Commit 48d33918 authored by Achilleas Pipinellis's avatar Achilleas Pipinellis

Refactor the Google integration page

parent d0593e16
# Google OAuth2 OmniAuth Provider # Google OAuth2 OmniAuth Provider
To enable the Google OAuth2 OmniAuth provider you must register your application with Google. Google will generate a client ID and secret key for you to use. To enable the Google OAuth2 OmniAuth provider you must register your application
with Google. Google will generate a client ID and secret key for you to use.
1. Sign in to the [Google Developers Console](https://console.developers.google.com/) with the Google account you want to use to register GitLab.
## Enabling Google OAuth
1. Select "Create Project".
In Google's side:
1. Provide the project information
- Project name: 'GitLab' works just fine here. 1. Navigate to the [cloud resource manager](https://console.cloud.google.com/cloud-resource-manager) page
- Project ID: Must be unique to all Google Developer registered applications. Google provides a randomly generated Project ID by default. You can use the randomly generated ID or choose a new one. 1. Select "Create Project"
1. Refresh the page. You should now see your new project in the list. Click on the project. 1. Provide the project information:
- **Project name** - "GitLab" works just fine here.
1. Select the "Google APIs" tab in the Overview. - **Project ID** - Must be unique to all Google Developer registered applications.
Google provides a randomly generated Project ID by default. You can use
1. Select and enable the following Google APIs - listed under "Popular APIs" the randomly generated ID or choose a new one.
- Enable `Contacts API` 1. Refresh the page and you should see your new project in the list
- Enable `Google+ API` 1. Go to the [Google API Console](https://console.developers.google.com/apis/dashboard)
1. Select the previously created project form the upper left corner
1. Click on the project and select "Google Cloud APIs" in the overview
1. Select "Credentials" in the left menu
1. Select "Create New Client ID"
1. Fill in the required information
- **Application type** - Choose "Web Application"
- **Authorized JavaScript origins** -This isn't really used by GitLab but go
ahead and put `https://gitlab.example.com`
- **Authorized redirect URIs** - Enter your domain name followed by the
callback URIs:
1. Select "Credentials" in the submenu. ```
https://gitlab.example.com/users/auth/google_oauth2/callback
https://gitlab.example.com/google_api/auth/callback
```
1. Select "Create New Client ID". 1. Under the heading "Client ID for web application" you should see a Client ID
and Client secret. Note them down or keep this page open as you will need them
later.
1. Fill in the required information On your GitLab server:
- Application type: "Web Application"
- Authorized JavaScript origins: This isn't really used by GitLab but go ahead and put 'https://gitlab.example.com' here.
- Authorized redirect URI: 'https://gitlab.example.com/users/auth/google_oauth2/callback'
1. Under the heading "Client ID for web application" you should see a Client ID and Client secret (see screenshot). Keep this page open as you continue configuration. ![Google app](img/google_app.png)
1. On your GitLab server, open the configuration file. 1. Open the configuration file.
For omnibus package: For Omnibus GitLab:
```sh ```sh
sudo editor /etc/gitlab/gitlab.rb sudo editor /etc/gitlab/gitlab.rb
...@@ -39,15 +50,13 @@ To enable the Google OAuth2 OmniAuth provider you must register your application ...@@ -39,15 +50,13 @@ To enable the Google OAuth2 OmniAuth provider you must register your application
```sh ```sh
cd /home/git/gitlab cd /home/git/gitlab
sudo -u git -H editor config/gitlab.yml sudo -u git -H editor config/gitlab.yml
``` ```
1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings. 1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings.
1. Add the provider configuration: 1. Add the provider configuration:
For omnibus package: For Omnibus GitLab:
```ruby ```ruby
gitlab_rails['omniauth_providers'] = [ gitlab_rails['omniauth_providers'] = [
...@@ -68,11 +77,10 @@ To enable the Google OAuth2 OmniAuth provider you must register your application ...@@ -68,11 +77,10 @@ To enable the Google OAuth2 OmniAuth provider you must register your application
args: { access_type: 'offline', approval_prompt: '' } } args: { access_type: 'offline', approval_prompt: '' } }
``` ```
1. Change 'YOUR_APP_ID' to the client ID from the Google Developer page from step 10. 1. Change `YOUR_APP_ID` to the client ID from the Google Developer page
1. Similarly, change `YOUR_APP_SECRET` to the client secret
1. Change 'YOUR_APP_SECRET' to the client secret from the Google Developer page from step 10. 1. Make sure that you configure GitLab to use an FQDN as Google will not accept
raw IP addresses.
1. Make sure that you configure GitLab to use an FQDN as Google will not accept raw IP addresses.
For Omnibus packages: For Omnibus packages:
...@@ -88,21 +96,32 @@ To enable the Google OAuth2 OmniAuth provider you must register your application ...@@ -88,21 +96,32 @@ To enable the Google OAuth2 OmniAuth provider you must register your application
``` ```
1. Save the configuration file. 1. Save the configuration file.
1. [Reconfigure][] or [restart GitLab][] for the changes to take effect if you 1. [Reconfigure][] or [restart GitLab][] for the changes to take effect if you
installed GitLab via Omnibus or from source respectively. installed GitLab via Omnibus or from source respectively.
On the sign in page there should now be a Google icon below the regular sign in form. Click the icon to begin the authentication process. Google will ask the user to sign in and authorize the GitLab application. If everything goes well the user will be returned to GitLab and will be signed in. On the sign in page there should now be a Google icon below the regular sign in
form. Click the icon to begin the authentication process. Google will ask the
user to sign in and authorize the GitLab application. If everything goes well
the user will be returned to GitLab and will be signed in.
## Further Configuration ## Further Configuration
This further configuration is not required for Google authentication to function but it is strongly recommended. Taking these steps will increase usability for users by providing a little more recognition and branding. This further configuration is not required for Google authentication to function
but it is strongly recommended. Taking these steps will increase usability for
At this point, when users first try to authenticate to your GitLab installation with Google they will see a generic application name on the prompt screen. The prompt informs the user that "Project Default Service Account" would like to access their account. "Project Default Service Account" isn't very recognizable and may confuse or cause users to be concerned. This is easily changeable. users by providing a little more recognition and branding.
1. Select 'Consent screen' in the left menu. (See steps 1, 4 and 5 above for instructions on how to get here if you closed your window). At this point, when users first try to authenticate to your GitLab installation
1. Scroll down until you find "Product Name". Change the product name to something more descriptive. with Google they will see a generic application name on the prompt screen. The
1. Add any additional information as you wish - homepage, logo, privacy policy, etc. None of this is required, but it may help your users. prompt informs the user that "Project Default Service Account" would like to
access their account. "Project Default Service Account" isn't very recognizable
and may confuse or cause users to be concerned. This is easily changeable:
1. Select 'Consent screen' in the left menu. (See steps 1, 4 and 5 above for
instructions on how to get here if you closed your window).
1. Scroll down until you find "Product Name". Change the product name to
something more descriptive.
1. Add any additional information as you wish - homepage, logo, privacy policy,
etc. None of this is required, but it may help your users.
[reconfigure]: ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure [reconfigure]: ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure
[restart GitLab]: ../administration/restart_gitlab.md#installations-from-source [restart GitLab]: ../administration/restart_gitlab.md#installations-from-source
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment