Skip to content

Commit 2ea27ee

Browse files
BartJorisBartJoris
authored
Add Generic OAuth2 provider (#2070)
* Add Generic OAuth2 provider * Add docs to test Keycloak on a local environment * Update docs for oauth2_generic
1 parent 3609e9a commit 2ea27ee

15 files changed

+337
-1
lines changed

‎README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
- [SAML](#saml)
4646
- [Crowd](#crowd)
4747
- [Microsoft Azure](#microsoft-azure)
48+
- [Generic OAuth2](#Generic-OAuth2)
4849
- [Gitlab Pages](#gitlab-pages)
4950
- [External Issue Trackers](#external-issue-trackers)
5051
- [Host UID / GID Mapping](#host-uid--gid-mapping)
@@ -671,6 +672,14 @@ Once you have the Client ID, Client secret and Tenant ID generated, configure th
671672

672673
For example, if your Client ID is `xxx`, the Client secret is `yyy` and the Tenant ID is `zzz`, then adding `--env 'OAUTH_AZURE_API_KEY=xxx' --env 'OAUTH_AZURE_API_SECRET=yyy' --env 'OAUTH_AZURE_TENANT_ID=zzz'` to the docker run command enables support for Microsoft Azure OAuth.
673674

675+
#### Generic OAuth2
676+
677+
To enable the Generic OAuth2 provider, you must register your application with your provider. You also need to confirm OAuth2 provider app's ID and secret, the client options and the user's response structure.
678+
679+
As an example this code has been tested with Keycloak, with the following variables: `OAUTH2_GENERIC_APP_ID`, `OAUTH2_GENERIC_APP_SECRET`, `OAUTH2_GENERIC_CLIENT_SITE`, `OAUTH2_GENERIC_CLIENT_USER_INFO_URL`, `OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL`, `OAUTH2_GENERIC_CLIENT_TOKEN_URL`, `OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT`, `OAUTH2_GENERIC_ID_PATH`, `OAUTH2_GENERIC_USER_UID`, `OAUTH2_GENERIC_USER_NAME`, `OAUTH2_GENERIC_USER_EMAIL`, `OAUTH2_GENERIC_NAME`,
680+
681+
See [GitLab documentation](https://docs.gitlab.com/ee/integration/oauth2_generic.html#sign-into-gitlab-with-almost-any-oauth2-provider) and [Omniauth-oauth2-generic documentation](https://gitlab.com/satorix/omniauth-oauth2-generic) for more details.
682+
674683
### Gitlab Pages
675684

676685
Gitlab Pages allows a user to host static websites from a project. Gitlab pages can be enabled with setting the envrionment variable `GITLAB_PAGES_ENABLED` to `true`.
@@ -1038,6 +1047,18 @@ Below is the complete list of available options that can be used to customize yo
10381047
| `OAUTH_AZURE_API_KEY` | Azure Client ID. No defaults. |
10391048
| `OAUTH_AZURE_API_SECRET` | Azure Client secret. No defaults. |
10401049
| `OAUTH_AZURE_TENANT_ID` | Azure Tenant ID. No defaults. |
1050+
| `OAUTH2_GENERIC_APP_ID` | Your OAuth2 App ID. No defaults. |
1051+
| `OAUTH2_GENERIC_APP_SECRET` | Your OAuth2 App Secret. No defaults. |
1052+
| `OAUTH2_GENERIC_CLIENT_SITE` | The OAuth2 generic client site. No defaults |
1053+
| `OAUTH2_GENERIC_CLIENT_USER_INFO_URL` | The OAuth2 generic client user info url. No defaults |
1054+
| `OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL` | The OAuth2 generic client authorize url. No defaults |
1055+
| `OAUTH2_GENERIC_CLIENT_TOKEN_URL` | The OAuth2 generic client token url. No defaults|
1056+
| `OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT` | The OAuth2 generic client end session endpoint. No defaults |
1057+
| `OAUTH2_GENERIC_ID_PATH` | The OAuth2 generic id path. No defaults |
1058+
| `OAUTH2_GENERIC_USER_UID` | The OAuth2 generic user id path. No defaults |
1059+
| `OAUTH2_GENERIC_USER_NAME` | The OAuth2 generic user name. No defaults |
1060+
| `OAUTH2_GENERIC_USER_EMAIL` | The OAuth2 generic user email. No defaults |
1061+
| `OAUTH2_GENERIC_NAME` | The name of your OAuth2 provider. No defaults |
10411062
| `GITLAB_GRAVATAR_ENABLED` | Enables gravatar integration. Defaults to `true`. |
10421063
| `GITLAB_GRAVATAR_HTTP_URL` | Sets a custom gravatar url. Defaults to `http://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon`. This can be used for [Libravatar integration](http://doc.gitlab.com/ce/customization/libravatar.html). |
10431064
| `GITLAB_GRAVATAR_HTTPS_URL` | Same as above, but for https. Defaults to `https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon`. |

