Skip to content

Commit a5fad42

Browse files
pabel-rhdeerskindollthemr0cnickboldt
authored
Rhidp 9758: Enable GitLab authentication (#1839)
Co-authored-by: deerskindoll <jvrbkova@redhat.com> Co-authored-by: Fabrice Flore-Thébault <ffloreth@redhat.com> Co-authored-by: Nick Boldt <nboldt@redhat.com>
1 parent 37d7902 commit a5fad42

8 files changed

+192
-5
lines changed

‎assemblies/assembly-enable-authentication-with-gitlab-basic.adoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
3+
[id="enable-authentication-with-gitlab-basic"]
4+
= Enable authentication with GitLab
5+
6+
By configuring GitLab as an identity provider, you can enable users to authenticate with {product} and import your GitLab users and groups into the software catalog.
7+
8+
include::modules/authentication/proc-enable-user-authentication-with-gitlab-basic.adoc[leveloffset=+1]

‎assemblies/assembly-enable-authentication.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,12 @@ include::assembly-enable-authentication-with-github.adoc[leveloffset=+1]
2222

2323
include::assembly-enable-authentication-with-azure.adoc[leveloffset=+1]
2424

25+
include::assembly-enable-authentication-with-gitlab-basic.adoc[leveloffset=+1]
2526

2627
include::assembly-enable-service-to-service-authentication.adoc[leveloffset=+1]
2728

2829

2930
include::modules/authentication/proc-enable-auto-logout-for-inactive-users.adoc[leveloffset=+1]
3031

3132

32-
include::assembly-troubleshoot-authentication-issues.adoc[leveloffset=+1]
33-
33+
include::assembly-troubleshoot-authentication-issues.adoc[leveloffset=+1]

‎modules/authentication/proc-enable-user-authentication-with-gitlab-basic.adoc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
3+
[id="enable-user-authentication-with-gilab-basic"]
4+
= Enable user authentication with GitLab
5+
6+
[role="_abstract"]
7+
You can enable authentication with GitLab to allow users to sign in to {product-short} using their GitLab credentials. This integration also allows you to provision user and group data from GitLab to the {product-short} software catalog, enabling features that rely on synchronized user and group data.
8+
9+
.Prerequisites
10+
include::snip-enable-user-authentication-with-gitlab-common-prerequisites.adoc[]
11+
12+
.Procedure
13+
include::snip-enable-user-authentication-with-gitlab-common-first-steps.adoc[]
14+
15+
.Verification
16+
include::snip-enable-user-authentication-with-gitlab-common-verification.adoc[]

‎modules/authentication/proc-enabling-user-authentication-with-github-with-mandatory-steps.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
:_mod-docs-content-type: PROCEDURE
22

33
[id="enabling-user-authentication-with-github-with-mandatory-steps"]
4-
= Enabling user authentication with GitHub
4+
= Enable user authentication with GitHub
55

66
[role="_abstract"]
77
Authenticate users with GitHub by provisioning the users and groups from GitHub to the {product-short} software catalog, and configuring the GitHub authentication provider in {product}.

