Commit 156642cf authored by Achilleas Pipinellis's avatar Achilleas Pipinellis

Merge branch 'saml-doc-update' into 'master'

Updated SAML and Omniauth docs

Updated SAML and Omniauth docs with information on the new behavior recently introduced in !2882

/cc @ernstvn @DouweM 

See merge request !2950
parents 6aa50165 3f70c8f2
# OmniAuth # OmniAuth
GitLab leverages OmniAuth to allow users to sign in using Twitter, GitHub, and other popular services. GitLab leverages OmniAuth to allow users to sign in using Twitter, GitHub, and
other popular services.
Configuring OmniAuth does not prevent standard GitLab authentication or LDAP (if configured) from continuing to work. Users can choose to sign in using any of the configured mechanisms. Configuring OmniAuth does not prevent standard GitLab authentication or LDAP
(if configured) from continuing to work. Users can choose to sign in using any
of the configured mechanisms.
- [Initial OmniAuth Configuration](#initial-omniauth-configuration) - [Initial OmniAuth Configuration](#initial-omniauth-configuration)
- [Supported Providers](#supported-providers) - [Supported Providers](#supported-providers)
...@@ -28,17 +31,25 @@ contains some settings that are common for all providers. ...@@ -28,17 +31,25 @@ contains some settings that are common for all providers.
## Initial OmniAuth Configuration ## Initial OmniAuth Configuration
Before configuring individual OmniAuth providers there are a few global settings that are in common for all providers that we need to consider. Before configuring individual OmniAuth providers there are a few global settings
that are in common for all providers that we need to consider.
- Omniauth needs to be enabled, see details below for example. - Omniauth needs to be enabled, see details below for example.
- `allow_single_sign_on` defaults to `false`. If `false` users must be created manually or they will not be able to - `allow_single_sign_on` allows you to specify the providers you want to allow to
sign in via OmniAuth. automatically create an account. It defaults to `false`. If `false` users must
- `block_auto_created_users` defaults to `true`. If `true` auto created users will be blocked by default and will be created manually or they will not be able to sign in via OmniAuth.
have to be unblocked by an administrator before they are able to sign in. - `block_auto_created_users` defaults to `true`. If `true` auto created users will
- **Note:** If you set `allow_single_sign_on` to `true` and `block_auto_created_users` to `false` please be aware be blocked by default and will have to be unblocked by an administrator before
that any user on the Internet will be able to successfully sign in to your GitLab without administrative approval. they are able to sign in.
If you want to change these settings: >**Note:**
If you set `block_auto_created_users` to `false`, make sure to only
define providers under `allow_single_sign_on` that you are able to control, like
SAML, Shibboleth, Crowd or Google, or set it to `false` otherwise any user on
the Internet will be able to successfully sign in to your GitLab without
administrative approval.
To change these settings:
* **For omnibus package** * **For omnibus package**
...@@ -48,11 +59,16 @@ If you want to change these settings: ...@@ -48,11 +59,16 @@ If you want to change these settings:
sudo editor /etc/gitlab/gitlab.rb sudo editor /etc/gitlab/gitlab.rb
``` ```
and change and change:
``` ```ruby
gitlab_rails['omniauth_enabled'] = true gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = false
# CAUTION!
# This allows users to login without having a user account first. Define the allowed providers
# using an array, e.g. ["saml", "twitter"], or as true/false to allow all providers or none.
# User accounts will be created automatically when authentication was successful.
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml', 'twitter']
gitlab_rails['omniauth_block_auto_created_users'] = true gitlab_rails['omniauth_block_auto_created_users'] = true
``` ```
...@@ -66,43 +82,57 @@ If you want to change these settings: ...@@ -66,43 +82,57 @@ If you want to change these settings:
sudo -u git -H editor config/gitlab.yml sudo -u git -H editor config/gitlab.yml
``` ```
and change the following section and change the following section:
``` ```yaml
## OmniAuth settings ## OmniAuth settings
omniauth: omniauth:
# Allow login via Twitter, Google, etc. using OmniAuth providers # Allow login via Twitter, Google, etc. using OmniAuth providers
enabled: true enabled: true
# CAUTION! # CAUTION!
# This allows users to login without having a user account first (default: false). # This allows users to login without having a user account first. Define the allowed providers
# using an array, e.g. ["saml", "twitter"], or as true/false to allow all providers or none.
# User accounts will be created automatically when authentication was successful. # User accounts will be created automatically when authentication was successful.
