GitLab
Integrate GitLab with Pocket ID authentication
Setting this app up requires access to the GitLab configuration file (most likely /etc/gitlab/gitlab.rb) as well shell access for reconfiguring. Below are URLs used as placeholders for the GitLab and Pocket ID instances:
| Placeholder | Replace with |
|---|---|
| gitlab.example.com | URL of your GitLab instance |
| oidc.example.com | URL of your Pocket ID instance |
Pocket ID Setup
- In Pocket ID, create a new OIDC client, named whatever you want.
- (Optional) Set a logo for the OIDC client
- Set the callback URL to
https://gitlab.example.com/users/auth/openid_connect/callback - Copy the
Client IDandClient Secretfor the GitLab Setup
GitLab Setup
You can reference the GitLab documentation for OmniAuth for more information on OmniAuth. There is more detailed information of available features, such as group assignment, of OIDC here.
- Open the config file in an editor of your choice
- Either find the
OmniAuthsection of the config file (around line 579). These next few steps can be done by either uncommenting the options or adding new ones - Enable OmniAuth:
gitlab_rails['omniauth_enabled'] = true - Allow single sign on:
gitlab_rails['omniauth_allow_single_sign_on] = ['openid_connect'] - Create a new provider:
gitlab_rails['omniauth_providers'] = [
{
name: "openid_connect",
label: "Pocket ID",
icon: "https://oidc.example.com/api/application-configuration/logo",
args: {
name: "openid_connect",
scope: ["openid","profile","email"],
response_type: "code",
issuer: "https://oidc.example.com",
discovery: true,
client_auth_method: "query",
uid_field: "preferred_username",
send_scope_to_token_endpoint: "false",
pkce: true,
client_options: {
identifier: "<Client ID>",
secret: "<Client Secret>",
redirect_uri: "https://gitlab.example.com/users/auth/openid_connect/callback"
}
}
}
]
After completing these edits to the configuration file, you will need to reconfigure GitLab:
gitlab-ctl reconfigure
Existing Accounts
After enabling OIDC, existing accounts will need to sign in with a username and password then link their OIDC. This is done from the Profile>Account page (https://gitlab.example.com/-/profile/account). Here, under the Service sign-in section should be a button to Connect Pocket ID, where you can login using Pocket ID. After you do this, you will be able to just use Pocket ID to sign in on the sign in page.
New Accounts
Depending on your GitLab instance's policies, your administrator may need to provision or enable each new account as they are created.