GitLab SAML

Introduction

This document explains how to configure and manage GitLab On-Prem Omnibus integration with the PureAUTH Identity Platform and make GitLab authentication Passwordless.

STEP 1: Add GitLab SAML application on PureAUTH

  • Enter Any application Name.
  • Select Primary (Corporate Email) in the Dataset for email field.
  • In “SAML Response Endpoint (ACS URL)” field, enter the URL using the following pattern.
https://<gitlab domain>/users/auth/saml/callback
  • In “Audience (Entity ID)” field, enter the URL using the following pattern.
https://<gitlab domain>/
  • Click the Add button.
  • The application will be added and you will be shown SAML settings.

Note: Please also replace https with http whenever necessary (No SSL certificate is used)

STEP 2: Generate Fingerprint for the x509 certificate

  • From the SAML Settings page, copy the X.509 certificate from

—–BEGIN CERTIFICATE—– to —–END CERTIFICATE—–.

  • Go to https://www.samltool.com/fingerprint.php and paste it in the X.509 cert field.
  • Click to “Calculate Fingerprint” option.
  • Copy the Formatted Fingerprint and save it for later.
  • E.g. 5F:80:F4:99:BB:3E:EA:1C:C7:E9:F3:89:9A:69:31:7A:66:FF:EA:43.

STEP 3: Configure GitLab to use SAML authentication

Access the Gitlab server and follow the commands below to configure SAML for GitLab:

  • sudo editor /etc/gitlab/gitlab.rb
  • [Optional]

To enable JIT user creation, add the following to the configuration file.

  • gitlab_rails[‘omniauth_allow_single_sign_on’] = [‘saml’]
  • gitlab_rails[‘omniauth_block_auto_created_users’] = false

You can automatically link SAML users with existing GitLab users if their email addresses match by adding the following setting:

  • gitlab_rails[‘omniauth_auto_link_saml_user’] = true
  • [SAML Configuration]
gitlab_rails['omniauth_providers'] = [
  {
    name: "saml",
    label: "PureAUTH",
    args: {
      assertion_consumer_service_url: "https://<gitlab domain>/users/auth/saml/callback",
      idp_cert_fingerprint: "<Generated Fingerprint from previous step>",
      idp_sso_target_url: "<SAML LOGIN URL from PureAUTH>",
      issuer: "https://<gitlab domain>/",
      name_identifier_format: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
    }
  }
]
  • Save the file and exit.
  • Run sudo gitlab-ctl reconfigure

STEP 4 : Testing PureAUTH

Go to the GitLab Login page, if you see a login with PureAUTH button, the configuration was successful.

Try to login to GitLab using your AuthVR5 application profile.

For more information, refer to the official GitLab documentation here.

Was this article helpful to you? Yes No