allow_single_sign_on: false allow_single_sign_on: ["saml", "twitter"]
# Locks down those users until they have been cleared by the admin (default: true). # Locks down those users until they have been cleared by the admin (default: true).
block_auto_created_users: true block_auto_created_users: true
``` ```
Now we can choose one or more of the Supported Providers below to continue configuration. Now we can choose one or more of the Supported Providers listed above to continue
the configuration process.
## Enable OmniAuth for an Existing User ## Enable OmniAuth for an Existing User
Existing users can enable OmniAuth for specific providers after the account is created. For example, if the user originally signed in with LDAP an OmniAuth provider such as Twitter can be enabled. Follow the steps below to enable an OmniAuth provider for an existing user. Existing users can enable OmniAuth for specific providers after the account is
created. For example, if the user originally signed in with LDAP, an OmniAuth
provider such as Twitter can be enabled. Follow the steps below to enable an
OmniAuth provider for an existing user.
1. Sign in normally - whether standard sign in, LDAP, or another OmniAuth provider. 1. Sign in normally - whether standard sign in, LDAP, or another OmniAuth provider.
1. Go to profile settings (the silhouette icon in the top right corner). 1. Go to profile settings (the silhouette icon in the top right corner).
1. Select the "Account" tab. 1. Select the "Account" tab.
1. Under "Connected Accounts" select the desired OmniAuth provider, such as Twitter. 1. Under "Connected Accounts" select the desired OmniAuth provider, such as Twitter.
1. The user will be redirected to the provider. Once the user authorized GitLab they will be redirected back to GitLab. 1. The user will be redirected to the provider. Once the user authorized GitLab
they will be redirected back to GitLab.
The chosen OmniAuth provider is now active and can be used to sign in to GitLab from then on. The chosen OmniAuth provider is now active and can be used to sign in to GitLab from then on.
## Using Custom Omniauth Providers ## Using Custom Omniauth Providers
GitLab uses [Omniauth](http://www.omniauth.org/) for authentication and already ships with a few providers preinstalled (e.g. LDAP, GitHub, Twitter). But sometimes that is not enough and you need to integrate with other authentication solutions. For these cases you can use the Omniauth provider. >**Note:**
The following information only applies for installations from source.
GitLab uses [Omniauth](http://www.omniauth.org/) for authentication and already ships
with a few providers pre-installed (e.g. LDAP, GitHub, Twitter). But sometimes that
is not enough and you need to integrate with other authentication solutions. For
these cases you can use the Omniauth provider.
### Steps ### Steps
These steps are fairly general and you will need to figure out the exact details from the Omniauth provider's documentation. These steps are fairly general and you will need to figure out the exact details
from the Omniauth provider's documentation.
- Stop GitLab: - Stop GitLab:
...@@ -128,8 +158,12 @@ These steps are fairly general and you will need to figure out the exact details ...@@ -128,8 +158,12 @@ These steps are fairly general and you will need to figure out the exact details
### Examples ### Examples
If you have successfully set up a provider that is not shipped with GitLab itself, please let us know. If you have successfully set up a provider that is not shipped with GitLab itself,
please let us know.
You can help others by reporting successful configurations and probably share a few insights or provide warnings for common errors or pitfalls by sharing your experience [in the public Wiki](https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations). You can help others by reporting successful configurations and probably share a
few insights or provide warnings for common errors or pitfalls by sharing your
experience [in the public Wiki](https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations).
