Commit 11bac42b authored by Achilleas Pipinellis's avatar Achilleas Pipinellis

Merge branch 'docs-repo-merge-3-integration-ee' into 'master'

Docs: (EE Port) Merge EE doc/​integration to CE

See merge request gitlab-org/gitlab-ee!11465
parents ad2206dc 4e6a56de
...@@ -8,8 +8,8 @@ This document describes how to set up Elasticsearch with GitLab. Once enabled, ...@@ -8,8 +8,8 @@ This document describes how to set up Elasticsearch with GitLab. Once enabled,
you'll have the benefit of fast search response times and the advantage of two you'll have the benefit of fast search response times and the advantage of two
special searches: special searches:
- [Advanced Global Search](../user/search/advanced_global_search.md) - [Advanced Global Search](https://docs.gitlab.com/ee/user/search/advanced_global_search.html)
- [Advanced Syntax Search](../user/search/advanced_search_syntax.md) - [Advanced Syntax Search](https://docs.gitlab.com/ee/user/search/advanced_search_syntax.html)
## Version Requirements ## Version Requirements
<!-- Please remember to update ee/lib/system_check/app/elasticsearch_check.rb if this changes --> <!-- Please remember to update ee/lib/system_check/app/elasticsearch_check.rb if this changes -->
......
...@@ -63,7 +63,7 @@ copied earlier in the 'API Token' field. ...@@ -63,7 +63,7 @@ copied earlier in the 'API Token' field.
For more information, see GitLab Plugin documentation about For more information, see GitLab Plugin documentation about
[Jenkins-to-GitLab authentication](https://github.com/jenkinsci/gitlab-plugin#jenkins-to-gitlab-authentication) [Jenkins-to-GitLab authentication](https://github.com/jenkinsci/gitlab-plugin#jenkins-to-gitlab-authentication)
![Jenkins GitLab plugin configuration](jenkins_gitlab_plugin_config.png) ![Jenkins GitLab plugin configuration](img/jenkins_gitlab_plugin_config.png)
## Configure a Jenkins project ## Configure a Jenkins project
...@@ -93,7 +93,7 @@ from the URL bar of your browser while viewing the Jenkins project. ...@@ -93,7 +93,7 @@ from the URL bar of your browser while viewing the Jenkins project.
Optionally, enter a username and password if your Jenkins server requires Optionally, enter a username and password if your Jenkins server requires
authentication. authentication.
![GitLab service settings](jenkins_gitlab_service_settings.png) ![GitLab service settings](img/jenkins_gitlab_service_settings.png)
## Plugin functional overview ## Plugin functional overview
......
...@@ -21,7 +21,7 @@ Requirements: ...@@ -21,7 +21,7 @@ Requirements:
1. Install [GitLab Hook plugin](https://wiki.jenkins.io/display/JENKINS/GitLab+Hook+Plugin) 1. Install [GitLab Hook plugin](https://wiki.jenkins.io/display/JENKINS/GitLab+Hook+Plugin)
2. Set up jenkins project 2. Set up jenkins project
![screen](jenkins_project.png) ![screen](img/jenkins_project.png)
## GitLab ## GitLab
...@@ -38,7 +38,7 @@ project. For that case we will need a Deploy key. Read the documentation on ...@@ -38,7 +38,7 @@ project. For that case we will need a Deploy key. Read the documentation on
Now navigate to GitLab services page and activate Jenkins Now navigate to GitLab services page and activate Jenkins
![screen](jenkins_gitlab_service.png) ![screen](img/jenkins_gitlab_service.png)
Done! Now when you push to GitLab - it will create a build for Jenkins. Done! Now when you push to GitLab - it will create a build for Jenkins.
And also you will be able to see merge request build status with a link to the Jenkins build. And also you will be able to see merge request build status with a link to the Jenkins build.
......
# SAML OmniAuth Provider # SAML OmniAuth Provider
> This topic is for SAML on self-managed GitLab instances. For SAML on GitLab.com, see [SAML SSO for GitLab.com Groups](../user/group/saml_sso/index.md). > This topic is for SAML on self-managed GitLab instances. For SAML on GitLab.com, see [SAML SSO for GitLab.com Groups](https://docs.gitlab.com/ee/user/group/saml_sso/index.html).
