| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:oidc_gitlab [2026/09/08 19:37] – [Quick Overview] kainhofer | en:2.0:single_sign_on:oidc_gitlab [2026/09/08 19:51] (current) – [Setting up the Client (SP) in Admidio] kainhofer |
|---|
| |
| * Open the ''config/gitlab.rb'' configuration file of GitLab and append the following lines to the end of the file: | * Open the ''config/gitlab.rb'' configuration file of GitLab and append the following lines to the end of the file: |
| * The ''issuer'' key is the base URL for the endpoints, without the endpoint names themselves. One has to copy over the OpenID Issuer from Admidio's OpenID preferences (it has a copy button). {{ :en:2.0:sso:sso_oidc_01-01_setup_admidio_endpoints.png?direct&600 |}} | * The ''issuer'' key is the base URL for the endpoints, without the endpoint names themselves. One has to copy over the OpenID Issuer from Admidio's OpenID preferences (it has a copy button). {{ :en:2.0:sso:sso_oidc_01-01_gitlab_setup_admidio_endpoints.png?600 |}} |
| * The **Client ID** and **Client Secret** will later come from Admidio's client configuration. | * The **Client ID** and **Client Secret** will later come from Admidio's client configuration. |
| * The 'client_auth_method' should not be left out or left empty, because then basic http authenatication will be used, which does not allow colons in the cliend ID. So if one wants to the use installation URL as client ID, one must switch to anything else than 'basic'. GitLab's documentation uses "query". | * The 'client_auth_method' should not be left out or left empty, because then basic http authenatication will be used, which does not allow colons in the cliend ID. So if one wants to the use installation URL as client ID, one must switch to anything else than 'basic'. GitLab's documentation uses "query". |
| This is a typical configuration of the GitLab OpenID client in Admidio: | This is a typical configuration of the GitLab OpenID client in Admidio: |
| |
| {{:en:2.0:sso:sso_oidc_gitlab_03_client.png?direct&450|}}{{:en:2.0:sso:sso_oidc_gitlab_04_client.png?direct&450|}} | {{:en:2.0:sso:sso_oidc_gitlab_03_client.png?direct&800|}} |
| |
| The clientID and the client secret in the Admidio client page and GitLab's ''config/gitlab.rb'' have to match exactly. Similarly, the scopes should coincide, otherwise not all desired profile fields will be transmitted. To make use of the group mapping in GitLab (see the [[https://docs.gitlab.com/administration/auth/oidc/#configure-users-based-on-oidc-group-membership|Gitlab documentation for details]]), make sure to include the 'groups' scope in Admidio and GitLab, and map the 'Roles - roles' Profile Field to an OIDC claim. | The clientID and the client secret in the Admidio client page and GitLab's ''config/gitlab.rb'' have to match exactly. Similarly, the scopes should coincide, otherwise not all desired profile fields will be transmitted. To make use of the group mapping in GitLab (see the [[https://docs.gitlab.com/administration/auth/oidc/#configure-users-based-on-oidc-group-membership|Gitlab documentation for details]]), make sure to include the 'groups' scope in Admidio and GitLab, and map the 'Roles - roles' Profile Field to an OIDC claim. |