‎assets/runtime/config/gitlabhq/gitlab.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -571,6 +571,27 @@ production: &base
571571
client_secret: '{{OAUTH_AUTH0_CLIENT_SECRET}}',
572572
domain: '{{OAUTH_AUTH0_DOMAIN}}',
573573
scope: '{{OAUTH_AUTH0_SCOPE}}' } }
574+
- { name: 'oauth2_generic',
575+
app_id: '{{OAUTH2_GENERIC_APP_ID}}',
576+
app_secret: '{{OAUTH2_GENERIC_APP_SECRET}}',
577+
args: {
578+
client_options: {
579+
site: '{{OAUTH2_GENERIC_CLIENT_SITE}}',
580+
user_info_url: '{{OAUTH2_GENERIC_CLIENT_USER_INFO_URL}}',
581+
authorize_url: '{{OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL}}',
582+
token_url: '{{OAUTH2_GENERIC_CLIENT_TOKEN_URL}}',
583+
end_session_endpoint: '{{OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT}}',
584+
},
585+
user_response_structure: {
586+
id_path: '{{OAUTH2_GENERIC_ID_PATH}}',
587+
attributes: {
588+
uid: '{{OAUTH2_GENERIC_USER_UID}}',
589+
name: '{{OAUTH2_GENERIC_USER_NAME}}',
590+
email: '{{OAUTH2_GENERIC_USER_EMAIL}}'
591+
}
592+
},
593+
name: '{{OAUTH2_GENERIC_NAME}}'
594+
}}
574595
- { name: 'azure_oauth2',
575596
args: {
576597
client_id: '{{OAUTH_AZURE_API_KEY}}',

‎assets/runtime/env-defaults‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -432,6 +432,20 @@ OAUTH_CAS3_LOGOUT_URL=${OAUTH_CAS3_LOGOUT_URL:-/cas/logout}
432432
### AUTH0
433433
OAUTH_AUTH0_SCOPE=${OAUTH_AUTH0_SCOPE:-openid profile email}
434434

435+
## OAUTH2 GENERIC
436+
OAUTH2_GENERIC_APP_ID=${OAUTH2_GENERIC_APP_ID:-}
437+
OAUTH2_GENERIC_APP_SECRET=${OAUTH2_GENERIC_APP_SECRET:-}
438+
OAUTH2_GENERIC_CLIENT_SITE=${OAUTH2_GENERIC_CLIENT_SITE:-}
439+
OAUTH2_GENERIC_CLIENT_USER_INFO_URL=${OAUTH2_GENERIC_CLIENT_USER_INFO_URL:-}
440+
OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL=${OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL:-}
441+
OAUTH2_GENERIC_CLIENT_TOKEN_URL=${OAUTH2_GENERIC_CLIENT_TOKEN_URL:-}
442+
OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT=${OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT:-}
443+
OAUTH2_GENERIC_ID_PATH=${OAUTH2_GENERIC_ID_PATH:-}
444+
OAUTH2_GENERIC_USER_UID=${OAUTH2_GENERIC_USER_UID:-}
445+
OAUTH2_GENERIC_USER_NAME=${OAUTH2_GENERIC_USER_NAME:-}
446+
OAUTH2_GENERIC_USER_EMAIL=${OAUTH2_GENERIC_USER_EMAIL:-}
447+
OAUTH2_GENERIC_NAME=${OAUTH2_GENERIC_NAME:-}
448+
435449
## ANALYTICS
436450

437451
### GOOGLE

‎assets/runtime/functions‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -595,6 +595,27 @@ gitlab_configure_oauth_saml() {
595595
fi
596596
}
597597

598+
gitlab_configure_oauth2_generic() {
599+
if [[ -n ${OAUTH2_GENERIC_APP_ID} && \
600+
-n ${OAUTH2_GENERIC_APP_SECRET} ]]; then
601+
echo "Configuring gitlab::oauth::generic..."
602+
OAUTH_ENABLED=${OAUTH_ENABLED:-true}
603+
update_template ${GITLAB_CONFIG} \
604+
OAUTH2_GENERIC_APP_ID \
605+
OAUTH2_GENERIC_APP_SECRET \
606+
OAUTH2_GENERIC_CLIENT_SITE \
607+
OAUTH2_GENERIC_CLIENT_USER_INFO_URL \
608+
OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL \
609+
OAUTH2_GENERIC_CLIENT_TOKEN_URL \
610+
OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT \
611+
OAUTH2_GENERIC_ID_PATH \
612+
OAUTH2_GENERIC_USER_UID \
613+
OAUTH2_GENERIC_USER_NAME \
614+
OAUTH2_GENERIC_USER_EMAIL \
615+
OAUTH2_GENERIC_NAME
616+
fi
617+
}
618+
598619
gitlab_configure_oauth_crowd() {
599620
if [[ -n ${OAUTH_CROWD_SERVER_URL} && \
600621
-n ${OAUTH_CROWD_APP_NAME} && \
@@ -654,6 +675,7 @@ gitlab_configure_oauth() {
654675
gitlab_configure_oauth_gitlab
655676
gitlab_configure_oauth_bitbucket
656677
gitlab_configure_oauth_saml
678+
gitlab_configure_oauth2_generic
657679
gitlab_configure_oauth_crowd
658680
gitlab_configure_oauth_auth0
659681
gitlab_configure_oauth_azure
@@ -668,7 +690,7 @@ gitlab_configure_oauth() {
668690
OAUTH_EXTERNAL_PROVIDERS
669691

670692
case ${OAUTH_AUTO_SIGN_IN_WITH_PROVIDER} in
671-
cas3|google_oauth2|facebook|twitter|github|gitlab|bitbucket|saml|crowd|azure_oauth2)
693+
cas3|google_oauth2|facebook|twitter|github|gitlab|bitbucket|saml|crowd|azure_oauth2|oauth2_generic)
672694
update_template ${GITLAB_CONFIG} OAUTH_AUTO_SIGN_IN_WITH_PROVIDER
673695
;;
674696
*)

‎contrib/docker-swarm/docker-compose.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,19 @@ services:
151151
- OAUTH_AUTH0_DOMAIN=
152152
- OAUTH_AUTH0_SCOPE=
153153

154+
- OAUTH2_GENERIC_APP_ID=
155+
- OAUTH2_GENERIC_APP_SECRET=
156+
- OAUTH2_GENERIC_CLIENT_SITE=
157+
- OAUTH2_GENERIC_CLIENT_USER_INFO_URL=
158+
- OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL=
159+
- OAUTH2_GENERIC_CLIENT_TOKEN_URL=
160+
- OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT=
161+
- OAUTH2_GENERIC_ID_PATH=
162+
- OAUTH2_GENERIC_USER_UID=
163+
- OAUTH2_GENERIC_USER_NAME=
164+
- OAUTH2_GENERIC_USER_EMAIL=
165+
- OAUTH2_GENERIC_NAME=
166+
154167
- OAUTH_AZURE_API_KEY=
155168
- OAUTH_AZURE_API_SECRET=
156169
- OAUTH_AZURE_TENANT_ID=