‎modules/authentication/snip-enable-user-authentication-with-gitlab-common-first-steps.adoc‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
:_mod-docs-content-type: SNIPPET
2+
3+
. Register GitLab OAuth 2 application to allow {product-very-short} to authenticate with GitLab. You must use the required callback URL and permissions.
4+
.. link:https://docs.gitlab.com/integration/oauth_provider/[Register a GitLab OAuth 2 application] using the following configuration:
5+
+
6+
--
7+
GitLab OAuth 2 application name::
8+
Enter a unique name, such as `authenticating-with-rhdh-_<GUID>_`.
9+
10+
Redirect URI::
11+
Enter your {product-short} URL: `pass:c,a,q[{my-product-url}]`.
12+
13+
Authorization callback URL::
14+
Enter your authentication backend URL: `pass:c,a,q[{my-product-url}/api/auth/gitlab/handler/frame]`.
15+
16+
Authorized application scope::
17+
Enable `email`, `profile`, `openid`, and `read_user`.
18+
--
19+
.. Save the application and record these values for the next step:
20+
21+
* **OAuth 2 Client ID**, available in the *Application ID* field
22+
* **OAuth 2 Client secret**, accessible by selecting *Copy* in the *Secret* field
23+
24+
. Add your GitLab credentials to {configuring-book-link}#provisioning-your-custom-configuration[your {product-very-short} secrets] using the following key/value pairs.
25+
Use these environment variables in your {product-very-short} configuration files.
26+
27+
`GITLAB_HOST`::
28+
Enter your GitLab host: `<gitlab_host>`.
29+
30+
`GITLAB_CLIENT_ID`::
31+
Enter the saved *OAuth 2 Client ID*.
32+
33+
`GITLAB_CLIENT_SECRET`::
34+
Enter the saved *OAuth 2 Client Secret*.
35+
36+
`GITLAB_URL`::
37+
Enter the GitLab host domain: _`<gitlab_host_domain>`_.
38+
39+
`GITLAB_PARENT_ORG`::
40+
Enter your GitLab organization name, such as `_<your_gitlab_organization_name>_`.
41+
42+
. Enable provisioning for GitLab users and groups to the {product-short} software catalog by adding the provider section to your {product-very-short} `{my-app-config-file}` file:
43+
+
44+
[source,yaml,subs="+quotes,+attributes"]
45+
----
46+
catalog:
47+
providers:
48+
gitlab:
49+
default:
50+
host: $\{GITLAB_HOST}
51+
orgEnabled: true
52+
group: $\{GITLAB_PARENT_ORG}
53+
relations:
54+
- INHERITED
55+
- DESCENDANTS
56+
- SHARED_FROM_GROUPS
57+
groupPattern: `[\s\S]*`
58+
restrictUsersToGroup: true
59+
includeUsersWithoutSeat: true
60+
schedule:
61+
initialDelay:
62+
seconds: 0
63+
frequency:
64+
minutes: 50
65+
timeout:
66+
minutes: 50
67+
----
68+
69+
`host`::
70+
Enter your GitLab instance address: pass:c,a,q[`${GITLAB_HOST}`].
71+
72+
`orgEnabled`::
73+
Set to `true` to enable the ingestion of GitLab organizational data, such as users and groups. For the Gitlab site, you must also provide a value for the `group` parameter.
74+
75+
`group`::
76+
Enter your configured link:https://docs.gitlab.com/user/group/[GitLab parent group]: `${GITLAB_PARENT_ORG}`.
77+
78+
`relations`::
79+
Optional. Specify the types of group memberships to include during ingestion. You can use the following values:
80+
* `INHERITED`: Optional. Includes members of any ancestor groups as members of the current group.
81+
* `DESCENDANTS`: Optional. Includes members of any descendant groups as members of the current group.
82+
* `SHARED_FROM_GROUPS`: Optional. Includes members of any invited groups as members of the current group.
83+
84+
`groupPattern`::
85+
Optional. Filters found groups based on provided pattern. Defaults to `[\s\S]*`, which means to not filter anything.
86+
87+
`restrictUsersToGroup`::
88+
Set to `true` to ingest only users who are direct members of the configured group.
89+
90+
`includeUsersWithoutSeat`::
91+
Set to `true` to include users who do not occupy a paid seat. This setting applies only to GitLab SaaS.
92+
93+
`schedule.initialDelay`::
94+
Enter your schedule initial delay, in the ISO duration or "human duration" format.
95+
96+
`schedule.frequency`::
97+
Enter your schedule frequency, in the cron, ISO duration, or "human duration" format.
98+
99+
`schedule.timeout`::
100+
Enter your schedule timeout, in the ISO duration or "human duration" format.
101+
102+
. Enable the GitLab authentication provider by adding the GitLab authentication provider section to your {product-very-short} `{my-app-config-file}` file:
103+
+
104+
[source,yaml,subs="+quotes,+attributes"]
105+
----
106+
includeTransitiveGroupOwnership: true
107+
signInPage: gitlab
108+
auth:
109+
environment: production
110+
session:
111+
secret: _<name_of_secret>_
112+
providers:
113+
gitlab:
114+
production:
115+
audience: https://${GITLAB_HOST}
116+
clientId: $\{GITLAB_CLIENT_ID}
117+
clientSecret: $\{GITLAB_CLIENT_SECRET}
118+
callbackUrl: {my-product-url}/api/auth/gitlab/handler/frame
119+
----
120+
+
121+
122+
`audience`::
123+
Enter your GitLab instance address: `pass:c,a,q[https://${GITLAB_HOST}]`
124+
125+
`clientId`::
126+
Enter the configured client ID: `${GITLAB_CLIENT_ID}`.
127+
128+
`clientSecret`::
129+
Enter the configured secret variable name: `${GITLAB_CLIENT_SECRET}`.
130+
131+
`callbackUrl`::
132+
Enter your {product-short} authentication backend URL: `pass:c,a,q[{my-product-url}/api/auth/gitlab/handler/frame]`

