To enable automatic linking for SAML, see the [SAML setup instructions](saml.md#general-setup).
You can define which OmniAuth providers you want to be `external`. Users
creating accounts, or logging in by using these `external` providers cannot have
access to internal projects. You must use the full name of the provider,
like `google_oauth2` for Google. Refer to the examples for the full names of the
supported providers.
## Create an external providers list
You can define a list of external OmniAuth providers.
Users who create accounts or sign in to GitLab through the listed providers do not get access to [internal projects](../public_access/public_access.md#internal-projects-and-groups).
To define the external providers list, use the full name of the provider,
for example, `google_oauth2` for Google. For provider names, see the
**OmniAuth provider name** column in the [supported providers table](#supported-providers).
NOTE:
If you decide to remove an OmniAuth provider from the external providers list,
you must manually update the users that use this method to sign in if you want
their accounts to be upgraded to full internal accounts.
If you remove an OmniAuth provider from the external providers list,
you must manually update the users that use this sign-in method so their
accounts are upgraded to full internal accounts.
-**For Omnibus installations**
...
...
@@ -184,70 +185,67 @@ their accounts to be upgraded to full internal accounts.
## Use a custom OmniAuth provider
NOTE:
The following information only applies for installations from source.
The following information only applies to installations from source.
GitLab uses [OmniAuth](https://github.com/omniauth/omniauth) for authentication and already ships
with a few providers pre-installed, such as LDAP, GitHub, and Twitter. You may also
have to integrate with other authentication solutions. For
these cases, you can use the OmniAuth provider.
If you have to integrate with an authentication solution other than the [OmniAuth](https://github.com/omniauth/omniauth) providers included with GitLab,
you can use a custom OmniAuth provider.
These steps are fairly general and you must figure out the exact details
from the OmniAuth provider's documentation.
These steps are general. Read the OmniAuth provider's documentation for the exact
implementation details.
- Stop GitLab:
1. Stop GitLab:
```shell
sudo service gitlab stop
```
```shell
sudo service gitlab stop
```
- Add the gem to your [`Gemfile`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/Gemfile):
1. Add the gem to your [`Gemfile`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/Gemfile):
```shell
gem "omniauth-your-auth-provider"
```
```shell
gem "omniauth-your-auth-provider"
```
- Install the new OmniAuth provider gem by running the following command:
1. Install the new OmniAuth provider gem:
```shell
sudo-u git -H bundle install--without development test mysql --path vendor/bundle --no-deployment
```
```shell
sudo-u git -H bundle install--without development test mysql --path vendor/bundle --no-deployment
```
> These are the same commands you used during initial installation in the [Install Gems section](../install/installation.md#install-gems) with `--path vendor/bundle --no-deployment` instead of `--deployment`.
These commands are the same as the commands for [installing gems](../install/installation.md#install-gems)
during initial installation, with `--path vendor/bundle --no-deployment` instead of `--deployment`.
- Start GitLab:
1. Start GitLab:
```shell
sudo service gitlab start
```
```shell
sudo service gitlab start
```
### Custom OmniAuth provider examples
If you have successfully set up a provider that is not shipped with GitLab itself,
please let us know.
If you have successfully set up a provider that is not already integrated with GitLab,
let us know.
While we can't officially support every possible authentication mechanism out there,
we'd like to at least help those with specific needs.
We can't officially support every possible authentication mechanism available,
but we'd like to at least help those with specific needs.
## Enable or disable sign-in with an OmniAuth provider without disabling import sources
Administrators are able to enable or disable **Sign In** by using some OmniAuth providers.
Administrators can enable or disable sign-in for some OmniAuth providers.
NOTE:
By default, **Sign In** is enabled by using all the OAuth Providers that have been configured in `config/gitlab.yml`.
By default, sign-in is enabled for all the OAuth providers configured in `config/gitlab.yml`.
To enable/disable an OmniAuth provider:
To enable or disable an OmniAuth provider:
1. On the top bar, select **Menu > Admin**.
1. On the left sidebar, go to **Settings**.
1. Scroll to the **Sign-in Restrictions** section, and click **Expand**.
1. Below **Enabled OAuth Sign-In sources**, select the checkbox for each provider you want to enable or disable.
