Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:oidc_gitlab [2025/05/09 00:17] – created kainhofer
+++ en:2.0:single_sign_on:oidc_gitlab [2026/09/08 19:51] (current) – [Setting up the Client (SP) in Admidio] kainhofer
@@ Line 6: / Line 6: @@
 Throughout the document we will assume you have both Admidio and GitLab already set up properly at https://admidio.local/ and https://gitlab.local/. Please modify these URLs to your actual installation.
-As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to GitLab. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_an_oidc_id_provider]]
+As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to any particular client. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_an_oidc_id_provider|folow this guide]]:
 {{ :en:2.0:sso:sso_oidc_01-05_setup_admidio_preferences.png?direct&600 |}}
-Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**.
-The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.
+Basically, one needs to enable OpenID Connect (OIDC). The Issuer URL should in most cases be left blank, which means Admidio's public URL will be used as issuer URL.
+The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the automatic discovery URL, and the individual settings for clients that do not support auto-configuration via metadata.
 ===== Quick Overview =====
-Setting up a client (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) The client (RP, GitLab in our case) needs to be set up with the data about the OpenID Provider (OP). Typically this is done via the metadata provided in the discovery URL of the provider. Since Admidio provides those URLs with copy buttons in the preferences screen, even the manual configuration is rather straigtforward. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
+Setting up a client (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps:
+  - The client (RP, GitLab in our case) needs to be set up with the data about the OpenID Provider (OP). Typically this is done via the metadata provided in the discovery URL of the provider. Otherwise one has to manually paste the endpoint URLs of the OpenID provider. Since Admidio provides those URLs with copy buttons in the preferences screen, even the manual configuration is rather straightforward.
+  - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
 The concrete steps are:
@@ Line 27: / Line 32: @@
     * Enter the redirect URL of GitLab in Admidio: 'https://[[YOUR_GITLAB]]/users/auth/openid_connect/callback'.
   * Optionally select (both in Admidio and the RP) which **profile fields should be mapped** to OpenID claims (attributes) and sent to the client, and configure which **group memberships** should be transmitted.
+  * Gitlab's Community Edition does not support group assignments through OIDC, so their configuration can be left out and is not available.
@@ Line 38: / Line 44: @@
   * Open the ''config/gitlab.rb'' configuration file of GitLab and append the following lines to the end of the file:
-    * The ''issuer'' key is the base URL for the endpoints, without the endpoint names themselves. One has to copy over the OpenID Issuer from Admidio's OpenID preferences (it has a copy button). {{ :en:2.0:sso:sso_oidc_01-01_setup_admidio_endpoints.png?direct&600 |}}
+    * The ''issuer'' key is the base URL for the endpoints, without the endpoint names themselves. One has to copy over the OpenID Issuer from Admidio's OpenID preferences (it has a copy button). {{ :en:2.0:sso:sso_oidc_01-01_gitlab_setup_admidio_endpoints.png?600 |}}
     * The **Client ID** and **Client Secret** will later come from Admidio's client configuration.
     * The 'client_auth_method' should not be left out or left empty, because then basic http authenatication will be used, which does not allow colons in the cliend ID. So if one wants to the use installation URL as client ID, one must switch to anything else than 'basic'. GitLab's documentation uses "query".
@@ Line 94: / Line 100: @@
 This is a typical configuration of the GitLab OpenID client in Admidio:
-{{:en:2.0:sso:sso_oidc_gitlab_03_client.png?direct&450|}}{{:en:2.0:sso:sso_oidc_gitlab_04_client.png?direct&450|}}
+{{:en:2.0:sso:sso_oidc_gitlab_03_client.png?direct&800|}}
 The clientID and the client secret in the Admidio client page and GitLab's ''config/gitlab.rb'' have to match exactly. Similarly, the scopes should coincide, otherwise not all desired profile fields will be transmitted. To make use of the group mapping in GitLab (see the [[https://docs.gitlab.com/administration/auth/oidc/#configure-users-based-on-oidc-group-membership|Gitlab documentation for details]]), make sure to include the 'groups' scope in Admidio and GitLab, and map the 'Roles - roles' Profile Field to an OIDC claim.