2.4 KiB
2.4 KiB
title | description | lead | date | draft | images | menu | weight | toc | community | ||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GitLab | Integrating GitLab with the Authelia OpenID Connect Provider. | 2022-06-15T17:51:47+10:00 | false |
|
620 | true | true |
Tested Versions
Before You Begin
{{% oidc-common %}}
Assumptions
This example makes the following assumptions:
- Application Root URL:
https://gitlab.example.com
- Authelia Root URL:
https://auth.example.com
- Client ID:
gitlab
- Client Secret:
insecure_secret
Configuration
Application
To configure GitLab to utilize Authelia as an OpenID Connect 1.0 Provider:
- Add the Omnibus OpenID Connect 1.0 OmniAuth configuration to
gitlab.rb
:
gitlab_rails['omniauth_providers'] = [
{
name: "openid_connect",
label: "Authelia",
icon: "https://www.authelia.com/images/branding/logo-cropped.png",
args: {
name: "openid_connect",
scope: ["openid","profile","email","groups"],
response_type: "code",
issuer: "https://auth.example.com",
discovery: true,
client_auth_method: "query",
uid_field: "preferred_username",
send_scope_to_token_endpoint: "false",
client_options: {
identifier: "gitlab",
secret: "insecure_secret",
redirect_uri: "https://gitlab.example.com/users/auth/openid_connect/callback"
}
}
}
]
Authelia
The following YAML configuration is an example Authelia client configuration for use with GitLab which will operate with the above example:
- id: gitlab
description: GitLab
secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
public: false
authorization_policy: two_factor
redirect_uris:
- https://gitlab.example.com/users/auth/openid_connect/callback
scopes:
- openid
- profile
- groups
- email
userinfo_signing_algorithm: none