pnp / pnp/cli-microsoft365

Enhancement: Add GitLab CI/CD support to federated identity login

Open
#7,463 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement needs discussion
Dominant language
TypeScript
Stars
1.5k
Forks
413
Avg merge
5d 6h
Merged PRs (30d)
21

Description

Description

login --authType federatedIdentity currently only supports GitHub Actions (via ACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKEN) and Azure DevOps (via SYSTEM_OIDCREQUESTURI). GitLab CI/CD also supports OIDC-based federated authentication through its id_tokens keyword, but there's currently no way to use it with the CLI without falling back to a secret-based app registration.

Proposal

  • Detect GitLab CI via GITLAB_CI and a job-configured OIDC ID token env var (e.g. GITLAB_OIDC_TOKEN, populated by the id_tokens block in .gitlab-ci.yml), and exchange it for an Entra ID access token via the existing federated token exchange, alongside the current GitHub Actions and Azure DevOps support.
  • Update login documentation to describe the required id_tokens configuration and the federated credential issuer/subject requirements for GitLab.

Prior art

PnP PowerShell already implemented the equivalent behaviour for Connect-PnPOnline -FederatedIdentity: https://github.com/pnp/powershell/pull/5395

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the login --authType federatedIdentity path and trace the existing GitHub Actions and Azure DevOps token handling, then review the federated token exchange and login documentation. Done means GitLab CI detection accepts the configured OIDC token, exchanges it successfully, and documents the required id_tokens and federated credential settings.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, gitlab, typescript
Domain
authentication, cli, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.