‎docs/docker-compose-keycloak.yml‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
version: '2'
2+
3+
services:
4+
redis:
5+
restart: always
6+
image: sameersbn/redis:4.0.9-2
7+
command:
8+
- --loglevel warning
9+
volumes:
10+
- redis-data:/var/lib/redis:Z
11+
12+
postgresql:
13+
restart: always
14+
image: sameersbn/postgresql:10-2
15+
volumes:
16+
- postgresql-data:/var/lib/postgresql:Z
17+
environment:
18+
- DB_USER=gitlab
19+
- DB_PASS=password
20+
- DB_NAME=gitlabhq_production
21+
- DB_EXTENSION=pg_trgm
22+
23+
gitlab:
24+
restart: always
25+
image: nuberabe/docker-gitlab:12.7.0
26+
depends_on:
27+
- redis
28+
- postgresql
29+
ports:
30+
- "10080:80"
31+
- "10022:22"
32+
volumes:
33+
- gitlab-data:/home/git/data:Z
34+
environment:
35+
- DEBUG=false
36+
37+
- DB_ADAPTER=postgresql
38+
- DB_HOST=postgresql
39+
- DB_PORT=5432
40+
- DB_USER=gitlab
41+
- DB_PASS=password
42+
- DB_NAME=gitlabhq_production
43+
44+
- REDIS_HOST=redis
45+
- REDIS_PORT=6379
46+
47+
- TZ=Asia/Kolkata
48+
- GITLAB_TIMEZONE=Kolkata
49+
50+
- GITLAB_HTTPS=false
51+
- SSL_SELF_SIGNED=false
52+
53+
- GITLAB_HOST='<your-ip-address>'
54+
- GITLAB_PORT=10080
55+
- GITLAB_SSH_PORT=10022
56+
- GITLAB_RELATIVE_URL_ROOT=
57+
- GITLAB_SECRETS_DB_KEY_BASE=long-and-random-alphanumeric-string
58+
- GITLAB_SECRETS_SECRET_KEY_BASE=long-and-random-alphanumeric-string
59+
- GITLAB_SECRETS_OTP_KEY_BASE=long-and-random-alphanumeric-string
60+
61+
- GITLAB_ROOT_PASSWORD=<root-password>
62+
- GITLAB_ROOT_EMAIL=
63+
64+
- GITLAB_NOTIFY_ON_BROKEN_BUILDS=true
65+
- GITLAB_NOTIFY_PUSHER=false
66+
67+
- [email protected]
68+
- [email protected]
69+
- [email protected]
70+
71+
- GITLAB_BACKUP_SCHEDULE=daily
72+
- GITLAB_BACKUP_TIME=01:00
73+
74+
- SMTP_ENABLED=false
75+
- SMTP_DOMAIN=www.example.com
76+
- SMTP_HOST=smtp.gmail.com
77+
- SMTP_PORT=587
78+
- [email protected]
79+
- SMTP_PASS=password
80+
- SMTP_STARTTLS=true
81+
- SMTP_AUTHENTICATION=login
82+
83+
- IMAP_ENABLED=false
84+
- IMAP_HOST=imap.gmail.com
85+
- IMAP_PORT=993
86+
- [email protected]
87+
- IMAP_PASS=password
88+
- IMAP_SSL=true
89+
- IMAP_STARTTLS=false
90+
91+
- OAUTH_ENABLED=true
92+
- OAUTH_AUTO_SIGN_IN_WITH_PROVIDER=Keycloak
93+
- OAUTH_ALLOW_SSO=Keycloak
94+
- OAUTH_BLOCK_AUTO_CREATED_USERS=false
95+
- OAUTH_AUTO_LINK_LDAP_USER=false
96+
- OAUTH_AUTO_LINK_SAML_USER=false
97+
- OAUTH_EXTERNAL_PROVIDERS=Keycloak
98+
99+
- OAUTH_CAS3_LABEL=cas3
100+
- OAUTH_CAS3_SERVER=
101+
- OAUTH_CAS3_DISABLE_SSL_VERIFICATION=false
102+
- OAUTH_CAS3_LOGIN_URL=/cas/login
103+
- OAUTH_CAS3_VALIDATE_URL=/cas/p3/serviceValidate
104+
- OAUTH_CAS3_LOGOUT_URL=/cas/logout
105+
106+
- OAUTH_GOOGLE_API_KEY=
107+
- OAUTH_GOOGLE_APP_SECRET=
108+
- OAUTH_GOOGLE_RESTRICT_DOMAIN=
109+
110+
