What the provider parameters do is described in Overview; where the entry is written and how a change is applied is described on Configuration.

OpenID Connect provider

The connection parameters of the provider and their effect are described in OpenID Connect (OIDC).

  • Linux package
  • Omnibus Docker
  • Helm Chart
  • Deckhouse Kubernetes Platform module

A provider is an entry of the gitlab_rails['omniauth_providers'] array. The allowed_groups, admin_groups, auditor_groups and groups_attribute keys sit next to name, at the top level of the entry; the connection parameters sit inside args:

gitlab_rails['omniauth_providers'] = [
  {
    name: 'openid_connect',   # Do not change this value.
    label: 'Keycloak',        # Sign-in button label.
    allowed_groups: ['gitlab'],
    admin_groups: ['admin'],
    auditor_groups: ['audit'],
    groups_attribute: 'gitlab_group',
    args: {
      name: 'openid_connect',
      scope: ['openid', 'profile', 'email'],
      response_type: 'code',
      issuer: 'https://keycloak.example.com/realms/example',
      discovery: true,
      client_auth_method: 'query',
      uid_field: 'preferred_username',
      send_scope_to_token_endpoint: false,
      pkce: true,
      client_options: {
        identifier: '<client_id>',
        secret: '<client_secret>',
        redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'
      }
    }
  }
]
The entry is the one of the Linux package tab. It spans several lines, so write it in /srv/code/config/gitlab.rb on the configuration volume.

A provider entry is stored in a Kubernetes Secret and referenced from the values, so the client secret stays out of values.yaml. Create the Secret with the provider block as its content:

d8 k -n code create secret generic code-omniauth-keycloak \
  --from-file=provider=keycloak.yaml

The file holds the same entry as on the other installation types:

name: 'openid_connect'
label: 'Keycloak'
allowed_groups:
  - 'gitlab'
admin_groups:
  - 'admin'
groups_attribute: 'gitlab_group'
args:
  name: 'openid_connect'
  scope:
    - 'openid'
    - 'profile'
    - 'email'
  response_type: 'code'
  issuer: 'https://keycloak.example.com/realms/example'
  discovery: true
  client_auth_method: 'query'
  uid_field: 'preferred_username'
  send_scope_to_token_endpoint: false
  pkce: true
  client_options:
    identifier: '<client_id>'
    secret: '<client_secret>'
    redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'

Reference the Secret from the values:

global:
  appConfig:
    omniauth:
      providers:
        - secret: code-omniauth-keycloak
          key: provider

The provider is an entry of the providers parameter in the spec.appConfig.omniauth section. The allowedGroups, adminGroups and groupsAttribute keys sit next to name; the CodeInstance resource has no parameter for auditor groups. The connection parameters sit inside args:

providers:
  - name: 'openid_connect'   # Do not change this value.
    label: 'Keycloak'        # Sign-in button label.
    allowedGroups:
      - 'gitlab'
    adminGroups:
      - 'admin'
    groupsAttribute: 'gitlab_group'
    args:
      name: 'openid_connect'
      scope:
        - 'openid'
        - 'profile'
        - 'email'
      response_type: 'code'
      issuer: 'https://keycloak.example.com/realms/example'
      discovery: true
      client_auth_method: 'query'
      uid_field: 'preferred_username'
      send_scope_to_token_endpoint: false
      pkce: true
      client_options:
        identifier: '<client_id>'
        secret: '<client_secret>'
        redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'

Integration with Deckhouse Platform

In a Deckhouse Platform cluster, the user-authn module runs Dex, an OpenID Connect provider at https://dex.<domain>/. Deckhouse Code connects to it as a Dex client, described in Configuring the OAuth2 client in Dex for connecting an application.

  1. Create a DexClient in any namespace of the cluster. allowedGroups lists the Dex groups whose users can sign in; without it, every Dex user can sign in:

    apiVersion: deckhouse.io/v1
kind: DexClient
metadata:
  name: code
  namespace: code
spec:
  redirectURIs:
    - https://code.example.com/users/auth/openid_connect/callback
  allowedGroups:
    - Everyone
    - admins

    Dex registers the client with the dex-client-<name>@<namespace> identifier and stores its secret in the dex-client-<name> Secret of the same namespace.

  2. Get the client secret:

    d8 k -n code get secret dex-client-code -o jsonpath='{.data.clientSecret}' | base64 -d

  3. Add the provider entry. issuer ends with /: it must match the issuer that Dex publishes exactly, otherwise the sign-in fails.

  • Linux package
  • Omnibus Docker
  • Helm Chart
  • Deckhouse Kubernetes Platform module
gitlab_rails['omniauth_providers'] = [
  {
    name: 'openid_connect',
    label: 'Deckhouse',
    args: {
      name: 'openid_connect',
      scope: ['openid', 'profile', 'email'],
      response_type: 'code',
      issuer: 'https://dex.example.com/',
      discovery: true,
      client_auth_method: 'query',
      client_options: {
        identifier: 'dex-client-code@code',
        secret: '<clientSecret>',
        redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'
      }
    }
  }
]
The entry is the one of the Linux package tab, written in /srv/code/config/gitlab.rb on the configuration volume.

The dex.yaml file of the code-omniauth-dex Secret, referenced from the values as in the OpenID Connect provider section:

name: 'openid_connect'
label: 'Deckhouse'
args:
  name: 'openid_connect'
  scope:
    - 'openid'
    - 'profile'
    - 'email'
  response_type: 'code'
  issuer: 'https://dex.example.com/'
  discovery: true
  client_auth_method: 'query'
  client_options:
    identifier: 'dex-client-code@code'
    secret: '<clientSecret>'
    redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'

The entry of the providers parameter in the spec.appConfig.omniauth section:

providers:
  - name: 'openid_connect'
    label: 'Deckhouse'
    args:
      name: 'openid_connect'
      scope:
        - 'openid'
        - 'profile'
        - 'email'
      response_type: 'code'
      issuer: 'https://dex.example.com/'
      discovery: true
      client_auth_method: 'query'
      client_options:
        identifier: 'dex-client-code@code'
        secret: '<clientSecret>'
        redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'
←
Authentication / Configuration
Authentication / SAML
→