Commit f8ec9dd3 authored by Matus Banas's avatar Matus Banas

added omniauth-shibboleth gem for shibboleth support

added documentation for shibboleth omniauth provider
updated changelog
parent 6b7e80cb
...@@ -25,6 +25,7 @@ v 7.3.0 ...@@ -25,6 +25,7 @@ v 7.3.0
- Process git push --all much faster - Process git push --all much faster
- Don't allow edit of system notes - Don't allow edit of system notes
- Project wiki search (Ralf Seidler) - Project wiki search (Ralf Seidler)
- Enabled Shibboleth authentication support (Matus Banas)
v 7.2.1 v 7.2.1
- Delete orphaned labels during label migration (James Brooks) - Delete orphaned labels during label migration (James Brooks)
......
...@@ -27,6 +27,7 @@ gem 'omniauth', "~> 1.1.3" ...@@ -27,6 +27,7 @@ gem 'omniauth', "~> 1.1.3"
gem 'omniauth-google-oauth2' gem 'omniauth-google-oauth2'
gem 'omniauth-twitter' gem 'omniauth-twitter'
gem 'omniauth-github' gem 'omniauth-github'
gem 'omniauth-shibboleth'
# Extracting information from a git repository # Extracting information from a git repository
# Provide access to Gitlab::Git library # Provide access to Gitlab::Git library
......
...@@ -321,6 +321,8 @@ GEM ...@@ -321,6 +321,8 @@ GEM
omniauth-oauth2 (1.1.1) omniauth-oauth2 (1.1.1)
oauth2 (~> 0.8.0) oauth2 (~> 0.8.0)
omniauth (~> 1.0) omniauth (~> 1.0)
omniauth-shibboleth (1.1.1)
omniauth (>= 1.0.0)
omniauth-twitter (1.0.1) omniauth-twitter (1.0.1)
multi_json (~> 1.3) multi_json (~> 1.3)
omniauth-oauth (~> 1.0) omniauth-oauth (~> 1.0)
...@@ -644,6 +646,7 @@ DEPENDENCIES ...@@ -644,6 +646,7 @@ DEPENDENCIES
omniauth-github omniauth-github
omniauth-google-oauth2 omniauth-google-oauth2
omniauth-twitter omniauth-twitter
omniauth-shibboleth
org-ruby org-ruby
pg pg
poltergeist (~> 1.5.1) poltergeist (~> 1.5.1)
......
...@@ -50,6 +50,13 @@ Before configuring individual OmniAuth providers there are a few global settings ...@@ -50,6 +50,13 @@ Before configuring individual OmniAuth providers there are a few global settings
# - { name: 'github', app_id: 'YOUR APP ID', # - { name: 'github', app_id: 'YOUR APP ID',
# app_secret: 'YOUR APP SECRET', # app_secret: 'YOUR APP SECRET',
# args: { scope: 'user:email' } } # args: { scope: 'user:email' } }
# - {"name": 'shibboleth',
# args: { shib_session_id_field: "HTTP_SHIB_SESSION_ID",
# shib_application_id_field: "HTTP_SHIB_APPLICATION_ID",
# uid_field: "HTTP_EPPN",
# name_field: "HTTP_CN",
# info_fields: {"email": "HTTP_MAIL" } } }
``` ```
1. Change `enabled` to `true`. 1. Change `enabled` to `true`.
...@@ -69,6 +76,7 @@ Before configuring individual OmniAuth providers there are a few global settings ...@@ -69,6 +76,7 @@ Before configuring individual OmniAuth providers there are a few global settings
- [GitHub](github.md) - [GitHub](github.md)
- [Google](google.md) - [Google](google.md)
- [Shibboleth](shibboleth.md)
- [Twitter](twitter.md) - [Twitter](twitter.md)
## Enable OmniAuth for an Existing User ## Enable OmniAuth for an Existing User
......
# Shibboleth OmniAuth Provider
This documentation is for enabling shibboleth with gitlab-omnibus package.
In order to enable Shibboleth support in gitlab we need to use Apache instead of Nginx (It may be possible to use Nginx, however I did not found way to easily configure nginx that is bundled in gitlab-omnibus package). Apache uses mod_shib2 module for shibboleth authentication and can pass attributes as headers to omniauth-shibboleth provider.
To enable the Shibboleth OmniAuth provider you must:
1. Configure Apache shibboleth module. Installation and configuration of module it self is out of scope of this document.
Check https://wiki.shibboleth.net/ for more info.
1. You can find Apache config in gitlab-reciepes (https://github.com/gitlabhq/gitlab-recipes/blob/master/web-server/apache/gitlab-ssl.conf)
Following changes are needed to enable shibboleth:
protect omniauth-shibboleth callback url:
```
<Location /users/auth/shibboleth/callback>
AuthType shibboleth
ShibRequestSetting requireSession 1
ShibUseHeaders On
require valid-user
</Location>
Alias /shibboleth-sp /usr/share/shibboleth
<Location /shibboleth-sp>
Satisfy any
</Location>
<Location /Shibboleth.sso>
SetHandler shib
</Location>
```
exclude shibboleth urls from rewriting, add "RewriteCond %{REQUEST_URI} !/Shibboleth.sso" and "RewriteCond %{REQUEST_URI} !/shibboleth-sp", config should look like this:
```
#apache equivalent of nginx try files
RewriteEngine on
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !/Shibboleth.sso
RewriteCond %{REQUEST_URI} !/shibboleth-sp
RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]
RequestHeader set X_FORWARDED_PROTO 'https'
```
1. Edit /etc/gitlab/gitlab.rb configuration file, your shibboleth attributes should be in form of "HTTP_ATTRIBUTE" and you should addjust them to your need and environment. Add any other configuration you need.
File it should look like this:
```
external_url 'https://gitlab.example.com'
gitlab_rails['internal_api_url'] = 'https://gitlab.example.com'
# disable nginx
nginx['enable'] = false
gitlab_rails['omniauth_allow_single_sign_on'] = true
gitlab_rails['omniauth_block_auto_created_users'] = false
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_providers'] = [
{
"name" => 'shibboleth',
"args" => {
"shib_session_id_field" => "HTTP_SHIB_SESSION_ID",
"shib_application_id_field" => "HTTP_SHIB_APPLICATION_ID",
"uid_field" => 'HTTP_EPPN',
"name_field" => 'HTTP_CN',
"info_fields" => { "email" => 'HTTP_MAIL'}
}
}
]
```
1. Save changes and reconfigure gitlab:
```
sudo gitlab-ctl reconfigure
```
On the sign in page there should now be a "Sign in with: Shibboleth" icon below the regular sign in form. Click the icon to begin the authentication process. You will be redirected to IdP server (Depends on your Shibboleth module configuration). If everything goes well the user will be returned to GitLab and will be signed in.
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment