shibboleth.md 5.36 KB
Newer Older
1 2
# Shibboleth OmniAuth Provider

3
This documentation is for enabling shibboleth with omnibus-gitlab package.
4

Sean McGivern's avatar
Sean McGivern committed
5
In order to enable Shibboleth support in gitlab we need to use Apache instead of Nginx (It may be possible to use Nginx, however this is difficult to configure using the bundled Nginx provided in the omnibus-gitlab package). Apache uses mod_shib2 module for shibboleth authentication and can pass attributes as headers to omniauth-shibboleth provider.
6 7 8 9


To enable the Shibboleth OmniAuth provider you must:

10
1. Configure Apache shibboleth module. Installation and configuration of module it self is out of scope of this document.
11 12
Check https://wiki.shibboleth.net/ for more info.

13
1. You can find Apache config in gitlab-recipes (https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/apache)
14 15 16

Following changes are needed to enable shibboleth:

17
protect omniauth-shibboleth callback URL:
18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34
```
  <Location /users/auth/shibboleth/callback>
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    ShibUseHeaders On
    require valid-user
  </Location>

  Alias /shibboleth-sp /usr/share/shibboleth
  <Location /shibboleth-sp>
    Satisfy any
  </Location>

  <Location /Shibboleth.sso>
    SetHandler shib
  </Location>
```
35
exclude shibboleth URLs from rewriting, add "RewriteCond %{REQUEST_URI} !/Shibboleth.sso" and "RewriteCond %{REQUEST_URI} !/shibboleth-sp", config should look like this:
36
```
37
  # Apache equivalent of Nginx try files
38 39
  RewriteEngine on
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
40 41
  RewriteCond %{REQUEST_URI} !/Shibboleth.sso
  RewriteCond %{REQUEST_URI} !/shibboleth-sp
42 43 44 45
  RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]
  RequestHeader set X_FORWARDED_PROTO 'https'
```

46 47 48 49 50 51 52 53 54 55 56 57 58
1. Edit /etc/gitlab/gitlab.rb configuration file to enable OmniAuth and add
Shibboleth as an OmniAuth provider. User attributes will be sent from the
Apache reverse proxy to GitLab as headers with the names from the Shibboleth
attribute mapping. Therefore the values of the `args` hash
should be in the form of `"HTTP_ATTRIBUTE"`. The keys in the hash are arguments
to the [OmniAuth::Strategies::Shibboleth class](https://github.com/toyokazu/omniauth-shibboleth/blob/master/lib/omniauth/strategies/shibboleth.rb)
and are documented by the [omniauth-shibboleth gem](https://github.com/toyokazu/omniauth-shibboleth)
(take care to note the version of the gem packaged with GitLab). If some of
your users appear to be authenticated by Shibboleth and Apache, but GitLab
rejects their account with a URI that contains "e-mail is invalid" then your
Shibboleth Identity Provider or Attribute Authority may be asserting multiple
e-mail addresses. In this instance, you might consider setting the
`multi_values` argument to `first`.
59

60
File should look like this:
61 62 63 64
```
external_url 'https://gitlab.example.com'
gitlab_rails['internal_api_url'] = 'https://gitlab.example.com'

65
# disable Nginx
66 67 68 69 70 71 72
nginx['enable'] = false

gitlab_rails['omniauth_allow_single_sign_on'] = true
gitlab_rails['omniauth_block_auto_created_users'] = false
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_providers'] = [
  {
73 74 75 76
    "name"  => "'shibboleth"',
    "label" => "Text for Login Button",
    "args"  => {
        "shib_session_id_field"     => "HTTP_SHIB_SESSION_ID",
77
        "shib_application_id_field" => "HTTP_SHIB_APPLICATION_ID",
78 79
        "uid_field"                 => 'HTTP_EPPN',
        "name_field"                => 'HTTP_CN',
80
        "info_fields" => { "email" => 'HTTP_MAIL'}
81
    }
82 83 84 85
  }
]

```
86 87 88

1. [Reconfigure][] or [restart GitLab][] for the changes to take effect if you
   installed GitLab via Omnibus or from source respectively.
89 90

On the sign in page there should now be a "Sign in with: Shibboleth" icon below the regular sign in form. Click the icon to begin the authentication process. You will be redirected to IdP server (Depends on your Shibboleth module configuration). If everything goes well the user will be returned to GitLab and will be signed in.
91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122

## Apache 2.4 / GitLab 8.6 update
The order of the first 2 Location directives is important. If they are reversed,
you will not get a shibboleth session!

```
  <Location />
    Require all granted
    ProxyPassReverse http://127.0.0.1:8181
    ProxyPassReverse http://YOUR_SERVER_FQDN/
  </Location>

  <Location /users/auth/shibboleth/callback>
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    ShibUseHeaders On
    Require shib-session
  </Location>

  Alias /shibboleth-sp /usr/share/shibboleth

  <Location /shibboleth-sp>
    Require all granted
  </Location>

  <Location /Shibboleth.sso>
    SetHandler shib
  </Location>

  RewriteEngine on

  #Don't escape encoded characters in api requests
123
  RewriteCond %{REQUEST_URI} ^/api/v4/.*
124 125 126 127 128 129 130 131 132 133 134 135 136
  RewriteCond %{REQUEST_URI} !/Shibboleth.sso
  RewriteCond %{REQUEST_URI} !/shibboleth-sp
  RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA,NE]

  #Forward all requests to gitlab-workhorse except existing files
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f [OR]
  RewriteCond %{REQUEST_URI} ^/uploads/.*
  RewriteCond %{REQUEST_URI} !/Shibboleth.sso
  RewriteCond %{REQUEST_URI} !/shibboleth-sp
  RewriteRule .* http://127.0.0.1:8181%{REQUEST_URI} [P,QSA]

  RequestHeader set X_FORWARDED_PROTO 'https'
  RequestHeader set X-Forwarded-Ssl on
137 138 139
```

[reconfigure]: ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure
140
[restart GitLab]: ../administration/restart_gitlab.md#installations-from-source