sameersbn / sameersbn/docker-gitlab

OAUTH - multiple providers fails.

Open
#1,382 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

wontfix
Dominant language
Shell
Stars
8.1k
Forks
2.1k
Avg merge
17h 47m
Merged PRs (30d)
7

Description

In trying to configure multiple oauth providers, the setup scripts seem to fail in setting this up.

Using gitlab 10.0.2/3 images (but also tested on 9.5.5 but I have moved past this version).
Also, deploying in GKE/kubernetes.

Variables are defined like this:

    - name: OAUTH_EXTERNAL_PROVIDERS
      value: "'saml', 'google_oauth2'"
    - name: OAUTH_ALLOW_SSO
      value: "'saml', 'google_oauth2'"
    - name: OAUTH_AUTO_SIGN_IN_WITH_PROVIDER
      value: "'saml', 'google_oauth2'"

(I'm also limiting with OAUTH_GOOGLE_RESTRICT_DOMAIN, and this works - saml server I have 100% control over, so no need to restric anything here)

So, with the above, I connected into the container after deploying, and pulled up config/gitlab.yml to verify.
So far...

allow_single_sign_on: ['saml', 'google_oauth2']

Under providers:

    providers:
      # See omniauth-cas3 for more configuration details
      - { name: 'saml',
          label: 'SAML Login',
          args: {
                  assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback',
                  idp_cert_fingerprint: 'XXXXXX',
                  idp_sso_target_url: 'https://XXX/auth/realms/myrealm/protocol/saml',
                  issuer: 'https://gitlab.example.com',
                  attribute_statements: {
                    name: ['urn:oid:2.5.4.42'],
                    email: ['urn:oid:1.2.840.113549.1.9.1'] },
                  name_identifier_format: 'urn:oasis:names:tc:SAML:1.1:nameid-foo
rmat:unspecified' } }

there should be a , at the end of the last } followed by all the config for google_oauth2 - but there is nothing.

Used information from here: https://www.digitalocean.com/community/questions/multiple-oauth-providers-in-gitlab to troubleshoot

Logs during startup also never seem to show google oath being configured.

....
Configuring gitlab::oauth...
Configuring gitlab::oauth::saml...
Configuring gitlab::oauth::saml::attribute_statements...
Configuring gitlab::ldap...
Configuring gitlab::cron_jobs...
Configuring gitlab::backups...
Configuring gitlab::backups::schedule...
Configuring gitlab::registry...
Configuring gitlab::pages...
....

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the OAuth setup scripts that generate config/gitlab.yml, using the reported OAUTH_EXTERNAL_PROVIDERS, OAUTH_ALLOW_SSO, and OAUTH_AUTO_SIGN_IN_WITH_PROVIDER values as the reproduction case. Compare the generated providers section and startup logs with the expected Google OAuth configuration. Done means both SAML and google_oauth2 are configured and reported during startup.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, kubernetes, shell
Domain
authentication, devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.