summaryrefslogtreecommitdiff
path: root/doc/integration/kerberos.md
diff options
context:
space:
mode:
Diffstat (limited to 'doc/integration/kerberos.md')
-rw-r--r--doc/integration/kerberos.md106
1 files changed, 53 insertions, 53 deletions
diff --git a/doc/integration/kerberos.md b/doc/integration/kerberos.md
index 44117755b83..b4f2025265e 100644
--- a/doc/integration/kerberos.md
+++ b/doc/integration/kerberos.md
@@ -1,4 +1,4 @@
-# Kerberos integration **[STARTER ONLY]**
+# Kerberos integration **(STARTER ONLY)**
GitLab can integrate with [Kerberos][kerb] as an authentication mechanism.
@@ -50,20 +50,20 @@ For source installations, make sure the `kerberos` gem group
authentication. In most cases, you only need to enable Kerberos and specify
the location of the keytab:
- ```yaml
- omniauth:
- enabled: true
- allow_single_sign_on: ['kerberos']
+ ```yaml
+ omniauth:
+ enabled: true
+ allow_single_sign_on: ['kerberos']
- kerberos:
- # Allow the HTTP Negotiate authentication method for Git clients
- enabled: true
+ kerberos:
+ # Allow the HTTP Negotiate authentication method for Git clients
+ enabled: true
- # Kerberos 5 keytab file. The keytab file must be readable by the GitLab user,
- # and should be different from other keytabs in the system.
- # (default: use default keytab from Krb5 config)
- keytab: /etc/http.keytab
- ```
+ # Kerberos 5 keytab file. The keytab file must be readable by the GitLab user,
+ # and should be different from other keytabs in the system.
+ # (default: use default keytab from Krb5 config)
+ keytab: /etc/http.keytab
+ ```
1. [Restart GitLab] for the changes to take effect.
@@ -73,13 +73,13 @@ For source installations, make sure the `kerberos` gem group
1. Edit `/etc/gitlab/gitlab.rb`:
- ```ruby
- gitlab_rails['omniauth_enabled'] = true
- gitlab_rails['omniauth_allow_single_sign_on'] = ['kerberos']
+ ```ruby
+ gitlab_rails['omniauth_enabled'] = true
+ gitlab_rails['omniauth_allow_single_sign_on'] = ['kerberos']
- gitlab_rails['kerberos_enabled'] = true
- gitlab_rails['kerberos_keytab'] = "/etc/http.keytab"
- ```
+ gitlab_rails['kerberos_enabled'] = true
+ gitlab_rails['kerberos_keytab'] = "/etc/http.keytab"
+ ```
1. [Reconfigure GitLab] for the changes to take effect.
@@ -149,26 +149,26 @@ keep offering only `basic` authentication.
(e.g., `/etc/nginx/sites-available/gitlab-ssl`) and configure NGINX to
listen to port `8443` in addition to the standard HTTPS port:
- ```conf
- server {
- listen 0.0.0.0:443 ssl;
- listen [::]:443 ipv6only=on ssl default_server;
- listen 0.0.0.0:8443 ssl;
- listen [::]:8443 ipv6only=on ssl;
- ```
+ ```conf
+ server {
+ listen 0.0.0.0:443 ssl;
+ listen [::]:443 ipv6only=on ssl default_server;
+ listen 0.0.0.0:8443 ssl;
+ listen [::]:8443 ipv6only=on ssl;
+ ```
1. Update the Kerberos section of [gitlab.yml]:
- ```yaml
- kerberos:
- # Dedicated port: Git before 2.4 does not fall back to Basic authentication if Negotiate fails.
- # To support both Basic and Negotiate methods with older versions of Git, configure
- # nginx to proxy GitLab on an extra port (e.g. 8443) and uncomment the following lines
- # to dedicate this port to Kerberos authentication. (default: false)
- use_dedicated_port: true
- port: 8443
- https: true
- ```
+ ```yaml
+ kerberos:
+ # Dedicated port: Git before 2.4 does not fall back to Basic authentication if Negotiate fails.
+ # To support both Basic and Negotiate methods with older versions of Git, configure
+ # nginx to proxy GitLab on an extra port (e.g. 8443) and uncomment the following lines
+ # to dedicate this port to Kerberos authentication. (default: false)
+ use_dedicated_port: true
+ port: 8443
+ https: true
+ ```
1. [Restart GitLab] and NGINX for the changes to take effect.
@@ -178,11 +178,11 @@ keep offering only `basic` authentication.
1. Edit `/etc/gitlab/gitlab.rb`:
- ```ruby
- gitlab_rails['kerberos_use_dedicated_port'] = true
- gitlab_rails['kerberos_port'] = 8443
- gitlab_rails['kerberos_https'] = true
- ```
+ ```ruby
+ gitlab_rails['kerberos_use_dedicated_port'] = true
+ gitlab_rails['kerberos_port'] = 8443
+ gitlab_rails['kerberos_https'] = true
+ ```
1. [Reconfigure GitLab] for the changes to take effect.
@@ -214,12 +214,12 @@ remove the OmniAuth provider named `kerberos` from your `gitlab.yml` /
1. Edit [gitlab.yml] and remove the `- { name: 'kerberos' }` line under omniauth
providers:
- ```yaml
- omniauth:
- # ...
- providers:
- - { name: 'kerberos' } # <-- remove this line
- ```
+ ```yaml
+ omniauth:
+ # ...
+ providers:
+ - { name: 'kerberos' } # <-- remove this line
+ ```
1. [Restart GitLab] for the changes to take effect.
@@ -230,11 +230,11 @@ remove the OmniAuth provider named `kerberos` from your `gitlab.yml` /
1. Edit `/etc/gitlab/gitlab.rb` and remove the `{ "name" => "kerberos" }` line
under `gitlab_rails['omniauth_providers']`:
- ```ruby
- gitlab_rails['omniauth_providers'] = [
- { "name" => "kerberos" } # <-- remove this entry
- ]
- ```
+ ```ruby
+ gitlab_rails['omniauth_providers'] = [
+ { "name" => "kerberos" } # <-- remove this entry
+ ]
+ ```
1. [Reconfigure GitLab] for the changes to take effect.
@@ -290,7 +290,7 @@ remote: HTTP Basic: Access denied
fatal: Authentication failed for '<KRB5 path>'
```
-If you are using Git v2.11 or newer and see the above error when cloning, you can
+If you are using Git v2.11 or newer and see the above error when cloning, you can
set the `http.emptyAuth` Git option to `true` to fix this:
```