Skip to content

G
gitlab-ce
Commit 209619de authored by Evan Read's avatar Evan Read
Browse files
Options

Fix markdown to render correctly

parent 60261d9d
Hide whitespace changes
Inline Side-by-side
Showing with 85 additions and 85 deletions
doc/integration/shibboleth.md
View file @ 209619de
...@@ -4,92 +4,95 @@ This documentation is for enabling shibboleth with omnibus-gitlab package. ...@@ -4,92 +4,95 @@ This documentation is for enabling shibboleth with omnibus-gitlab package.
In order to enable Shibboleth support in gitlab we need to use Apache instead of Nginx (It may be possible to use Nginx, however this is difficult to configure using the bundled Nginx provided in the omnibus-gitlab package). Apache uses mod_shib2 module for shibboleth authentication and can pass attributes as headers to omniauth-shibboleth provider. In order to enable Shibboleth support in gitlab we need to use Apache instead of Nginx (It may be possible to use Nginx, however this is difficult to configure using the bundled Nginx provided in the omnibus-gitlab package). Apache uses mod_shib2 module for shibboleth authentication and can pass attributes as headers to omniauth-shibboleth provider.
To enable the Shibboleth OmniAuth provider you must configure Apache shibboleth module.
To enable the Shibboleth OmniAuth provider you must: Installation and configuration of module it self is out of scope of this document.
Check <https://wiki.shibboleth.net/> for more info.
1. Configure Apache shibboleth module. Installation and configuration of module it self is out of scope of this document.
Check https://wiki.shibboleth.net/ for more info. You can find Apache config in gitlab-recipes (<https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/apache>).
1. You can find Apache config in gitlab-recipes (https://gitlab.com/gitlab-org/gitlab-recipes/tree/master/web-server/apache) The following changes are needed to enable Shibboleth:
Following changes are needed to enable shibboleth: 1. Protect omniauth-shibboleth callback URL:
protect omniauth-shibboleth callback URL: ```
``` <Location /users/auth/shibboleth/callback>
<Location /users/auth/shibboleth/callback> AuthType shibboleth
AuthType shibboleth ShibRequestSetting requireSession 1
ShibRequestSetting requireSession 1 ShibUseHeaders On
ShibUseHeaders On require valid-user
require valid-user </Location>
</Location>
Alias /shibboleth-sp /usr/share/shibboleth
Alias /shibboleth-sp /usr/share/shibboleth <Location /shibboleth-sp>
<Location /shibboleth-sp> Satisfy any
Satisfy any </Location>
</Location>
<Location /Shibboleth.sso>
<Location /Shibboleth.sso> SetHandler shib
SetHandler shib </Location>
</Location> ```
```
exclude shibboleth URLs from rewriting, add "RewriteCond %{REQUEST_URI} !/Shibboleth.sso" and "RewriteCond %{REQUEST_URI} !/shibboleth-sp", config should look like this: 1. Exclude shibboleth URLs from rewriting. Add `RewriteCond %{REQUEST_URI} !/Shibboleth.sso` and `RewriteCond %{REQUEST_URI} !/shibboleth-sp`. Config should look like this:
```
# Apache equivalent of Nginx try files ```
RewriteEngine on # Apache equivalent of Nginx try files
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f RewriteEngine on
RewriteCond %{REQUEST_URI} !/Shibboleth.sso RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !/shibboleth-sp RewriteCond %{REQUEST_URI} !/Shibboleth.sso
RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA] RewriteCond %{REQUEST_URI} !/shibboleth-sp
RequestHeader set X_FORWARDED_PROTO 'https' RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]
``` RequestHeader set X_FORWARDED_PROTO 'https'
```
1. Edit /etc/gitlab/gitlab.rb configuration file to enable OmniAuth and add
Shibboleth as an OmniAuth provider. User attributes will be sent from the 1. Edit `/etc/gitlab/gitlab.rb` configuration file to enable OmniAuth and add
Apache reverse proxy to GitLab as headers with the names from the Shibboleth Shibboleth as an OmniAuth provider. User attributes will be sent from the
attribute mapping. Therefore the values of the `args` hash Apache reverse proxy to GitLab as headers with the names from the Shibboleth
should be in the form of `"HTTP_ATTRIBUTE"`. The keys in the hash are arguments attribute mapping. Therefore the values of the `args` hash
to the [OmniAuth::Strategies::Shibboleth class](https://github.com/toyokazu/omniauth-shibboleth/blob/master/lib/omniauth/strategies/shibboleth.rb) should be in the form of `"HTTP_ATTRIBUTE"`. The keys in the hash are arguments
and are documented by the [omniauth-shibboleth gem](https://github.com/toyokazu/omniauth-shibboleth) to the [OmniAuth::Strategies::Shibboleth class](https://github.com/toyokazu/omniauth-shibboleth/blob/master/lib/omniauth/strategies/shibboleth.rb)
(take care to note the version of the gem packaged with GitLab). If some of and are documented by the [omniauth-shibboleth gem](https://github.com/toyokazu/omniauth-shibboleth)
your users appear to be authenticated by Shibboleth and Apache, but GitLab (take care to note the version of the gem packaged with GitLab). If some of
rejects their account with a URI that contains "e-mail is invalid" then your your users appear to be authenticated by Shibboleth and Apache, but GitLab
Shibboleth Identity Provider or Attribute Authority may be asserting multiple rejects their account with a URI that contains "e-mail is invalid" then your
e-mail addresses. In this instance, you might consider setting the Shibboleth Identity Provider or Attribute Authority may be asserting multiple
`multi_values` argument to `first`. e-mail addresses. In this instance, you might consider setting the
`multi_values` argument to `first`.
File should look like this:
``` The file should look like this:
external_url 'https://gitlab.example.com'
gitlab_rails['internal_api_url'] = 'https://gitlab.example.com' ```
external_url 'https://gitlab.example.com'
# disable Nginx gitlab_rails['internal_api_url'] = 'https://gitlab.example.com'
nginx['enable'] = false
# disable Nginx
gitlab_rails['omniauth_allow_single_sign_on'] = true nginx['enable'] = false
gitlab_rails['omniauth_block_auto_created_users'] = false
gitlab_rails['omniauth_enabled'] = true gitlab_rails['omniauth_allow_single_sign_on'] = true
gitlab_rails['omniauth_providers'] = [ gitlab_rails['omniauth_block_auto_created_users'] = false
{ gitlab_rails['omniauth_enabled'] = true
"name" => "'shibboleth"', gitlab_rails['omniauth_providers'] = [
"label" => "Text for Login Button", {
"args" => { "name" => "'shibboleth"',
"shib_session_id_field" => "HTTP_SHIB_SESSION_ID", "label" => "Text for Login Button",
"shib_application_id_field" => "HTTP_SHIB_APPLICATION_ID", "args" => {
"uid_field" => 'HTTP_EPPN', "shib_session_id_field" => "HTTP_SHIB_SESSION_ID",
"name_field" => 'HTTP_CN', "shib_application_id_field" => "HTTP_SHIB_APPLICATION_ID",
"info_fields" => { "email" => 'HTTP_MAIL'} "uid_field" => 'HTTP_EPPN',
} "name_field" => 'HTTP_CN',
} "info_fields" => { "email" => 'HTTP_MAIL'}
] }
}
``` ]
1. [Reconfigure][] or [restart GitLab][] for the changes to take effect if you ```
1. [Reconfigure](../administration/restart_gitlab.md#omnibus-gitlab-reconfigure) or [restart](../administration/restart_gitlab.md#installations-from-source) GitLab for the changes to take effect if you
installed GitLab via Omnibus or from source respectively. installed GitLab via Omnibus or from source respectively.
On the sign in page there should now be a "Sign in with: Shibboleth" icon below the regular sign in form. Click the icon to begin the authentication process. You will be redirected to IdP server (Depends on your Shibboleth module configuration). If everything goes well the user will be returned to GitLab and will be signed in. On the sign in page, there should now be a "Sign in with: Shibboleth" icon below the regular sign in form. Click the icon to begin the authentication process. You will be redirected to IdP server (depends on your Shibboleth module configuration). If everything goes well the user will be returned to GitLab and will be signed in.
## Apache 2.4 / GitLab 8.6 update ## Apache 2.4 / GitLab 8.6 update
The order of the first 2 Location directives is important. If they are reversed, The order of the first 2 Location directives is important. If they are reversed,
you will not get a shibboleth session! you will not get a shibboleth session!
...@@ -135,6 +138,3 @@ you will not get a shibboleth session! ...@@ -135,6 +138,3 @@ you will not get a shibboleth session!
RequestHeader set X_FORWARDED_PROTO 'https' RequestHeader set X_FORWARDED_PROTO 'https'
RequestHeader set X-Forwarded-Ssl on RequestHeader set X-Forwarded-Ssl on
``` ```
[reconfigure]: ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure
[restart GitLab]: ../administration/restart_gitlab.md#installations-from-source
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7