What each setting does is described in Overview. This page gives, for every installation type, the place the settings are written in, the general OmniAuth parameters and the way a change is applied. The provider and server entries are on OpenID Connect, SAML and LDAP.
Where the configuration lives
Linux package. The settings are keys of /etc/gitlab/gitlab.rb.
Omnibus Docker. The container reads the same gitlab.rb keys. They reach it from the GITLAB_OMNIBUS_CONFIG environment variable, which is evaluated on every start, and from /etc/gitlab/gitlab.rb on the configuration volume, which is read after the variable. A key written in the file overrides the same key in the variable. The variable is set when the container is created:
docker run -d --name code \
--shm-size 256m \
-p 80:80 -p 443:443 -p 22:22 \
-e GITLAB_OMNIBUS_CONFIG="external_url 'https://<HOSTNAME>'; gitlab_rails['omniauth_enabled'] = true; gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect']; gitlab_rails['omniauth_auto_link_ldap_user'] = true" \
-v /srv/code/config:/etc/gitlab \
-v /srv/code/logs:/var/log/gitlab \
-v /srv/code/data:/var/opt/gitlab \
<REGISTRY>/<FLAVOR>:<VERSION>The variable is fixed when the container is created, so changing it means removing the container and creating a new one with the same volumes. The provider entries and the LDAP servers are multi-line values, and the configuration volume keeps them across container replacements. With the volumes from the quick start, /etc/gitlab/gitlab.rb inside the container is /srv/code/config/gitlab.rb on the host, and it is edited on the host:
sudo vi /srv/code/config/gitlab.rbHelm Chart. The settings are chart values, written in the values.yaml file of the release.
Deckhouse Kubernetes Platform module. The settings are parameters of the CodeInstance resource, described on the OmniAuth and LDAP setup and Custom Resources pages of the module documentation.
OmniAuth general parameters
The parameters and their effect are described in General OmniAuth parameters.
- Linux package
- Omnibus Docker
- Helm Chart
- Deckhouse Kubernetes Platform module
Each general OmniAuth parameter has a gitlab.rb key of its own:
| Parameter | gitlab.rb key |
|---|---|
enabled | gitlab_rails['omniauth_enabled'] |
providers | gitlab_rails['omniauth_providers'] |
allow_single_sign_on | gitlab_rails['omniauth_allow_single_sign_on'] |
block_auto_created_users | gitlab_rails['omniauth_block_auto_created_users'] |
auto_link_ldap_user | gitlab_rails['omniauth_auto_link_ldap_user'] |
auto_link_user | gitlab_rails['omniauth_auto_link_user'] |
auto_sign_in_with_provider | gitlab_rails['omniauth_auto_sign_in_with_provider'] |
external_providers | gitlab_rails['omniauth_external_providers'] |
allow_bypass_two_factor | gitlab_rails['omniauth_allow_bypass_two_factor'] |
sync_profile_from_provider | gitlab_rails['omniauth_sync_profile_from_provider'] |
sync_profile_attributes | gitlab_rails['omniauth_sync_profile_attributes'] |
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect']
gitlab_rails['omniauth_block_auto_created_users'] = true
gitlab_rails['omniauth_auto_link_ldap_user'] = true
gitlab_rails['omniauth_sync_profile_attributes'] = ['email']GITLAB_OMNIBUS_CONFIG, separated from the next one by ;, as in the docker run command above; a key whose value spans several lines is written in /srv/code/config/gitlab.rb.The general parameters are values under global.appConfig.omniauth:
global:
appConfig:
omniauth:
enabled: true
allowSingleSignOn: ['openid_connect']
blockAutoCreatedUsers: true
autoLinkLdapUser: true
syncProfileAttributes: ['email']The general parameters are set in the spec.appConfig.omniauth section, and the providers are listed in its providers parameter:
enabled: true
allowSingleSignOn: ['openid_connect']
blockAutoCreatedUsers: true
autoLinkLdapUser: true
syncProfileAttributes: ['email']