NOTE: **Note:** NOTE: **Note:**
You need to [enable OmniAuth](omniauth.md) in order to use this. You need to [enable OmniAuth](omniauth.md) in order to use this.
...@@ -12,115 +12,115 @@ Microsoft ADFS to authenticate users. ...@@ -12,115 +12,115 @@ Microsoft ADFS to authenticate users.
First configure SAML 2.0 support in GitLab, then register the GitLab application First configure SAML 2.0 support in GitLab, then register the GitLab application
in your SAML IdP: in your SAML IdP:
1. Make sure GitLab is configured with HTTPS. 1. Make sure GitLab is configured with HTTPS.
See [Using HTTPS](../install/installation.md#using-https) for instructions. See [Using HTTPS](../install/installation.md#using-https) for instructions.
1. On your GitLab server, open the configuration file.
1. On your GitLab server, open the configuration file. For omnibus package:
For omnibus package: ```sh
sudo editor /etc/gitlab/gitlab.rb
```
```sh For installations from source:
sudo editor /etc/gitlab/gitlab.rb
```
For installations from source: ```sh
cd /home/git/gitlab
```sh sudo -u git -H editor config/gitlab.yml
cd /home/git/gitlab ```
sudo -u git -H editor config/gitlab.yml 1. To allow your users to use SAML to sign up without having to manually create
``` an account first, don't forget to add the following values to your configuration:
1. To allow your users to use SAML to sign up without having to manually create For omnibus package:
an account first, don't forget to add the following values to your configuration:
For omnibus package: ```ruby
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
gitlab_rails['omniauth_block_auto_created_users'] = false
```
```ruby For installations from source:
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
gitlab_rails['omniauth_block_auto_created_users'] = false
```
For installations from source: ```yaml
omniauth:
enabled: true
allow_single_sign_on: ["saml"]
block_auto_created_users: false
```
```yaml 1. You can also automatically link SAML users with existing GitLab users if their
omniauth: email addresses match by adding the following setting:
enabled: true
allow_single_sign_on: ["saml"]
block_auto_created_users: false
```
1. You can also automatically link SAML users with existing GitLab users if their For omnibus package:
email addresses match by adding the following setting:
For omnibus package: ```ruby
gitlab_rails['omniauth_auto_link_saml_user'] = true
```
```ruby For installations from source:
gitlab_rails['omniauth_auto_link_saml_user'] = true
```
For installations from source: ```yaml
auto_link_saml_user: true
```
```yaml 1. Add the provider configuration:
auto_link_saml_user: true
```
1. Add the provider configuration: For omnibus package:
For omnibus package: ```ruby
gitlab_rails['omniauth_providers'] = [
{
name: 'saml',
args: {
assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
idp_sso_target_url: 'https://login.example.com/idp',
issuer: 'https://gitlab.example.com',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
},
label: 'Company Login' # optional label for SAML login button, defaults to "Saml"
}
]
```
```ruby For installations from source:
gitlab_rails['omniauth_providers'] = [
{
name: 'saml',
args: {
assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
idp_sso_target_url: 'https://login.example.com/idp',
issuer: 'https://gitlab.example.com',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
},
label: 'Company Login' # optional label for SAML login button, defaults to "Saml"
}
]
```
For installations from source: ```yaml
omniauth:
providers:
- {
name: 'saml',
args: {
assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
idp_sso_target_url: 'https://login.example.com/idp',
issuer: 'https://gitlab.example.com',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
},
label: 'Company Login' # optional label for SAML login button, defaults to "Saml"
}
```
```yaml 1. Change the value for `assertion_consumer_service_url` to match the HTTPS endpoint
omniauth: of GitLab (append `users/auth/saml/callback` to the HTTPS URL of your GitLab
providers: installation to generate the correct value).
- {
name: 'saml',
args: {
assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
idp_sso_target_url: 'https://login.example.com/idp',
issuer: 'https://gitlab.example.com',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
},
label: 'Company Login' # optional label for SAML login button, defaults to "Saml"
}
```
1. Change the value for `assertion_consumer_service_url` to match the HTTPS endpoint
of GitLab (append `users/auth/saml/callback` to the HTTPS URL of your GitLab
installation to generate the correct value).