‎modules/authentication/snip-enable-user-authentication-with-gitlab-common-prerequisites.adoc‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
:_mod-docs-content-type: SNIPPET
2+
3+
* You have enough permissions in GitLab to create and manage a link:https://docs.gitlab.com/api/oauth2/[GitLab OAuth 2 application].
4+
+
5+
[TIP]
6+
====
7+
Alternatively, ask your GitLab administrator to prepare the required GitLab OAuth 2 application.
8+
====
9+
* You must create a GitLab personal access token with the `read_api` scope.
10+
* You have {configuring-book-link}[added a custom {product-short} application configuration], and have enough permissions to change it.

‎modules/authentication/snip-enable-user-authentication-with-gitlab-common-verification.adoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
:_mod-docs-content-type: SNIPPET
2+
3+
. Open {product-very-short} and wait for first ingestion.
4+
. Log in with your GitLab account.

‎modules/importing-repositories/proc-importing-multiple-repositories-from-gitlab.adoc‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,31 @@ See: link:https://access.redhat.com/support/offerings/techpreview/[Technology Pr
1717
.Prerequisites
1818
* You have {configuring-dynamic-plugins-book-link}#bulk-importing-github-repositories[enabled the Bulk Import feature and given access to it].
1919
* You have set up a link:https://docs.gitlab.com/user/profile/personal_access_tokens/[GitLab personal access token (PAT)].
20+
* You configured the GitLab integration by adding the following section to your {product-very-short} `{my-app-config-file}` file:
21+
+
22+
[source,yaml,subs="+quotes,+attributes"]
23+
----
24+
integrations:
25+
gitlab:
26+
- host: ${GITLAB_HOST}
27+
token: ${GITLAB_TOKEN}
28+
----
29+
* You enabled the GitLab catalog provider plugin in your `dynamic-plugins.yaml` file to import GitLab users and groups:
30+
+
31+
[source,yaml]
32+
----
33+
plugins:
34+
- package: './dynamic-plugins/dist/backstage-plugin-catalog-backend-module-gitlab-org-dynamic'
35+
disabled: false
36+
----
2037

2138
.Procedure
22-
. Click *Bulk Import* in {product-short} left sidebar.
39+
. In the {product-short} left sidebar, click *Bulk Import*.
2340
. If your {product-very-short} instance has multiple source control tools configured, select GitLab as your *Source control tool* option.
2441
. Select the projects to import, and validate.
2542
+
2643
{product-short} creates a merge request in each selected project to add the required `catalog-info.yaml` file.
27-
. For each project to import, click on the *PR* link to review and merge the changes in Gitlab.
44+
. For each project to import, click the *PR* link to review and merge the changes in Gitlab.
2845

2946
.Verification
3047
. Click *Bulk Import* in {product-short} left sidebar.

0 commit comments

Comments
 (0)