Merge branch '57815' into 'master'

#57815 Omniauth UltraAuth strategy

See merge request gitlab-org/gitlab-ce!26348

8 files changed, 115 insertions, 0 deletions

diff --git a/Gemfile b/Gemfile
index c55e6478cb0..50099f5a3b1 100644
--- a/Gemfile
+++ b/Gemfile
@@ -42,6 +42,7 @@ gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.2.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
 gem 'rack-oauth2', '~> 1.9.3'
+gem "omniauth-ultraauth", '~> 0.0.1'
 gem 'jwt', '~> 2.1.0'
 
 # Spam and anti-bot protection
diff --git a/Gemfile.lock b/Gemfile.lock
index 109958e2591..95c377e2725 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -551,10 +551,26 @@ GEM
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
+    omniauth-ultraauth (0.0.1)
+      omniauth_openid_connect (~> 0.2.4)
     omniauth_crowd (2.2.3)
       activesupport
       nokogiri (>= 1.4.4)
       omniauth (~> 1.0)
+    omniauth_openid_connect (0.2.4)
+      addressable (~> 2.5)
+      omniauth (~> 1.3)
+      openid_connect (~> 1.1)
+    openid_connect (1.1.6)
+      activemodel
+      attr_required (>= 1.0.0)
+      json-jwt (>= 1.5.0)
+      rack-oauth2 (>= 1.6.1)
+      swd (>= 1.0.0)
+      tzinfo
+      validate_email
+      validate_url
+      webfinger (>= 1.0.1)
     opentracing (0.4.3)
     optimist (3.0.0)
     org-ruby (0.9.12)
@@ -865,6 +881,10 @@ GEM
     state_machines-activerecord (0.5.1)
       activerecord (>= 4.1, < 6.0)
       state_machines-activemodel (>= 0.5.0)
+    swd (1.1.2)
+      activesupport (>= 3)
+      attr_required (>= 0.0.5)
+      httpclient (>= 2.4)
     sys-filesystem (1.1.6)
       ffi
     sysexits (1.2.0)
@@ -914,6 +934,12 @@ GEM
       equalizer (~> 0.0.9)
       parser (>= 2.3.1.2, < 2.6)
       procto (~> 0.0.2)
+    validate_email (0.1.6)
+      activemodel (>= 3.0)
+      mail (>= 2.2.5)
+    validate_url (1.0.8)
+      activemodel (>= 3.0.0)
+      public_suffix
     validates_hostname (1.0.6)
       activerecord (>= 3.0)
       activesupport (>= 3.0)
@@ -926,6 +952,9 @@ GEM
     vmstat (2.3.0)
     warden (1.2.7)
       rack (>= 1.0)
+    webfinger (1.1.0)
+      activesupport
+      httpclient (>= 2.4)
     webmock (3.5.1)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
@@ -1086,6 +1115,7 @@ DEPENDENCIES
   omniauth-saml (~> 1.10)
   omniauth-shibboleth (~> 1.3.0)
   omniauth-twitter (~> 1.4)
+  omniauth-ultraauth (~> 0.0.1)
   omniauth_crowd (~> 2.2.0)
   opentracing (~> 0.4.3)
   org-ruby (~> 0.9.12)
diff --git a/changelogs/unreleased/57815.yml b/changelogs/unreleased/57815.yml
new file mode 100644
index 00000000000..ccf76c99f1e
--- /dev/null
+++ b/changelogs/unreleased/57815.yml
@@ -0,0 +1,5 @@
+---
+title: Added Omniauth UltraAuth strategy to GitLab
+merge_request:
+author: Kartikey Tanna
+type: added
diff --git a/doc/integration/img/ultra_auth_credentials.png b/doc/integration/img/ultra_auth_credentials.png
new file mode 100644
index 00000000000..cff98a4b056
--- /dev/null
+++ b/doc/integration/img/ultra_auth_credentials.png
diff --git a/doc/integration/img/ultra_auth_edit_callback_url.png b/doc/integration/img/ultra_auth_edit_callback_url.png
new file mode 100644
index 00000000000..b7548122c5e
--- /dev/null
+++ b/doc/integration/img/ultra_auth_edit_callback_url.png
diff --git a/doc/integration/img/ultra_auth_edit_callback_url_highlighted.png b/doc/integration/img/ultra_auth_edit_callback_url_highlighted.png
new file mode 100644
index 00000000000..4abf224756c
--- /dev/null
+++ b/doc/integration/img/ultra_auth_edit_callback_url_highlighted.png
diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md
index 2932c884d04..7fd39b02fbe 100644
--- a/doc/integration/omniauth.md
+++ b/doc/integration/omniauth.md
@@ -33,6 +33,7 @@ contains some settings that are common for all providers.
 - [Authentiq](../administration/auth/authentiq.md)
 - [OAuth2Generic](oauth2_generic.md)
 - [JWT](../administration/auth/jwt.md)
+- [UltraAuth](ultra_auth.md)
 
