summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStan Hu <stanhu@gmail.com>2019-06-07 14:20:57 -0700
committerStan Hu <stanhu@gmail.com>2019-06-07 14:22:35 -0700
commit0ac84f2bd37ca8fe85951da149ca90836dab3a1b (patch)
tree3a7a366e2340053925c610feea004873f7a13cc9
parentf08abfcc3275c41e3e92e3504188359cc773730c (diff)
downloadgitlab-ce-0ac84f2bd37ca8fe85951da149ca90836dab3a1b.tar.gz
Add OpenID Connect troubleshooting docssh-troubleshooting-openid-docs
-rw-r--r--doc/administration/auth/oidc.md23
1 files changed, 23 insertions, 0 deletions
diff --git a/doc/administration/auth/oidc.md b/doc/administration/auth/oidc.md
index df4f22aa3e7..00422ec347c 100644
--- a/doc/administration/auth/oidc.md
+++ b/doc/administration/auth/oidc.md
@@ -138,3 +138,26 @@ for more details:
}
}
```
+
+### Troubleshooting
+
+If you're having trouble, here are some tips:
+
+1. Ensure `discovery` is set to `true`. Setting it to `false` requires
+specifying all the URLs and keys required to make OpenID work.
+
+1. Check your system clock to ensure the time is synchronized properly.
+
+1. As mentioned in [the
+documentation](https://github.com/m0n9oose/omniauth_openid_connect),
+make sure `issuer` corresponds to the base URL of the Discovery URL. For
+example, `https://accounts.google.com` is used for the URL
+`https://accounts.google.com/.well-known/openid-configuration`.
+
+1. The OpenID Connect client uses HTTP Basic Authentication to send the
+OAuth2 access token. For example, if you are seeing 401 errors upon
+retrieving the `userinfo` endpoint, you may want to check your OpenID
+Web server configuration. For example, for
+[oauth2-server-php](https://github.com/bshaffer/oauth2-server-php), you
+may need to [add a configuration parameter to
+Apache](https://github.com/bshaffer/oauth2-server-php/issues/926#issuecomment-387502778).