GitLab steht wegen Wartungsarbeiten am Montag, den 10. Mai, zwischen 17:00 und 19:00 Uhr nicht zur Verfügung.

omniauth.md 5.39 KB
Newer Older
Drew Blessing's avatar
Drew Blessing committed
1 2
# OmniAuth

3
GitLab leverages OmniAuth to allow users to sign in using Twitter, GitHub, and other popular services.
Drew Blessing's avatar
Drew Blessing committed
4

5
Configuring OmniAuth does not prevent standard GitLab authentication or LDAP (if configured) from continuing to work. Users can choose to sign in using any of the configured mechanisms.
Drew Blessing's avatar
Drew Blessing committed
6

7 8 9
- [Initial OmniAuth Configuration](#initial-omniauth-configuration)
- [Supported Providers](#supported-providers)
- [Enable OmniAuth for an Existing User](#enable-omniauth-for-an-existing-user)
10
- [OmniAuth configuration sample when using Omnibus GitLab](https://gitlab.com/gitlab-org/omnibus-gitlab/tree/master#omniauth-google-twitter-github-login)
11 12

## Initial OmniAuth Configuration
Drew Blessing's avatar
Drew Blessing committed
13

14
Before configuring individual OmniAuth providers there are a few global settings that are in common for all providers that we need to consider.
Drew Blessing's avatar
Drew Blessing committed
15

16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
- Omniauth needs to be enabled, see details below for example.
- `allow_single_sign_on` defaults to `false`. If `false` users must be created manually or they will not be able to
sign in via OmniAuth.
- `block_auto_created_users` defaults to `true`. If `true` auto created users will be blocked by default and will
have to be unblocked by an administrator before they are able to sign in.
- **Note:** If you set `allow_single_sign_on` to `true` and `block_auto_created_users` to `false` please be aware
that any user on the Internet will be able to successfully sign in to your GitLab without administrative approval.

If you want to change these settings:

* **For omnibus package**

    Open the configuration file:

    ```sh
    sudo editor /etc/gitlab/gitlab.rb
    ```

    and change

    ```
    gitlab_rails['omniauth_enabled'] = true
    gitlab_rails['omniauth_allow_single_sign_on'] = false
39
    gitlab_rails['omniauth_block_auto_created_users'] = true
40 41 42 43 44
    ```

* **For installations from source**

    Open the configuration file:
Drew Blessing's avatar
Drew Blessing committed
45 46 47 48 49 50 51

    ```sh
    cd /home/git/gitlab

    sudo -u git -H editor config/gitlab.yml
    ```

52
    and change the following section
53

Drew Blessing's avatar
Drew Blessing committed
54
    ```
55
     ## OmniAuth settings
Drew Blessing's avatar
Drew Blessing committed
56 57
      omniauth:
        # Allow login via Twitter, Google, etc. using OmniAuth providers
58
        enabled: true
Drew Blessing's avatar
Drew Blessing committed
59 60 61 62 63 64 65 66

        # CAUTION!
        # This allows users to login without having a user account first (default: false).
        # User accounts will be created automatically when authentication was successful.
        allow_single_sign_on: false
        # Locks down those users until they have been cleared by the admin (default: true).
        block_auto_created_users: true
    ```
67

68
Now we can choose one or more of the Supported Providers below to continue configuration.
69 70

## Supported Providers
Drew Blessing's avatar
Drew Blessing committed
71

72
- [GitHub](github.md)
Douwe Maan's avatar
Douwe Maan committed
73
- [Bitbucket](bitbucket.md)
74
- [GitLab.com](gitlab.md)
75
- [Google](google.md)
Douwe Maan's avatar
Douwe Maan committed
76
- [Facebook](facebook.md)
77
- [Twitter](twitter.md)
Douwe Maan's avatar
Douwe Maan committed
78
- [Shibboleth](shibboleth.md)
Alex Lossent's avatar
Alex Lossent committed
79
- [SAML](saml.md)
Valery Sizov's avatar
Valery Sizov committed
80
- [Crowd](crowd.md)
81
- [Azure](azure.md)
Drew Blessing's avatar
Drew Blessing committed
82

83
## Enable OmniAuth for an Existing User
Drew Blessing's avatar
Drew Blessing committed
84

85
Existing users can enable OmniAuth for specific providers after the account is created. For example, if the user originally signed in with LDAP an OmniAuth provider such as Twitter can be enabled. Follow the steps below to enable an OmniAuth provider for an existing user.
Drew Blessing's avatar
Drew Blessing committed
86 87

1. Sign in normally - whether standard sign in, LDAP, or another OmniAuth provider.
88 89
1. Go to profile settings (the silhouette icon in the top right corner).
1. Select the "Account" tab.
90
1. Under "Connected Accounts" select the desired OmniAuth provider, such as Twitter.
91
1. The user will be redirected to the provider. Once the user authorized GitLab they will be redirected back to GitLab.
Drew Blessing's avatar
Drew Blessing committed
92 93

The chosen OmniAuth provider is now active and can be used to sign in to GitLab from then on.
94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131

## Using Custom Omniauth Providers

GitLab uses [Omniauth](http://www.omniauth.org/) for authentication and already ships with a few providers preinstalled (e.g. LDAP, GitHub, Twitter). But sometimes that is not enough and you need to integrate with other authentication solutions. For these cases you can use the Omniauth provider.

### Steps

These steps are fairly general and you will need to figure out the exact details from the Omniauth provider's documentation.

-   Stop GitLab:

        sudo service gitlab stop

-   Add the gem to your [Gemfile](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/Gemfile):

        gem "omniauth-your-auth-provider"

-   If you're using MySQL, install the new Omniauth provider gem by running the following command:

        sudo -u git -H bundle install --without development test postgres --path vendor/bundle --no-deployment

-   If you're using PostgreSQL, install the new Omniauth provider gem by running the following command:

        sudo -u git -H bundle install --without development test mysql --path vendor/bundle --no-deployment

    > These are the same commands you used in the [Install Gems section](#install-gems) with `--path vendor/bundle --no-deployment` instead of `--deployment`.

-   Start GitLab:

        sudo service gitlab start

### Examples

If you have successfully set up a provider that is not shipped with GitLab itself, please let us know.

You can help others by reporting successful configurations and probably share a few insights or provide warnings for common errors or pitfalls by sharing your experience [in the public Wiki](https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations).

While we can't officially support every possible authentication mechanism out there, we'd like to at least help those with specific needs.