While we can't officially support every possible authentication mechanism out there, we'd like to at least help those with specific needs. While we can't officially support every possible authentication mechanism out there,
we'd like to at least help those with specific needs.
# SAML OmniAuth Provider # SAML OmniAuth Provider
GitLab can be configured to act as a SAML 2.0 Service Provider (SP). This allows GitLab to consume assertions from a SAML 2.0 Identity Provider (IdP) such as Microsoft ADFS to authenticate users. GitLab can be configured to act as a SAML 2.0 Service Provider (SP). This allows
GitLab to consume assertions from a SAML 2.0 Identity Provider (IdP) such as
Microsoft ADFS to authenticate users.
First configure SAML 2.0 support in GitLab, then register the GitLab application in your SAML IdP: First configure SAML 2.0 support in GitLab, then register the GitLab application
in your SAML IdP:
1. Make sure GitLab is configured with HTTPS. See [Using HTTPS](../install/installation.md#using-https) for instructions. 1. Make sure GitLab is configured with HTTPS.
See [Using HTTPS](../install/installation.md#using-https) for instructions.
1. On your GitLab server, open the configuration file. 1. On your GitLab server, open the configuration file.
...@@ -22,7 +26,40 @@ First configure SAML 2.0 support in GitLab, then register the GitLab application ...@@ -22,7 +26,40 @@ First configure SAML 2.0 support in GitLab, then register the GitLab application
sudo -u git -H editor config/gitlab.yml sudo -u git -H editor config/gitlab.yml
``` ```
1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings. 1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration)
for initial settings.
1. To allow your users to use SAML to sign up without having to manually create
an account first, don't forget to add the following values to your configuration:
For omnibus package:
```ruby
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
gitlab_rails['omniauth_block_auto_created_users'] = false
```
For installations from source:
```yaml
allow_single_sign_on: ["saml"]
block_auto_created_users: false
```
1. You can also automatically link SAML users with existing GitLab users if their
email addresses match by adding the following setting:
For omnibus package:
```ruby
gitlab_rails['omniauth_auto_link_saml_user'] = true
```
For installations from source:
```yaml
auto_link_saml_user: true
```
1. Add the provider configuration: 1. Add the provider configuration:
...@@ -31,7 +68,7 @@ First configure SAML 2.0 support in GitLab, then register the GitLab application ...@@ -31,7 +68,7 @@ First configure SAML 2.0 support in GitLab, then register the GitLab application
```ruby ```ruby
gitlab_rails['omniauth_providers'] = [ gitlab_rails['omniauth_providers'] = [
{ {
"name" => "saml", name: 'saml',
args: { args: {
assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
...@@ -39,7 +76,7 @@ First configure SAML 2.0 support in GitLab, then register the GitLab application ...@@ -39,7 +76,7 @@ First configure SAML 2.0 support in GitLab, then register the GitLab application
issuer: 'https://gitlab.example.com', issuer: 'https://gitlab.example.com',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
}, },
"label" => "Company Login" # optional label for SAML login button, defaults to "Saml" label: 'Company Login' # optional label for SAML login button, defaults to "Saml"
} }
] ]
``` ```
...@@ -47,34 +84,52 @@ First configure SAML 2.0 support in GitLab, then register the GitLab application ...@@ -47,34 +84,52 @@ First configure SAML 2.0 support in GitLab, then register the GitLab application
For installations from source: For installations from source:
```yaml ```yaml
- { name: 'saml', - {
name: 'saml',
args: { args: {
assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
idp_sso_target_url: 'https://login.example.com/idp', idp_sso_target_url: 'https://login.example.com/idp',
issuer: 'https://gitlab.example.com', issuer: 'https://gitlab.example.com',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
} } },
label: 'Company Login' # optional label for SAML login button, defaults to "Saml"
}
``` ```
1. Change the value for 'assertion_consumer_service_url' to match the HTTPS endpoint of GitLab (append 'users/auth/saml/callback' to the HTTPS URL of your GitLab installation to generate the correct value). 1. Change the value for `assertion_consumer_service_url` to match the HTTPS endpoint
of GitLab (append `users/auth/saml/callback` to the HTTPS URL of your GitLab
installation to generate the correct value).
