What the provider parameters do is described in Overview; where the entry is written and how a change is applied is described on Configuration.

OpenID Connect provider

The connection parameters of the provider and their effect are described in OpenID Connect (OIDC).

  • Linux package
  • Omnibus Docker
  • Helm Chart
  • Deckhouse Kubernetes Platform module

A provider is an entry of the gitlab_rails['omniauth_providers'] array. The allowed_groups, admin_groups, auditor_groups and groups_attribute keys sit next to name, at the top level of the entry; the connection parameters sit inside args:

gitlab_rails['omniauth_providers'] = [
  {
    name: 'openid_connect',   # Do not change this value.
    label: 'Keycloak',        # Sign-in button label.
    allowed_groups: ['gitlab'],
    admin_groups: ['admin'],
    auditor_groups: ['audit'],
    groups_attribute: 'gitlab_group',
    args: {
      name: 'openid_connect',
      scope: ['openid', 'profile', 'email'],
      response_type: 'code',
      issuer: 'https://keycloak.example.com/realms/example',
      discovery: true,
      client_auth_method: 'query',
      uid_field: 'preferred_username',
      send_scope_to_token_endpoint: false,
      pkce: true,
      client_options: {
        identifier: '<client_id>',
        secret: '<client_secret>',
        redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'
      }
    }
  }
]
The entry is the one of the Linux package tab. It spans several lines, so write it in /srv/code/config/gitlab.rb on the configuration volume.

A provider entry is stored in a Kubernetes Secret and referenced from the values, so the client secret stays out of values.yaml. Create the Secret with the provider block as its content:

d8 k -n code create secret generic code-omniauth-keycloak \
  --from-file=provider=keycloak.yaml

The file holds the same entry as on the other installation types:

name: 'openid_connect'
label: 'Keycloak'
allowed_groups:
  - 'gitlab'
admin_groups:
  - 'admin'
groups_attribute: 'gitlab_group'
args:
  name: 'openid_connect'
  scope:
    - 'openid'
    - 'profile'
    - 'email'
  response_type: 'code'
  issuer: 'https://keycloak.example.com/realms/example'
  discovery: true
  client_auth_method: 'query'
  uid_field: 'preferred_username'
  send_scope_to_token_endpoint: false
  pkce: true
  client_options:
    identifier: '<client_id>'
    secret: '<client_secret>'
    redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'

Reference the Secret from the values:

global:
  appConfig:
    omniauth:
      providers:
        - secret: code-omniauth-keycloak
          key: provider

The provider is an entry of the providers parameter in the spec.appConfig.omniauth section. The allowedGroups, adminGroups and groupsAttribute keys sit next to name; the CodeInstance resource has no parameter for auditor groups. The connection parameters sit inside args:

providers:
  - name: 'openid_connect'   # Do not change this value.
    label: 'Keycloak'        # Sign-in button label.
    allowedGroups:
      - 'gitlab'
    adminGroups:
      - 'admin'
    groupsAttribute: 'gitlab_group'
    args:
      name: 'openid_connect'
      scope:
        - 'openid'
        - 'profile'
        - 'email'
      response_type: 'code'
      issuer: 'https://keycloak.example.com/realms/example'
      discovery: true
      client_auth_method: 'query'
      uid_field: 'preferred_username'
      send_scope_to_token_endpoint: false
      pkce: true
      client_options:
        identifier: '<client_id>'
        secret: '<client_secret>'
        redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'
←
Authentication / Configuration
Authentication / SAML
→