diff options
| -rw-r--r-- | CHANGELOG | 1 | ||||
| -rw-r--r-- | Gemfile | 1 | ||||
| -rw-r--r-- | Gemfile.lock | 3 | ||||
| -rw-r--r-- | doc/integration/omniauth.md | 8 | ||||
| -rw-r--r-- | doc/integration/shibboleth.md | 78 |
5 files changed, 91 insertions, 0 deletions
diff --git a/CHANGELOG b/CHANGELOG index efecd5ae671..6021da42422 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -25,6 +25,7 @@ v 7.3.0 - Process git push --all much faster - Don't allow edit of system notes - Project wiki search (Ralf Seidler) + - Enabled Shibboleth authentication support (Matus Banas) v 7.2.1 - Delete orphaned labels during label migration (James Brooks) @@ -27,6 +27,7 @@ gem 'omniauth', "~> 1.1.3" gem 'omniauth-google-oauth2' gem 'omniauth-twitter' gem 'omniauth-github' +gem 'omniauth-shibboleth' # Extracting information from a git repository # Provide access to Gitlab::Git library diff --git a/Gemfile.lock b/Gemfile.lock index b20f4169174..dc0037d1592 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -321,6 +321,8 @@ GEM omniauth-oauth2 (1.1.1) oauth2 (~> 0.8.0) omniauth (~> 1.0) + omniauth-shibboleth (1.1.1) + omniauth (>= 1.0.0) omniauth-twitter (1.0.1) multi_json (~> 1.3) omniauth-oauth (~> 1.0) @@ -644,6 +646,7 @@ DEPENDENCIES omniauth-github omniauth-google-oauth2 omniauth-twitter + omniauth-shibboleth org-ruby pg poltergeist (~> 1.5.1) diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md index 367fa0f0dda..00adae58dfa 100644 --- a/doc/integration/omniauth.md +++ b/doc/integration/omniauth.md @@ -50,6 +50,13 @@ Before configuring individual OmniAuth providers there are a few global settings # - { name: 'github', app_id: 'YOUR APP ID', # app_secret: 'YOUR APP SECRET', # args: { scope: 'user:email' } } + # - {"name": 'shibboleth', + # args: { shib_session_id_field: "HTTP_SHIB_SESSION_ID", + # shib_application_id_field: "HTTP_SHIB_APPLICATION_ID", + # uid_field: "HTTP_EPPN", + # name_field: "HTTP_CN", + # info_fields: {"email": "HTTP_MAIL" } } } + ``` 1. Change `enabled` to `true`. @@ -69,6 +76,7 @@ Before configuring individual OmniAuth providers there are a few global settings - [GitHub](github.md) - [Google](google.md) +- [Shibboleth](shibboleth.md) - [Twitter](twitter.md) ## Enable OmniAuth for an Existing User diff --git a/doc/integration/shibboleth.md b/doc/integration/shibboleth.md new file mode 100644 index 00000000000..78317a5c0f2 --- /dev/null +++ b/doc/integration/shibboleth.md @@ -0,0 +1,78 @@ +# Shibboleth OmniAuth Provider + +This documentation is for enabling shibboleth with gitlab-omnibus package. + +In order to enable Shibboleth support in gitlab we need to use Apache instead of Nginx (It may be possible to use Nginx, however I did not found way to easily configure nginx that is bundled in gitlab-omnibus package). Apache uses mod_shib2 module for shibboleth authentication and can pass attributes as headers to omniauth-shibboleth provider. + + +To enable the Shibboleth OmniAuth provider you must: + +1. Configure Apache shibboleth module. Installation and configuration of module it self is out of scope of this document. +Check https://wiki.shibboleth.net/ for more info. + +1. You can find Apache config in gitlab-reciepes (https://github.com/gitlabhq/gitlab-recipes/blob/master/web-server/apache/gitlab-ssl.conf) + +Following changes are needed to enable shibboleth: + +protect omniauth-shibboleth callback url: +``` + <Location /users/auth/shibboleth/callback> + AuthType shibboleth + ShibRequestSetting requireSession 1 + ShibUseHeaders On + require valid-user + </Location> + + Alias /shibboleth-sp /usr/share/shibboleth + <Location /shibboleth-sp> + Satisfy any + </Location> + + <Location /Shibboleth.sso> + SetHandler shib + </Location> +``` +exclude shibboleth urls from rewriting, add "RewriteCond %{REQUEST_URI} !/Shibboleth.sso" and "RewriteCond %{REQUEST_URI} !/shibboleth-sp", config should look like this: +``` + #apache equivalent of nginx try files + RewriteEngine on + RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f + RewriteCond %{REQUEST_URI} !/Shibboleth.sso + RewriteCond %{REQUEST_URI} !/shibboleth-sp + RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA] + RequestHeader set X_FORWARDED_PROTO 'https' +``` + +1. Edit /etc/gitlab/gitlab.rb configuration file, your shibboleth attributes should be in form of "HTTP_ATTRIBUTE" and you should addjust them to your need and environment. Add any other configuration you need. + +File it should look like this: +``` +external_url 'https://gitlab.example.com' +gitlab_rails['internal_api_url'] = 'https://gitlab.example.com' + +# disable nginx +nginx['enable'] = false + +gitlab_rails['omniauth_allow_single_sign_on'] = true +gitlab_rails['omniauth_block_auto_created_users'] = false +gitlab_rails['omniauth_enabled'] = true +gitlab_rails['omniauth_providers'] = [ + { + "name" => 'shibboleth', + "args" => { + "shib_session_id_field" => "HTTP_SHIB_SESSION_ID", + "shib_application_id_field" => "HTTP_SHIB_APPLICATION_ID", + "uid_field" => 'HTTP_EPPN', + "name_field" => 'HTTP_CN', + "info_fields" => { "email" => 'HTTP_MAIL'} + } + } +] + +``` +1. Save changes and reconfigure gitlab: +``` +sudo gitlab-ctl reconfigure +``` + +On the sign in page there should now be a "Sign in with: Shibboleth" icon below the regular sign in form. Click the icon to begin the authentication process. You will be redirected to IdP server (Depends on your Shibboleth module configuration). If everything goes well the user will be returned to GitLab and will be signed in. |