Add support for Omniauth OpenID Connect login.

sachilles · Jun 18, 2024 · f30613b · f30613b
1 parent 0b1a014
commit f30613b
Show file tree

Hide file tree

Showing 4 changed files with 90 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -46,6 +46,7 @@
         - [Crowd](#crowd)
         - [Microsoft Azure](#microsoft-azure)
         - [Generic OAuth2](#Generic-OAuth2)
+        - [OpenID Connect](#OpenID-Connect)
     - [Gitlab Pages](#gitlab-pages)
     - [External Issue Trackers](#external-issue-trackers)
     - [Host UID / GID Mapping](#host-uid--gid-mapping)
@@ -725,6 +726,30 @@ As an example this code has been tested with Keycloak, with the following variab
 
 See [GitLab documentation](https://docs.gitlab.com/ee/integration/oauth2_generic.html#sign-into-gitlab-with-almost-any-oauth2-provider) and [Omniauth-oauth2-generic documentation](https://gitlab.com/satorix/omniauth-oauth2-generic) for more details.
 
+##### OpenID Connect
+
+To enable OpenID Connect provider, you must register your application with your provider. You also need to confirm OpenID Connect provider app's ID and secret, the client options and the user's response structure.
+
+To use OIDC set at least `OAUTH_OIDC_ISSUER` and `OAUTH_OIDC_CLIENT_ID`.
+
+| GitLab setting | environment variable |
+|----------------|----------------------|
+| `label` | `OAUTH_OIDC_LABEL` |
+| `icon` | `OAUTH_OIDC_ICON` |
+| `scope`| `OAUTH_OIDC_SCOPE` |
+| `response_type` | `OAUTH_OIDC_RESPONSE_TYPE` |
+| `issuer` | `OAUTH_OIDC_ISSUER` |
+| `discovery` | `OAUTH_OIDC_DISCOVERY` |
+| `client_auth_method` | `OAUTH_OIDC_CLIENT_AUTH_METHOD` |
+| `uid_field` | `OAUTH_OIDC_UID_FIELD` |
+| `send_scope_to_token_endpoint` | `OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP` |
+| `pkce` | `OAUTH_OIDC_PKCE` |
+| `client_options.identifier` | `OAUTH_OIDC_CLIENT_ID` |
+| `client_options.secret` | `OAUTH_OIDC_CLIENT_SECRET` |
+| `client_options.redirect_uri` | `OAUTH_OIDC_REDIRECT_URI` |
+
+See [GitLab OIDC documentation](https://docs.gitlab.com/ee/administration/auth/oidc.html) and [OmniAuth OpenID Connect documentation](https://github.com/omniauth/omniauth_openid_connect/).
+
 #### Gitlab Pages
 
 Gitlab Pages allows a user to host static websites from a project. Gitlab pages can be enabled with setting the envrionment variable `GITLAB_PAGES_ENABLED` to `true`.

diff --git a/assets/runtime/config/gitlabhq/gitlab.yml b/assets/runtime/config/gitlabhq/gitlab.yml
@@ -1031,6 +1031,23 @@ production: &base
             client_id: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_CLIENT_ID}}',
             client_secret: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_CLIENT_SECRET}}',
             tenant_id: '{{OAUTH_AZURE_ACTIVEDIRECTORY_V2_TENANT_ID}}' } }
+      - { name: 'openid_connect',
+          label: '{{OAUTH_OIDC_LABEL}}',
+          icon: '{{OAUTH_OIDC_ICON}}',
+          args: {
+            name: 'openid_connect',
+            scope: {{OAUTH_OIDC_SCOPE}},
+            response_type: '{{OAUTH_OIDC_RESPONSE_TYPE}}',
+            issuer: '{{OAUTH_OIDC_ISSUER}}',
+            discovery: {{OAUTH_OIDC_DISCOVERY}},
+            client_auth_method: '{{OAUTH_OIDC_CLIENT_AUTH_METHOD}}',
+            uid_field: '{{OAUTH_OIDC_UID_FIELD}}',
+            send_scope_to_token_endpoint: {{OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP}},
+            pkce: {{OAUTH_OIDC_PKCE}},
+            client_options: {
+              identifier: '{{OAUTH_OIDC_CLIENT_ID}}',
+              secret: '{{OAUTH_OIDC_CLIENT_SECRET}}',
+              redirect_uri: '{{OAUTH_OIDC_REDIRECT_URI}}' } } }
 
     # SSO maximum session duration in seconds. Defaults to CAS default of 8 hours.
     # cas3:

diff --git a/assets/runtime/env-defaults b/assets/runtime/env-defaults
@@ -537,6 +537,28 @@ OAUTH2_GENERIC_AUTHORIZE_PARAMS_SCOPE=${OAUTH2_GENERIC_AUTHORIZE_PARAMS_SCOPE:-}
 OAUTH2_GENERIC_LABEL=${OAUTH2_GENERIC_LABEL:-}
 OAUTH2_GENERIC_NAME=${OAUTH2_GENERIC_NAME:-}
 
+### OpenID Connect
+OAUTH_OIDC_LABEL=${OAUTH_OIDC_LABEL:-'OpenID Connect'}
+OAUTH_OIDC_ICON=${OAUTH_OIDC_ICON:-}
+OAUTH_OIDC_SCOPE=${OAUTH_OIDC_SCOPE:-"['openid','profile','email']"}
+OAUTH_OIDC_RESPONSE_TYPE=${OAUTH_OIDC_RESPONSE_TYPE:-'code'}
+OAUTH_OIDC_ISSUER=${OAUTH_OIDC_ISSUER:-}
+OAUTH_OIDC_DISCOVERY=${OAUTH_OIDC_DISCOVERY:-true}
+OAUTH_OIDC_CLIENT_AUTH_METHOD=${OAUTH_OIDC_CLIENT_AUTH_METHOD:-'query'}
+OAUTH_OIDC_UID_FIELD=${OAUTH_OIDC_UID_FIELD:-sub}
+OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP=${OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP:-false}
+OAUTH_OIDC_PKCE=${OAUTH_OIDC_PKCE:-true}
+OAUTH_OIDC_CLIENT_ID=${OAUTH_OIDC_CLIENT_ID:-}
+OAUTH_OIDC_CLIENT_SECRET=${OAUTH_OIDC_CLIENT_SECRET:-'secret'}
+case $GITLAB_HTTPS in
+  true)
+    OAUTH_OIDC_REDIRECT_URI=${OAUTH_OIDC_REDIRECT_URI:-https://${GITLAB_HOST}/users/auth/openid_connect/callback}
+    ;;
+  false)
+    OAUTH_OIDC_REDIRECT_URI=${OAUTH_OIDC_REDIRECT_URI:-http://${GITLAB_HOST}/users/auth/openid_connect/callback}
+    ;;
+esac
+
 ## ANALYTICS
 
 ### GOOGLE

diff --git a/assets/runtime/functions b/assets/runtime/functions
@@ -793,6 +793,30 @@ gitlab_configure_oauth_azure_ad_v2() {
   fi
 }
 
+gitlab_configure_oauth_oidc() {
+  if [[ -n ${OAUTH_OIDC_ISSUER} && \
+        -n ${OAUTH_OIDC_CLIENT_ID} ]]; then
+    echo "Configuring gitlab::oauth::oidc..."
+    OAUTH_ENABLED=${OAUTH_ENABLED:-true}
+    update_template ${GITLAB_CONFIG} \
+      OAUTH_OIDC_LABEL \
+      OAUTH_OIDC_ICON \
+      OAUTH_OIDC_SCOPE \
+      OAUTH_OIDC_RESPONSE_TYPE \
+      OAUTH_OIDC_ISSUER \
+      OAUTH_OIDC_DISCOVERY \
+      OAUTH_OIDC_CLIENT_AUTH_METHOD \
+      OAUTH_OIDC_UID_FIELD \
+      OAUTH_OIDC_SEND_SCOPE_TO_TOKEN_EP \
+      OAUTH_OIDC_PKCE \
+      OAUTH_OIDC_CLIENT_ID \
+      OAUTH_OIDC_CLIENT_SECRET \
+      OAUTH_OIDC_REDIRECT_URI
+  else
+    exec_as_git sed -i "/name: 'openid_connect'/,/{{OAUTH_OIDC_REDIRECT_URI}}/d" ${GITLAB_CONFIG}
+  fi
+}
+
 gitlab_configure_oauth() {
   echo "Configuring gitlab::oauth..."
 
@@ -810,6 +834,7 @@ gitlab_configure_oauth() {
   gitlab_configure_oauth_auth0
   gitlab_configure_oauth_azure
   gitlab_configure_oauth_azure_ad_v2
+  gitlab_configure_oauth_oidc
 
   OAUTH_ENABLED=${OAUTH_ENABLED:-false}
   update_template ${GITLAB_CONFIG} \
@@ -823,7 +848,7 @@ gitlab_configure_oauth() {
     OAUTH_ALLOW_BYPASS_TWO_FACTOR
 
   case ${OAUTH_AUTO_SIGN_IN_WITH_PROVIDER} in
-    cas3|google_oauth2|facebook|twitter|github|gitlab|bitbucket|saml|crowd|azure_oauth2|azure_activedirectory_v2|oauth2_generic|$OAUTH2_GENERIC_NAME)
+    cas3|google_oauth2|facebook|twitter|github|gitlab|bitbucket|saml|crowd|azure_oauth2|azure_activedirectory_v2|oauth2_generic|$OAUTH2_GENERIC_NAME|oidc)
       update_template ${GITLAB_CONFIG} OAUTH_AUTO_SIGN_IN_WITH_PROVIDER
       ;;
     *)