On a package installation the authentication settings live in /etc/gitlab/gitlab.rb. What each setting does is described in Overview; this page gives the key it is written under and the shape of its value.

OmniAuth

General parameters

Each general OmniAuth parameter has a gitlab.rb key of its own:

Parameter gitlab.rb key
enabled gitlab_rails['omniauth_enabled']
providers gitlab_rails['omniauth_providers']
allow_single_sign_on gitlab_rails['omniauth_allow_single_sign_on']
block_auto_created_users gitlab_rails['omniauth_block_auto_created_users']
auto_link_ldap_user gitlab_rails['omniauth_auto_link_ldap_user']
auto_link_user gitlab_rails['omniauth_auto_link_user']
auto_sign_in_with_provider gitlab_rails['omniauth_auto_sign_in_with_provider']
external_providers gitlab_rails['omniauth_external_providers']
allow_bypass_two_factor gitlab_rails['omniauth_allow_bypass_two_factor']
sync_profile_from_provider gitlab_rails['omniauth_sync_profile_from_provider']
sync_profile_attributes gitlab_rails['omniauth_sync_profile_attributes'] 
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect']
gitlab_rails['omniauth_block_auto_created_users'] = true
gitlab_rails['omniauth_auto_link_ldap_user'] = true
gitlab_rails['omniauth_sync_profile_attributes'] = ['email']

OpenID Connect provider

A provider is an entry of the gitlab_rails['omniauth_providers'] array. The allowed_groups, admin_groups, auditor_groups and groups_attribute keys sit next to name, at the top level of the entry; the connection parameters sit inside args:

gitlab_rails['omniauth_providers'] = [
  {
    name: 'openid_connect',   # Do not change this value.
    label: 'Keycloak',        # Sign-in button label.
    allowed_groups: ['gitlab'],
    admin_groups: ['admin'],
    auditor_groups: ['audit'],
    groups_attribute: 'gitlab_group',
    args: {
      name: 'openid_connect',
      scope: ['openid', 'profile', 'email'],
      response_type: 'code',
      issuer: 'https://keycloak.example.com/realms/example',
      discovery: true,
      client_auth_method: 'query',
      uid_field: 'preferred_username',
      send_scope_to_token_endpoint: false,
      pkce: true,
      client_options: {
        identifier: '<client_id>',
        secret: '<client_secret>',
        redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'
      }
    }
  }
]

SAML provider

A SAML provider is written as one more entry of the same array:

gitlab_rails['omniauth_providers'] = [
  {
    name: 'saml',
    allowed_groups: ['gitlab'],
    admin_groups: ['admin'],
    groups_attribute: 'gitlab_group'
  }
]

LDAP

LDAP servers

Signing in through LDAP is turned on by gitlab_rails['ldap_enabled']. The servers are described in gitlab_rails['ldap_servers'], whose value is a YAML document: the key of an entry is the server name, and the group_sync section with role_mapping inside it belongs to the server under the main key.

The value is parsed as YAML, so the indentation inside the block is significant and tab characters break it.

gitlab_rails['ldap_enabled'] = true
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
  main:
    label: 'Head office'
    host: ldap-main.example.com
    port: 3389
    uid: 'cn'
    bind_dn: 'uid=viewer,ou=People,dc=example,dc=com'
    password: 'viewer123'
    base: 'ou=People,dc=example,dc=com'
    # Ignore users blocked in the directory (optional).
    user_filter: '(!(nsAccountLock=TRUE))'
    # The user is found in LDAP — sign-in is allowed immediately.
    block_auto_created_users: false
    sync_name: true
    group_sync:
      create_groups: true
      base: 'ou=Groups,dc=example,dc=com'
      filter: '(objectClass=groupOfNames)'
      prefix:
        attribute: 'businessCategory'
        default: 'default-program'
      top_level_group: 'LdapGroups'
      name_mask: '(?<=-)[A-z0-9]*$'
      owner: 'root'
      role_mapping:
        - by_name: '.*-project_manager-.*'
          gitlab_role: 'maintainer'
        - by_name: '.*-developer-.*'
          gitlab_role: 'developer'
        - by_name: '.*-participant-.*'
          gitlab_role: 'reporter'
  contractors:
    label: 'Contractors'
    host: ldap-contractors.example.com
    port: 3389
    uid: 'cn'
    bind_dn: 'uid=viewer,ou=People,dc=contractors,dc=example,dc=com'
    password: 'viewer123'
    base: 'ou=People,dc=contractors,dc=example,dc=com'
EOS

Synchronization schedule

The schedule of the synchronization job is set by its own key, in cron format:

gitlab_rails['ldap_sync_worker_cron'] = "0 * * * *"

Applying the configuration

Every change to /etc/gitlab/gitlab.rb takes effect after:

sudo gitlab-ctl reconfigure
←
Authentication / Configuration
Authentication / Omnibus Docker
→