Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e6a3ce7

Browse files
ericpaulsenericpaulsen
authored
docs: add GitLab auth docs (#5923)
1 parent b31b0fd commit e6a3ce7

File tree

1 file changed

+54
-11
lines changed

1 file changed

+54
-11
lines changed

‎docs/admin/auth.md

Lines changed: 54 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,52 @@ CODER_OAUTH2_GITHUB_ALLOW_EVERYONE=true
4646

4747
Once complete, run `sudo service coder restart` to reboot Coder.
4848

49-
## OpenID Connect with Google
49+
## GitLab
50+
51+
### Step 1: Configure the OAuth application in your GitLab instance
52+
53+
First, [register a GitLab OAuth application](https://docs.gitlab.com/ee/integration/oauth_provider.html). GitLab will ask you for the following parameter:
54+
55+
- **Redirect URI**: Set to `https://coder.domain.com/api/v2/users/oidc/callback`
56+
57+
### Step 2: Configure Coder with the OpenID Connect credentials
58+
59+
Navigate to your Coder host and run the following command to start up the Coder
60+
server:
61+
62+
```console
63+
coder server --oidc-issuer-url="https://gitlab.com" --oidc-email-domain="your-domain-1,your-domain-2" --oidc-client-id="533...des" --oidc-client-secret="G0CSP...7qSM"
64+
```
65+
66+
Alternatively, if you are running Coder as a system service, you can achieve the
67+
same result as the command above by adding the following environment variables
68+
to the `/etc/coder.d/coder.env` file:
69+
70+
```console
71+
CODER_OIDC_ISSUER_URL="https://gitlab.com"
72+
CODER_OIDC_EMAIL_DOMAIN="your-domain-1,your-domain-2"
73+
CODER_OIDC_CLIENT_ID="533...des"
74+
CODER_OIDC_CLIENT_SECRET="G0CSP...7qSM"
75+
```
76+
77+
Once complete, run `sudo service coder restart` to reboot Coder.
5078

51-
> We describe how to set up the most popular OIDC provider, Google, but any (Okta, Azure Active Directory, GitLab, Auth0, etc.) may be used.
79+
### Additional Notes
80+
81+
GitLab maintains configuration settings for OIDC applications at the following URL:
82+
83+
```console
84+
https://gitlab.com/.well-known/openid-configuration
85+
```
86+
87+
If you are using a self-hosted GitLab instance, replace `gitlab.com` in the above URL
88+
with your internal domain. The same will apply for the `OIDC_ISSUER_URL` variable.
89+
90+
## OpenID Connect with Google
5291

5392
### Step 1: Configure the OAuth application on Google Cloud
5493

55-
First, [register a Google OAuth app](https://support.google.com/cloud/answer/6158849?hl=en). Google will ask you for the following Coder parameters:
94+
First, [register a Google OAuth application](https://support.google.com/cloud/answer/6158849?hl=en). Google will ask you for the following Coder parameters:
5695

5796
- **Authorized JavaScript origins**: Set to your Coder domain (e.g. `https://coder.domain.com`)
5897
- **Redirect URIs**: Set to `https://coder.domain.com/api/v2/users/oidc/callback`
@@ -79,14 +118,7 @@ CODER_OIDC_CLIENT_SECRET="G0CSP...7qSM"
79118

80119
Once complete, run `sudo service coder restart` to reboot Coder.
81120

82-
> When a new user is created, the `preferred_username` claim becomes the username. If this claim is empty, the email address will be stripped of the domain, and become the username (e.g. `[email protected]` becomes `example`).
83-
84-
If your OpenID Connect provider requires client TLS certificates for authentication, you can configure them like so:
85-
86-
```console
87-
CODER_TLS_CLIENT_CERT_FILE=/path/to/cert.pem
88-
CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
89-
```
121+
## OIDC Claims
90122

91123
Coder requires all OIDC email addresses to be verified by default. If the `email_verified` claim is present in the token response from the identity provider, Coder will validate that its value is `true`.
92124
If needed, you can disable this behavior with the following setting:
@@ -97,6 +129,8 @@ CODER_OIDC_IGNORE_EMAIL_VERIFIED=true
97129

98130
> **Note:** This will cause Coder to implicitly treat all OIDC emails as "verified".
99131
132+
When a new user is created, the `preferred_username` claim becomes the username. If this claim is empty, the email address will be stripped of the domain, and become the username (e.g. `[email protected]` becomes `example`).
133+
100134
## SCIM (enterprise)
101135

102136
Coder supports user provisioning and deprovisioning via SCIM 2.0 with header
@@ -107,3 +141,12 @@ auth key and supply it the Coder server.
107141
```console
108142
CODER_SCIM_API_KEY="your-api-key"
109143
```
144+
145+
## TLS
146+
147+
If your OpenID Connect provider requires client TLS certificates for authentication, you can configure them like so:
148+
149+
```console
150+
CODER_TLS_CLIENT_CERT_FILE=/path/to/cert.pem
151+
CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
152+
```

0 commit comments

Comments
 (0)