1. Change the values of 'idp_cert_fingerprint', 'idp_sso_target_url', 'name_identifier_format' to match your IdP. Check [the omniauth-saml documentation](https://github.com/PracticallyGreen/omniauth-saml) for details on these options. 1. Change the values of `idp_cert_fingerprint`, `idp_sso_target_url`,
`name_identifier_format` to match your IdP. Check
[the omniauth-saml documentation](https://github.com/omniauth/omniauth-saml)
for details on these options.
1. Change the value of 'issuer' to a unique name, which will identify the application to the IdP. 1. Change the value of `issuer` to a unique name, which will identify the application
to the IdP.
1. Restart GitLab for the changes to take effect. 1. Restart GitLab for the changes to take effect.
1. Register the GitLab SP in your SAML 2.0 IdP, using the application name specified in 'issuer'. 1. Register the GitLab SP in your SAML 2.0 IdP, using the application name specified
in `issuer`.
To ease configuration, most IdP accept a metadata URL for the application to provide configuration information to the IdP. To build the metadata URL for GitLab, append 'users/auth/saml/metadata' to the HTTPS URL of your GitLab installation, for instance: To ease configuration, most IdP accept a metadata URL for the application to provide
configuration information to the IdP. To build the metadata URL for GitLab, append
`users/auth/saml/metadata` to the HTTPS URL of your GitLab installation, for instance:
``` ```
https://gitlab.example.com/users/auth/saml/metadata https://gitlab.example.com/users/auth/saml/metadata
``` ```
At a minimum the IdP *must* provide a claim containing the user's email address, using claim name 'email' or 'mail'. The email will be used to automatically generate the GitLab username. GitLab will also use claims with name 'name', 'first_name', 'last_name' (see [the omniauth-saml gem](https://github.com/PracticallyGreen/omniauth-saml/blob/master/lib/omniauth/strategies/saml.rb) for supported claims). At a minimum the IdP *must* provide a claim containing the user's email address, using
claim name `email` or `mail`. The email will be used to automatically generate the GitLab
username. GitLab will also use claims with name `name`, `first_name`, `last_name`
(see [the omniauth-saml gem](https://github.com/omniauth/omniauth-saml/blob/master/lib/omniauth/strategies/saml.rb)
for supported claims).
On the sign in page there should now be a SAML button below the regular sign in form. Click the icon to begin the authentication process. If everything goes well the user will be returned to GitLab and will be signed in. On the sign in page there should now be a SAML button below the regular sign in form.
Click the icon to begin the authentication process. If everything goes well the user
will be returned to GitLab and will be signed in.
## Troubleshooting ## Troubleshooting
...@@ -82,7 +137,7 @@ If you see a "500 error" in GitLab when you are redirected back from the SAML si ...@@ -82,7 +137,7 @@ If you see a "500 error" in GitLab when you are redirected back from the SAML si
this likely indicates that GitLab could not get the email address for the SAML user. this likely indicates that GitLab could not get the email address for the SAML user.
Make sure the IdP provides a claim containing the user's email address, using claim name Make sure the IdP provides a claim containing the user's email address, using claim name
'email' or 'mail'. The email will be used to automatically generate the GitLab username. `email` or `mail`.
If after signing in into your SAML server you are redirected back to the sign in page and If after signing in into your SAML server you are redirected back to the sign in page and
no error is displayed, check your `production.log` file. It will most likely contain the no error is displayed, check your `production.log` file. It will most likely contain the
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment