diff --git a/CHANGELOG b/CHANGELOG index d208812af635dbf84758f6a17466624d21584b87..43788f5c4d3b3bb9730d314488c1a336ec15690d 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ Please view this file on the master branch, on stable branches it's out of date. v 7.12.0 (unreleased) + - Shorten merge request WIP text. - Refactor permission checks with issues and merge requests project settings (Stan Hu) - Fix Markdown preview not working in Edit Milestone page (Stan Hu) - Fix Zen Mode not closing with ESC key (Stan Hu) @@ -36,6 +37,7 @@ v 7.11.4 v 7.11.3 - no changes + - Add SAML support as an omniauth provider v 7.11.2 - no changes diff --git a/Gemfile b/Gemfile index d0fd205a37876481d5790c6ce250363fc5b6a9e9..35f6b42f879dd279cc264397aa9dc6f53c35cf7b 100644 --- a/Gemfile +++ b/Gemfile @@ -31,6 +31,7 @@ gem 'omniauth-shibboleth' gem 'omniauth-kerberos', group: :kerberos gem 'omniauth-gitlab' gem 'omniauth-bitbucket' +gem 'omniauth-saml' gem 'doorkeeper', '2.1.3' gem "rack-oauth2", "~> 1.0.5" diff --git a/Gemfile.lock b/Gemfile.lock index d1e311c2d496cc69d3b5426f42ed8112f022c9de..cc373f5a0d7dd3e79bea5956d78b5a7a7e3d1e1a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -327,6 +327,8 @@ GEM rb-fsevent (>= 0.9.3) rb-inotify (>= 0.9) lumberjack (1.0.4) + macaddr (1.7.1) + systemu (~> 2.6.2) mail (2.6.3) mime-types (>= 1.16, < 3) method_source (0.8.2) @@ -383,6 +385,9 @@ GEM omniauth-oauth2 (1.1.1) oauth2 (~> 0.8.0) omniauth (~> 1.0) + omniauth-saml (1.3.1) + omniauth (~> 1.1) + ruby-saml (~> 0.8.1) omniauth-shibboleth (1.1.1) omniauth (>= 1.0.0) omniauth-twitter (1.0.1) @@ -516,6 +521,9 @@ GEM rainbow (>= 1.99.1, < 3.0) ruby-progressbar (~> 1.4) ruby-progressbar (1.7.1) + ruby-saml (0.8.2) + nokogiri (>= 1.5.0) + uuid (~> 2.3) ruby2ruby (2.1.3) ruby_parser (~> 3.1) sexp_processor (~> 4.0) @@ -601,6 +609,7 @@ GEM stamp (0.5.0) state_machine (1.2.0) stringex (2.5.2) + systemu (2.6.5) task_list (1.0.2) html-pipeline teaspoon (1.0.2) @@ -653,6 +662,8 @@ GEM raindrops (~> 0.7) unicorn-worker-killer (0.4.2) unicorn (~> 4) + uuid (2.3.7) + macaddr (~> 1.0) version_sorter (2.0.0) virtus (1.0.1) axiom-types (~> 0.0.5) @@ -755,6 +766,7 @@ DEPENDENCIES omniauth-gitlab omniauth-google-oauth2 omniauth-kerberos + omniauth-saml omniauth-shibboleth omniauth-twitter org-ruby (= 0.9.12) diff --git a/app/controllers/omniauth_callbacks_controller.rb b/app/controllers/omniauth_callbacks_controller.rb index dcd949a71ded3779d89aad4a848c1de9d85788b7..a767815b31113da8ed8bfb1c25ea85070f39ed26 100644 --- a/app/controllers/omniauth_callbacks_controller.rb +++ b/app/controllers/omniauth_callbacks_controller.rb @@ -1,4 +1,7 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController + + protect_from_forgery except: [:kerberos, :saml] + Gitlab.config.omniauth.providers.each do |provider| define_method provider['name'] do handle_omniauth diff --git a/app/views/projects/_issuable_form.html.haml b/app/views/projects/_issuable_form.html.haml index 2292aaaa2144235529d3c49f1ae1dc4bbef72859..c85da8eff985f58f7a43b24140a86033c7e116c3 100644 --- a/app/views/projects/_issuable_form.html.haml +++ b/app/views/projects/_issuable_form.html.haml @@ -15,11 +15,11 @@ - if issuable.is_a?(MergeRequest) %p.help-block - if issuable.work_in_progress? - This merge request is marked a <strong>Work In Progress</strong>. - When it's ready, remove the <code>WIP</code> prefix from the title to allow it to be accepted. + Remove the <code>WIP</code> prefix from the title to allow this + <strong>Work In Progress</strong> merge request to be accepted when it's ready. - else - To prevent this merge request from being accepted before it's ready, - mark it a <strong>Work In Progress</strong> by starting the title with <code>[WIP]</code> or <code>WIP:</code>. + Start the title with <code>[WIP]</code> or <code>WIP:</code> to prevent a + <strong>Work In Progress</strong> merge request from being accepted before it's ready. .form-group.issuable-description = f.label :description, 'Description', class: 'control-label' .col-sm-10 diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example index fbc7f515f34592e712774f5eecd108697037ece1..5acfe5485027a2b16d1df6566b2ba6d1b27369d6 100644 --- a/config/gitlab.yml.example +++ b/config/gitlab.yml.example @@ -210,6 +210,15 @@ production: &base # args: { scope: 'api' } } # - { name: 'bitbucket', app_id: 'YOUR_APP_ID', # app_secret: 'YOUR_APP_SECRET'} + # - { name: 'saml', + # args: { + # assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', + # idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', + # idp_sso_target_url: 'https://login.example.com/idp', + # issuer: 'https://gitlab.example.com', + # name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' + # } } + diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md index 24f7b4bb4b407a2770f0d5735dea87a649ea1983..8e2a602ec3500cf8e7d528870d3eef78e2a6ddbe 100644 --- a/doc/integration/omniauth.md +++ b/doc/integration/omniauth.md @@ -75,6 +75,7 @@ Now we can choose one or more of the Supported Providers below to continue confi - [Google](google.md) - [Shibboleth](shibboleth.md) - [Twitter](twitter.md) +- [SAML](saml.md) ## Enable OmniAuth for an Existing User diff --git a/doc/integration/saml.md b/doc/integration/saml.md new file mode 100644 index 0000000000000000000000000000000000000000..a8cc5c8f74a4f9c4e7c81ef282e2a43a69283665 --- /dev/null +++ b/doc/integration/saml.md @@ -0,0 +1,77 @@ +# SAML OmniAuth Provider + +GitLab can be configured to act as a SAML 2.0 Service Provider (SP). This allows GitLab to consume assertions from a SAML 2.0 Identity Provider (IdP) such as Microsoft ADFS to authenticate users. + +First configure SAML 2.0 support in GitLab, then register the GitLab application in your SAML IdP: + +1. Make sure GitLab is configured with HTTPS. See [Using HTTPS](../install/installation.md#using-https) for instructions. + +1. On your GitLab server, open the configuration file. + + For omnibus package: + + ```sh + sudo editor /etc/gitlab/gitlab.rb + ``` + + For instalations from source: + + ```sh + cd /home/git/gitlab + + sudo -u git -H editor config/gitlab.yml + ``` + +1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings. + +1. Add the provider configuration: + + For omnibus package: + + ```ruby + gitlab_rails['omniauth_providers'] = [ + { + "name" => "saml", + args: { + assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', + idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', + idp_sso_target_url: 'https://login.example.com/idp', + issuer: 'https://gitlab.example.com', + name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' + } + } + ] + ``` + + For installations from source: + + ```yaml + - { name: 'saml', + args: { + assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', + idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', + idp_sso_target_url: 'https://login.example.com/idp', + issuer: 'https://gitlab.example.com', + name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' + } } + ``` + +1. Change the value for 'assertion_consumer_service_url' to match the HTTPS endpoint of GitLab (append 'users/auth/saml/callback' to the HTTPS URL of your GitLab installation to generate the correct value). + +1. Change the values of 'idp_cert_fingerprint', 'idp_sso_target_url', 'name_identifier_format' to match your IdP. Check [the omniauth-saml documentation](https://github.com/PracticallyGreen/omniauth-saml) for details on these options. + +1. Change the value of 'issuer' to a unique name, which will identify the application to the IdP. + +1. Restart GitLab for the changes to take effect. + +1. Register the GitLab SP in your SAML 2.0 IdP, using the application name specified in 'issuer'. + +To ease configuration, most IdP accept a metadata URL for the application to provide configuration information to the IdP. To build the metadata URL for GitLab, append 'users/auth/saml/metadata' to the HTTPS URL of your GitLab installation, for instance: + ``` + https://gitlab.example.com/users/auth/saml/metadata + ``` + +At a minimum the IdP *must* provide a claim containing the user's email address, using claim name 'email' or 'mail'. The email will be used to automatically generate the GitLab username. GitLab will also use claims with name 'name', 'first_name', 'last_name' (see [the omniauth-saml gem](https://github.com/PracticallyGreen/omniauth-saml/blob/master/lib/omniauth/strategies/saml.rb) for supported claims). + +On the sign in page there should now be a SAML button below the regular sign in form. Click the icon to begin the authentication process. If everything goes well the user will be returned to GitLab and will be signed in. +