuth for specific providers after the account is
created. For example, if the user originally signed in with LDAP, an OmniAuth
provider such as Twitter can be enabled. Follow the steps below to enable an
OmniAuth provider for an existing user.
2014-09-02 18:07:02 +05:30
1. Sign in normally - whether standard sign in, LDAP, or another OmniAuth provider.
1. Go to profile settings (the silhouette icon in the top right corner).
1. Select the "Account" tab.
2015-09-11 14:41:01 +05:30
1. Under "Connected Accounts" select the desired OmniAuth provider, such as Twitter.
2021-02-22 17:27:13 +05:30
1. The user is redirected to the provider. After the user authorizes GitLab,
they are redirected back to GitLab.
2014-09-02 18:07:02 +05:30
The chosen OmniAuth provider is now active and can be used to sign in to GitLab from then on.
2015-04-26 12:48:37 +05:30
2020-10-24 23:57:45 +05:30
## Automatically Link Existing Users to OmniAuth Users
2021-01-03 14:25:43 +05:30
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/36664) in GitLab 13.4.
2020-11-24 15:15:51 +05:30
You can automatically link OmniAuth users with existing GitLab users if their email addresses match.
For example, the following setting is used to enable the auto link feature for both a SAML provider and the Twitter OAuth provider:
2020-10-24 23:57:45 +05:30
**For Omnibus installations**
```ruby
2020-11-24 15:15:51 +05:30
gitlab_rails['omniauth_auto_link_user'] = ["saml", "twitter"]
2020-10-24 23:57:45 +05:30
```
**For installations from source**
```yaml
omniauth:
2020-11-24 15:15:51 +05:30
auto_link_user: ["saml", "twitter"]
2020-10-24 23:57:45 +05:30
```
2016-06-02 11:05:42 +05:30
## Configure OmniAuth Providers as External
2020-10-24 23:57:45 +05:30
> Introduced in GitLab 8.7.
2016-06-02 11:05:42 +05:30
You can define which OmniAuth providers you want to be `external` so that all users
2021-02-22 17:27:13 +05:30
**creating accounts, or logging in via these providers** can't have
access to internal projects. You must use the full name of the provider,
2016-08-24 12:49:21 +05:30
like `google_oauth2` for Google. Refer to the examples for the full names of the
supported providers.
2021-02-22 17:27:13 +05:30
NOTE:
2021-01-29 00:20:46 +05:30
If you decide to remove an OmniAuth provider from the external providers list,
you must manually update the users that use this method to sign in if you want
their accounts to be upgraded to full internal accounts.
2016-06-02 11:05:42 +05:30
**For Omnibus installations**
```ruby
2019-09-30 21:07:59 +05:30
gitlab_rails['omniauth_external_providers'] = ['twitter', 'google_oauth2']
2016-06-02 11:05:42 +05:30
```
**For installations from source**
```yaml
2019-09-30 21:07:59 +05:30
omniauth:
external_providers: ['twitter', 'google_oauth2']
2016-06-02 11:05:42 +05:30
```
2019-12-21 20:55:43 +05:30
## Using Custom OmniAuth Providers
2015-04-26 12:48:37 +05:30
2021-02-22 17:27:13 +05:30
NOTE:
2016-06-02 11:05:42 +05:30
The following information only applies for installations from source.
2019-12-21 20:55:43 +05:30
GitLab uses [OmniAuth](https://github.com/omniauth/omniauth) for authentication and already ships
2016-06-02 11:05:42 +05:30
with a few providers pre-installed (e.g. LDAP, GitHub, Twitter). But sometimes that
is not enough and you need to integrate with other authentication solutions. For
2019-12-21 20:55:43 +05:30
these cases you can use the OmniAuth provider.
2015-04-26 12:48:37 +05:30
### Steps
2021-02-22 17:27:13 +05:30
These steps are fairly general and you must figure out the exact details
2019-12-21 20:55:43 +05:30
from the OmniAuth provider's documentation.
2015-04-26 12:48:37 +05:30
2019-09-30 21:07:59 +05:30
- Stop GitLab:
2015-04-26 12:48:37 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-09-30 21:07:59 +05:30
sudo service gitlab stop
```
2015-04-26 12:48:37 +05:30
2019-12-21 20:55:43 +05:30
- Add the gem to your [Gemfile](https://gitlab.com/gitlab-org/gitlab/blob/master/Gemfile):
2015-04-26 12:48:37 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-09-30 21:07:59 +05:30
gem "omniauth-your-auth-provider"
```
2015-04-26 12:48:37 +05:30
2019-12-21 20:55:43 +05:30
- Install the new OmniAuth provider gem by running the following command:
2015-04-26 12:48:37 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-09-30 21:07:59 +05:30
sudo -u git -H bundle install --without development test mysql --path vendor/bundle --no-deployment
```
2015-04-26 12:48:37 +05:30
2019-09-30 21:07:59 +05:30
> These are the same commands you used during initial installation in the [Install Gems section](../install/installation.md#install-gems) with `--path vendor/bundle --no-deployment` instead of `--deployment`.
2015-04-26 12:48:37 +05:30
2019-09-30 21:07:59 +05:30
- Start GitLab:
2015-04-26 12:48:37 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-09-30 21:07:59 +05:30
sudo service gitlab start
```
2015-04-26 12:48:37 +05:30
### Examples
2016-06-02 11:05:42 +05:30
If you have successfully set up a provider that is not shipped with GitLab itself,
please let us know.
You can help others by reporting successful configurations and probably share a
few insights or provide warnings for common errors or pitfalls by sharing your
experience [in the public Wiki](https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations).
While we can't officially support every possible authentication mechanism out there,
we'd like to at least help those with specific needs.
## Enable or disable Sign In with an OmniAuth provider without disabling import sources
2020-10-24 23:57:45 +05:30
> Introduced in GitLab 8.8.
2016-06-02 11:05:42 +05:30
Administrators are able to enable or disable Sign In via some OmniAuth providers.
2021-02-22 17:27:13 +05:30
NOTE:
2016-06-02 11:05:42 +05:30
By default Sign In is enabled via all the OAuth Providers that have been configured in `config/gitlab.yml`.
2015-04-26 12:48:37 +05:30
2016-06-02 11:05:42 +05:30
In order to enable/disable an OmniAuth provider, go to Admin Area -> Settings -> Sign-in Restrictions section -> Enabled OAuth Sign-In sources and select the providers you want to enable or disable.
2015-04-26 12:48:37 +05:30
2016-06-02 11:05:42 +05:30
![Enabled OAuth Sign-In sources](img/enabled-oauth-sign-in-sources.png)
2018-03-17 18:26:18 +05:30
2019-12-21 20:55:43 +05:30
## Disabling OmniAuth
2018-12-05 23:21:45 +05:30
2019-12-21 20:55:43 +05:30
Starting from version 11.4 of GitLab, OmniAuth is enabled by default. This only
2018-12-05 23:21:45 +05:30
has an effect if providers are configured and [enabled](#enable-or-disable-sign-in-with-an-omniauth-provider-without-disabling-import-sources).
2019-12-21 20:55:43 +05:30
If OmniAuth providers are causing problems even when individually disabled, you
can disable the entire OmniAuth subsystem by modifying the configuration file:
2018-12-05 23:21:45 +05:30
**For Omnibus installations**
```ruby
gitlab_rails['omniauth_enabled'] = false
```
**For installations from source**
```yaml
2019-09-30 21:07:59 +05:30
omniauth:
enabled: false
2018-12-05 23:21:45 +05:30
```
2018-03-17 18:26:18 +05:30
## Keep OmniAuth user profiles up to date
You can enable profile syncing from selected OmniAuth providers and for all or for specific user information.
2019-07-07 11:18:12 +05:30
When authenticating using LDAP, the user's name and email are always synced.
2018-03-17 18:26:18 +05:30
2018-11-20 20:47:30 +05:30
```ruby
2020-03-13 15:44:24 +05:30
gitlab_rails['omniauth_sync_profile_from_provider'] = ['twitter', 'google_oauth2']
gitlab_rails['omniauth_sync_profile_attributes'] = ['name', 'email', 'location']
2019-09-30 21:07:59 +05:30
```
2018-03-17 18:26:18 +05:30
2018-11-20 20:47:30 +05:30
**For installations from source**
2018-03-17 18:26:18 +05:30
2018-11-20 20:47:30 +05:30
```yaml
2019-09-30 21:07:59 +05:30
omniauth:
sync_profile_from_provider: ['twitter', 'google_oauth2']
sync_profile_attributes: ['email', 'location']
2018-11-20 20:47:30 +05:30
```
2019-12-04 20:38:33 +05:30
## Bypassing two factor authentication
2021-01-29 00:20:46 +05:30
In GitLab 12.3 or later, users can sign in with specified providers _without_
using two factor authentication.
2019-12-04 20:38:33 +05:30
2021-01-29 00:20:46 +05:30
Define the allowed providers using an array (for example, `["twitter", 'google_oauth2']`),
or as `true` or `false` to allow all providers (or none). This option should be
configured only for providers which already have two factor authentication
(default: false). This configuration doesn't apply to SAML.
2019-12-04 20:38:33 +05:30
```ruby
gitlab_rails['omniauth_allow_bypass_two_factor'] = ['twitter', 'google_oauth2']
```
**For installations from source**
```yaml
omniauth:
allow_bypass_two_factor: ['twitter', 'google_oauth2']
```
## Automatically sign in with provider
2021-01-29 00:20:46 +05:30
You can add the `auto_sign_in_with_provider` setting to your GitLab
configuration to redirect login requests to your OmniAuth provider for
authentication, removing the need to click a button before actually signing in.
2019-12-04 20:38:33 +05:30
2021-01-29 00:20:46 +05:30
For example, when using the Azure integration, set the following to enable auto
sign-in:
2019-12-04 20:38:33 +05:30
For Omnibus package:
```ruby
gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'azure_oauth2'
```
For installations from source:
```yaml
omniauth:
auto_sign_in_with_provider: azure_oauth2
```
2021-02-22 17:27:13 +05:30
Keep in mind that every sign-in attempt is redirected to the OmniAuth
provider; you can't sign in using local credentials. Ensure at least
2021-01-29 00:20:46 +05:30
one of the OmniAuth users has admin permissions.
2019-12-04 20:38:33 +05:30
2021-01-29 00:20:46 +05:30
You may also bypass the auto sign in feature by browsing to
2019-12-04 20:38:33 +05:30
`https://gitlab.example.com/users/sign_in?auto_sign_in=false`.
2020-10-24 23:57:45 +05:30
## Passwords for users created via OmniAuth
2021-01-29 00:20:46 +05:30
The [Generated passwords for users created through integrated authentication](../security/passwords_for_integrated_authentication_methods.md)
guide provides an overview about how GitLab generates and sets passwords for
users created with OmniAuth.