Self-hosted Gitlab Integration not Working

[necouchman]

I think this has been reported in the past, but I'm still unable to get a self-hosted version of DrawIO to integrate correctly with a self-hosted version of Gitlab for storing diagrams.

Environment

• Gitlab CE running on Rocky Linux 9
• DrawIO running in a Pod in OKD 4.19 (Kubernetes 1.32.5)
  • Image is jgraph/drawio:latest

Process

• Gitlab is installed and running, I can successfully log in, have repos, etc.
• Create an application in Gitlab called "DrawIO" and set the callback URL to https://diagrams.apps.okd.local/gitlab.html
• Create the Gitlab pod with the following details:
  • Create a custom service account with the "anyuid" privilege
  • Set the runAsUser and runAsGroup parameters for the DrawIO container.
  • Set the DRAWIO_GITLAB_URL an DRAWIO_GITLAB_ID variables to the URL of my Gitlab instance and the application ID created above.
  • Set image to jgraph/drawio:latest
• Open the https://diagrams.apps.okd.local URL, and the DrawIO application launches successfully.
• From the File menu within the web application, select Open From -> Gitlab
• Click the Authorize button when it appears.
• Receive the error from Gitlab: The redirect URI included is not valid.
• Upon examining the URL, note that the ".html" is missing from the end of the "gitlab" portion in the diagrams redirect:
  • Expected value: &redirect_uri=https%3A%2F%2Fdiagrams.apps.okd.local%2Fgitlab.html&response_type=
  • Observed value: &redirect_uri=https%3A%2F%2Fdiagrams.apps.okd.local%2Fgitlab&response_type=
• By manually adding the .html to the end of the redirect_uri argument, the authorization appears to succeed and the page closes.
• However, in the DrawIO window an error appears: Access Denied with a Try Again and Cancel button.
• If, instead, I change the URL of the application to not include the .html, the redirect back to the DrawIO page fails with HTTP 500.

[realgeneraliroh]

See https://github.com/jgraph/docker-drawio/blob/dev/self-contained/README.md

[necouchman]

See https://github.com/jgraph/docker-drawio/blob/dev/self-contained/README.md

Thanks @realgeneraliroh , I'm pretty sure that's the document that I already followed, and that isn't working as expected. I've reviewed it, again, to make sure, and if you're seeing anything specific that I'm missing, please feel free to point that out.

[realgeneraliroh]

See https://github.com/jgraph/docker-drawio/blob/dev/self-contained/README.md

Thanks @realgeneraliroh , I'm pretty sure that's the document that I already followed, and that isn't working as expected. I've reviewed it, again, to make sure, and if you're seeing anything specific that I'm missing, please feel free to point that out.

@necouchman, are you by chance using a reverse proxy like Traefik in front of your GitLab instance or your DrawIO instance?

[necouchman]

See https://github.com/jgraph/docker-drawio/blob/dev/self-contained/README.md

Thanks @realgeneraliroh , I'm pretty sure that's the document that I already followed, and that isn't working as expected. I've reviewed it, again, to make sure, and if you're seeing anything specific that I'm missing, please feel free to point that out.

@necouchman, are you by chance using a reverse proxy like Traefik in front of your GitLab instance or your DrawIO instance?

For DrawIO, I'm deploying in Kubernetes, so there's something there - it isn't anything that I've specifically configured, like Traefik, just the standard K8s (Openshift/OKD) stuff.

For Gitlab, also nothing special/different - Nginx, but it's the Nginx embedded instance included in the Gitlab install.

[realgeneraliroh]

See https://github.com/jgraph/docker-drawio/blob/dev/self-contained/README.md

Thanks @realgeneraliroh , I'm pretty sure that's the document that I already followed, and that isn't working as expected. I've reviewed it, again, to make sure, and if you're seeing anything specific that I'm missing, please feel free to point that out.

@necouchman, are you by chance using a reverse proxy like Traefik in front of your GitLab instance or your DrawIO instance?

For DrawIO, I'm deploying in Kubernetes, so there's something there - it isn't anything that I've specifically configured, like Traefik, just the standard K8s (Openshift/OKD) stuff.

For Gitlab, also nothing special/different - Nginx, but it's the Nginx embedded instance included in the Gitlab install.

Ah! That may be your issue! See: Traefik Migration Documentation

In Traefik v3.6.4, they changed the default security configuration to be such that it no longer supports encoded slashes in the URI, unless it is explicitly enabled.

So when GitLab tries to go to the redirect URI for DrawIO (which is behind Traefik (assuming you are using the default ingress)), Traefik does not accept the encoded slashes.

Try setting your Traefik configuration to allowEncodedSlash, and see if that works.