sameersbn / sameersbn/docker-gitlab

Fixed name for OAUTH_AUTO_SIGN_IN_WITH_PROVIDER

Open
#2,125 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
8.1k
Forks
2.1k
Avg merge
17h 47m
Merged PRs (30d)
7

Description

The provider list is fixed this creates issues when using the generic oauth2 provider when using a different name.
https://github.com/sameersbn/docker-gitlab/blob/c773d84f452a59a0ffd6c8374883c423c751174b/assets/runtime/functions#L703

This config will restult in an error:

  ## OmniAuth settings
  omniauth:
    # Allow login via Twitter, Google, etc. using OmniAuth providers
    enabled: true

    # Uncomment this to automatically sign in with a specific omniauth provider's without
    # showing GitLab's sign-in page (default: show the GitLab sign-in page)
    auto_sign_in_with_provider: oauth2_generic

    # Sync user's email address from the specified Omniauth provider every time the user logs
    # in (default: nil). And consequently make this field read-only.
    # sync_email_from_provider: cas3

    # CAUTION!
    # This allows users to login without having a user account first. Define the allowed providers
    # using an array, e.g. ["saml", "twitter"], or as true/false to allow all providers or none.
    # User accounts will be created automatically when authentication was successful.
    allow_single_sign_on: []

    # Locks down those users until they have been cleared by the admin (default: true).
    block_auto_created_users: true
    # Look up new users in LDAP servers. If a match is found (same uid), automatically
    # link the omniauth identity with the LDAP account. (default: false)
    auto_link_ldap_user: false

    # Allow users with existing accounts to login and auto link their account via SAML
    # login, without having to do a manual login first and manually add SAML
    # (default: false)
    auto_link_saml_user: false

    # Set different Omniauth providers as external so that all users creating accounts
    # via these providers will not be able to have access to internal projects. You
    # will need to use the full name of the provider, like `google_oauth2` for Google.
    # Refer to the examples below for the full names of the supported providers.
    # (default: [])
    external_providers: []

    ## Auth providers
    # Uncomment the following lines and fill in the data of the auth provider you want to use
    # If your favorite auth provider is not listed you can use others:
    # see https://github.com/gitlabhq/gitlab-public-wiki/wiki/Custom-omniauth-provider-configurations
    # The 'app_id' and 'app_secret' parameters are always passed as the first two
    # arguments, followed by optional 'args' which can be either a hash or an array.
    # Documentation for this is available at http://doc.gitlab.com/ce/integration/omniauth.html
    providers:
      # See omniauth-cas3 for more configuration details
      - { name: 'oauth2_generic',
          app_id: 'gitlab',
          app_secret: 'fa48e546-6a14-4c83-8403-5c4dc9cda14b',
          args: {
            client_options: {
              site: 'https://identity-o.serverhostname.be/',
              user_info_url: 'https://identity-o.serverhostname.be/auth/realms/coolrealm/protocol/openid-connect/userinfo',
              authorize_url: 'https://identity-o.serverhostname.be/auth/realms/coolrealm/protocol/openid-connect/auth',
              token_url: 'https://identity-o.serverhostname.be/auth/realms/coolrealm/protocol/openid-connect/token',
              end_session_endpoint: 'https://identity-o.serverhostname.be/auth/realms/coolrealm/protocol/openid-connect/logout',
                        },
            user_response_structure: {
            id_path: 'sub',
            attributes: {
              uid: 'sub',
              name: 'preferred_username',
              email: 'email'
              }
            },
            name: 'IdentityServer' }}

Results in following error:

Processing by SessionsController#new as HTML
Completed 500 Internal Server Error in 22ms (ActiveRecord: 1.3ms | Elasticsearch: 0.0ms | Allocations: 5544)
  
NoMethodError (undefined method `user_oauth2_generic_omniauth_authorize_path' for #<ActionDispatch::Routing::RoutesProxy:0x0000556b3e8c4890>):
  
app/controllers/sessions_controller.rb:249:in `auto_sign_in_with_provider'
app/controllers/application_controller.rb:479:in `set_current_admin'
lib/gitlab/session.rb:11:in `with_session'
app/controllers/application_controller.rb:470:in `set_session_storage'
lib/gitlab/i18n.rb:55:in `with_locale'
lib/gitlab/i18n.rb:61:in `with_user_locale'
app/controllers/application_controller.rb:464:in `set_locale'
lib/gitlab/error_tracking.rb:34:in `with_context'
app/controllers/application_controller.rb:555:in `sentry_context'
lib/gitlab/application_context.rb:46:in `block in use'
lib/gitlab/application_context.rb:46:in `use'
lib/gitlab/application_context.rb:19:in `with_context'
app/controllers/application_controller.rb:455:in `set_current_context'
lib/gitlab/request_profiler/middleware.rb:17:in `call'
lib/gitlab/middleware/go.rb:20:in `call'
lib/gitlab/etag_caching/middleware.rb:13:in `call'
lib/gitlab/middleware/multipart.rb:121:in `call'
lib/gitlab/middleware/read_only/controller.rb:53:in `call'
lib/gitlab/middleware/read_only.rb:18:in `call'
lib/gitlab/middleware/basic_health_check.rb:25:in `call'
lib/gitlab/middleware/request_context.rb:23:in `call'
config/initializers/fix_local_cache_middleware.rb:9:in `call'
lib/gitlab/metrics/requests_rack_middleware.rb:49:in `call'
lib/gitlab/middleware/release_env.rb:12:in `call'

This problem is fixed replacing the auto_sign_in_with_provider: oauth2_generic with in this case IdentityServer.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at assets/runtime/functions around line 703, then trace the auto_sign_in_with_provider call named in app/controllers/sessions_controller.rb:249. Reproduce the configuration with a custom provider name and verify that automatic sign-in no longer raises the undefined route error for that provider.

Written by the indexing model from the issue text.

Assessment

Tech stack
gitlab, shell
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.