 ## Initial OmniAuth Configuration
 
diff --git a/doc/integration/ultra_auth.md b/doc/integration/ultra_auth.md
new file mode 100644
index 00000000000..139cca456aa
--- /dev/null
+++ b/doc/integration/ultra_auth.md
@@ -0,0 +1,78 @@
+# UltraAuth OmniAuth Provider
+
+You can integrate your GitLab instance with [UltraAuth](https://ultraauth.com) to enable users to perform secure biometric authentication to your GitLab instance with your UltraAuth account. Users have to perform the biometric authentication using their mobile device with fingerprint sensor.
+
+## Create UltraAuth Application
+
+To enable UltraAuth OmniAuth provider, you must use UltraAuth's credentials for your GitLab instance.
+To get the credentials (a pair of Client ID and Client Secret), you must register an application on UltraAuth.
+
+1.  Sign in to [UltraAuth](https://ultraauth.com).
+1.  Navigate to [Create an App](https://ultraauth.com/select-strategy) and click on "Ruby on Rails".
+1.  Scroll down the page that is displayed to locate the **Client ID** and **Client Secret**.
+    Keep this page open as you continue configuration.
+    ![UltraAuth Credentials: OPENID_CLIENT_ID and OPENID_CLIENT_SECRET](img/ultra_auth_credentials.png)
+1.  Click on "Edit Callback URL" link.
+    ![Edit UltraAuth Callback URL](img/ultra_auth_edit_callback_url_highlighted.png)
+1.  The callback URL will be `http(s)://<your_domain>/users/auth/ultraauth/callback`
+    ![UltraAuth Callback URL](img/ultra_auth_edit_callback_url.png)
+1.  Select **Register application**.
+1.  On your GitLab server, open the configuration file.
+
+    For omnibus package:
+
+    ```sh
+      sudo editor /etc/gitlab/gitlab.rb
+    ```
+
+    For installations from source:
+
+    ```sh
+      cd /home/git/gitlab
+      sudo -u git -H editor config/gitlab.yml
+    ```
+1.  See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings.
+1.  Add the provider configuration:
+
+    For omnibus package:
+
+    ```ruby
+      gitlab_rails['omniauth_providers'] = [
+        {
+          "name" => "ultraauth",
+          "app_id" => "OPENID_CLIENT_ID",
+          "app_secret" => "OPENID_CLIENT_SECRET",
+          "args" => {
+            "client_options" => {
+              "redirect_uri" => "https://example.com/users/auth/ultraauth/callback"
+            }
+          }
+        }
+      ]
+    ```
+
+    For installation from source:
+
+    ```
+      - { name: 'ultraauth',
+          app_id: 'OPENID_CLIENT_ID',
+          app_secret: 'OPENID_CLIENT_SECRET',
+          args: {
+            client_options: {
+              redirect_uri: 'https://example.com/users/auth/ultraauth/callback'
+            }
+          }
+        }
+    ```
+    __Replace `https://example.com/users/auth/ultraauth/callback` with your application's Callback URL.__
+1.  Change `OPENID_CLIENT_ID` to the Client ID from the UltraAuth application page.
+1.  Change `OPENID_CLIENT_SECRET` to the Client Secret from the UltraAuth application page.
+1.  Save the configuration file.
+1.  [Reconfigure GitLab]( ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure ) or [restart GitLab]( ../administration/restart_gitlab.md#installations-from-source ) for the changes to take effect if you
+    installed GitLab via Omnibus or from source respectively.
+
+On the sign in page, there should now be a UltraAuth icon below the regular sign in form.
+Click the icon to begin the authentication process. UltraAuth will ask the user to sign in and authorize the GitLab application.
+If everything goes well, the user will be returned to GitLab and will be signed in.
+
+**Note:** GitLab requires the email address of each new user. Once the user is logged in using UltraAuth, GitLab will redirect the user to the profile page where they will have to provide the email and verify the email.