- OAUTH_FACEBOOK_API_KEY=
111+
- OAUTH_FACEBOOK_APP_SECRET=
112+
113+
- OAUTH_TWITTER_API_KEY=
114+
- OAUTH_TWITTER_APP_SECRET=
115+
116+
- OAUTH_GITHUB_API_KEY=
117+
- OAUTH_GITHUB_APP_SECRET=
118+
- OAUTH_GITHUB_URL=
119+
- OAUTH_GITHUB_VERIFY_SSL=
120+
121+
- OAUTH_GITLAB_API_KEY=
122+
- OAUTH_GITLAB_APP_SECRET=
123+
124+
- OAUTH_BITBUCKET_API_KEY=
125+
- OAUTH_BITBUCKET_APP_SECRET=
126+
127+
- OAUTH_SAML_ASSERTION_CONSUMER_SERVICE_URL=
128+
- OAUTH_SAML_IDP_CERT_FINGERPRINT=
129+
- OAUTH_SAML_IDP_SSO_TARGET_URL=
130+
- OAUTH_SAML_ISSUER=
131+
- OAUTH_SAML_LABEL="Our SAML Provider"
132+
- OAUTH_SAML_NAME_IDENTIFIER_FORMAT=urn:oasis:names:tc:SAML:2.0:nameid-format:transient
133+
- OAUTH_SAML_GROUPS_ATTRIBUTE=
134+
- OAUTH_SAML_EXTERNAL_GROUPS=
135+
- OAUTH_SAML_ATTRIBUTE_STATEMENTS_EMAIL=
136+
- OAUTH_SAML_ATTRIBUTE_STATEMENTS_NAME=
137+
- OAUTH_SAML_ATTRIBUTE_STATEMENTS_USERNAME=
138+
- OAUTH_SAML_ATTRIBUTE_STATEMENTS_FIRST_NAME=
139+
- OAUTH_SAML_ATTRIBUTE_STATEMENTS_LAST_NAME=
140+
141+
- OAUTH_CROWD_SERVER_URL=
142+
- OAUTH_CROWD_APP_NAME=
143+
- OAUTH_CROWD_APP_PASSWORD=
144+
145+
- OAUTH_AUTH0_CLIENT_ID=
146+
- OAUTH_AUTH0_CLIENT_SECRET=
147+
- OAUTH_AUTH0_DOMAIN=
148+
- OAUTH_AUTH0_SCOPE=
149+
150+
- OAUTH_AZURE_API_KEY=
151+
- OAUTH_AZURE_API_SECRET=
152+
- OAUTH_AZURE_TENANT_ID=
153+
154+
- OAUTH2_GENERIC_APP_ID=git
155+
- OAUTH2_GENERIC_APP_SECRET=<your-client-secret>
156+
- OAUTH2_GENERIC_CLIENT_SITE=http://<your-ip-address>:10081
157+
- OAUTH2_GENERIC_CLIENT_USER_INFO_URL=http://<your-ip-address>:10081/auth/realms/master/protocol/openid-connect/userinfo
158+
- OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL=http://<your-ip-address>:10081/auth/realms/master/protocol/openid-connect/auth
159+
- OAUTH2_GENERIC_CLIENT_TOKEN_URL=http://<your-ip-address>:10081/auth/realms/master/protocol/openid-connect/token
160+
- OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT=http://<your-ip-address>:10081/auth/realms/master/protocol/openid-connect/logout
161+
- OAUTH2_GENERIC_ID_PATH=sub
162+
- OAUTH2_GENERIC_USER_UID=sub
163+
- OAUTH2_GENERIC_USER_NAME=preferred_username
164+
- OAUTH2_GENERIC_USER_EMAIL=email
165+
- OAUTH2_GENERIC_NAME=Keycloak
166+
167+
keycloak:
168+
restart: always
169+
image: jboss/keycloak:8.0.1
170+
ports:
171+
- "10081:8080"
172+
environment:
173+
- DEBUG=false
174+
- KEYCLOAK_PASSWORD=admin
175+
- KEYCLOAK_USER=admin
176+
177+
volumes:
178+
redis-data:
179+
postgresql-data:
180+
gitlab-data:

‎docs/images/keycloak-admin-acc.png‎

56.8 KB
Loading

‎docs/images/keycloak-client-creation.png‎

29.5 KB
Loading

‎docs/images/keycloak-client-creation2.png‎

102 KB
Loading

‎docs/images/keycloak-client.png‎

80.5 KB
Loading

0 commit comments

Comments
 (0)