1. Change the values of `idp_cert_fingerprint`, `idp_sso_target_url`, 1. Change the values of `idp_cert_fingerprint`, `idp_sso_target_url`,
`name_identifier_format` to match your IdP. If a fingerprint is used it must `name_identifier_format` to match your IdP. If a fingerprint is used it must
be a SHA1 fingerprint; check be a SHA1 fingerprint; check
[the omniauth-saml documentation](https://github.com/omniauth/omniauth-saml) [the omniauth-saml documentation](https://github.com/omniauth/omniauth-saml)
for more details on these options. for more details on these options.
1. Change the value of `issuer` to a unique name, which will identify the application 1. Change the value of `issuer` to a unique name, which will identify the application
to the IdP. to the IdP.
1. For the changes to take effect, you must [reconfigure][] GitLab if you installed via Omnibus or [restart GitLab][] if you installed from source. 1. For the changes to take effect, you must [reconfigure][] GitLab if you installed via Omnibus or [restart GitLab][] if you installed from source.
1. Register the GitLab SP in your SAML 2.0 IdP, using the application name specified 1. Register the GitLab SP in your SAML 2.0 IdP, using the application name specified
in `issuer`. in `issuer`.
To ease configuration, most IdP accept a metadata URL for the application to provide To ease configuration, most IdP accept a metadata URL for the application to provide
configuration information to the IdP. To build the metadata URL for GitLab, append configuration information to the IdP. To build the metadata URL for GitLab, append
...@@ -268,28 +268,28 @@ If you want some SAML authentication methods to count as 2FA on a per session ba ...@@ -268,28 +268,28 @@ If you want some SAML authentication methods to count as 2FA on a per session ba
1. Edit `/etc/gitlab/gitlab.rb`: 1. Edit `/etc/gitlab/gitlab.rb`:
```ruby ```ruby
gitlab_rails['omniauth_providers'] = [ gitlab_rails['omniauth_providers'] = [
{ {
name: 'saml', name: 'saml',
args: { args: {
assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
idp_sso_target_url: 'https://login.example.com/idp', idp_sso_target_url: 'https://login.example.com/idp',
issuer: 'https://gitlab.example.com', issuer: 'https://gitlab.example.com',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent', name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
upstream_two_factor_authn_contexts: upstream_two_factor_authn_contexts:
%w( %w(
urn:oasis:names:tc:SAML:2.0:ac:classes:CertificateProtectedTransport urn:oasis:names:tc:SAML:2.0:ac:classes:CertificateProtectedTransport
urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS
urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorIGTOKEN urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorIGTOKEN
) )
}, },
label: 'Company Login' # optional label for SAML login button, defaults to "Saml" label: 'Company Login' # optional label for SAML login button, defaults to "Saml"
} }
] ]
``` ```
1. Save the file and [reconfigure][] GitLab for the changes to take effect. 1. Save the file and [reconfigure][] GitLab for the changes to take effect.
...@@ -299,27 +299,27 @@ If you want some SAML authentication methods to count as 2FA on a per session ba ...@@ -299,27 +299,27 @@ If you want some SAML authentication methods to count as 2FA on a per session ba
1. Edit `config/gitlab.yml`: 1. Edit `config/gitlab.yml`:
```yaml ```yaml
omniauth: omniauth:
providers: providers:
- { - {
name: 'saml', name: 'saml',
args: { args: {
assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8',
idp_sso_target_url: 'https://login.example.com/idp', idp_sso_target_url: 'https://login.example.com/idp',
issuer: 'https://gitlab.example.com', issuer: 'https://gitlab.example.com',
name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent', name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
upstream_two_factor_authn_contexts: upstream_two_factor_authn_contexts:
[ [
'urn:oasis:names:tc:SAML:2.0:ac:classes:CertificateProtectedTransport', 'urn:oasis:names:tc:SAML:2.0:ac:classes:CertificateProtectedTransport',
'urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS', 'urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS',
'urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorIGTOKEN' 'urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorIGTOKEN'
] ]
}, },
label: 'Company Login' # optional label for SAML login button, defaults to "Saml" label: 'Company Login' # optional label for SAML login button, defaults to "Saml"
} }
``` ```
1. Save the file and [restart GitLab][] for the changes ot take effect 1. Save the file and [restart GitLab][] for the changes ot take effect
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment