OmniAuth

Users can sign in to GitLab by using their credentials from Google, GitHub, and other popular services. OmniAuth is the Rack framework that GitLab uses to provide this authentication.

When configured, additional sign-in options are displayed on the sign-in page.

Supported providers

GitLab supports the following OmniAuth providers.

Configure common settings

Before you configure the OmniAuth provider, configure the settings that are common for all providers.

Configure initial settings

To change the OmniAuth settings:

After configuring these settings, you can configure your chosen provider.

Per-provider configuration

If allow_single_sign_on is set, GitLab uses one of the following fields returned in the OmniAuth auth_hash to establish a username in GitLab for the user signing in, choosing the first that exists:

• username.
• nickname.
• email.

You can create GitLab configuration on a per-provider basis, which is supplied to the provider using args. If you set the gitlab_username_claim variable in args for a provider, you can select another claim to use for the GitLab username. The chosen claim must be unique to avoid collisions.

gitlab_rails['omniauth_providers'] = [

  # The generic pattern for configuring a provider with name PROVIDER_NAME

  gitlab_rails['omniauth_providers'] = {
    name: "PROVIDER_NAME"
    ...
    args: { gitlab_username_claim: 'sub' } # For users signing in with the provider you configure, the GitLab username will be set to the "sub" received from the provider
  },

  # Here are examples using GitHub and Kerberos

  gitlab_rails['omniauth_providers'] = {
    name: "github"
    ...
    args: { gitlab_username_claim: 'name' } # For users signing in with GitHub, the GitLab username will be set to the "name" received from GitHub
  },
  {
    name: "kerberos"
    ...
    args: { gitlab_username_claim: 'uid' } # For users signing in with Kerberos, the GitLab username will be set to the "uid" received from Kerberos
  },
]

- { name: 'PROVIDER_NAME',
  # ...
  args: { gitlab_username_claim: 'sub' }
}
- { name: 'github',
  # ...
  args: { gitlab_username_claim: 'name' }
}
- { name: 'kerberos',
  # ...
  args: { gitlab_username_claim: 'uid' }
}

Passwords for users created via OmniAuth

The Generated passwords for users created through integrated authentication guide provides an overview about how GitLab generates and sets passwords for users created with OmniAuth.

Enable OmniAuth for an existing user

If you’re an existing user, after your GitLab account is created, you can activate an OmniAuth provider. For example, if you originally signed in with LDAP, you can enable an OmniAuth provider like Google.

Link an OmniAuth provider through profile settings

To link an OmniAuth provider through your profile settings:

1. Sign in to GitLab with your GitLab credentials, LDAP, or another OmniAuth provider.
2. In the upper-right corner, select your avatar.
3. Select Edit profile.
4. In the left sidebar, select Access > Password and authentication.
5. In the Service sign-in section, select the OmniAuth provider, such as Google.
6. You are redirected to the provider. After you authorize GitLab, you are redirected back to GitLab.

You can now use your chosen OmniAuth provider to sign in to GitLab.

Link an existing account when signing in with OmniAuth

By default, when you sign in with an OmniAuth provider whose email address matches an existing GitLab account, GitLab guides you through linking the provider to your existing account instead of showing a sign-in error.

If auto_link_user is enabled, linking happens automatically without a sign in flow. If the link_omniauth_to_existing_user_on_login feature flag is not enabled on your instance, sign-in fails with a 422 error instead.

The guided linking flow works as follows:

1. You attempt to sign in with an OmniAuth provider.
2. GitLab detects that the email address from the provider matches an existing account.
3. You are redirected to the sign-in page with a notice: “An account already exists with the email address for your <provider> account. Sign in with your existing credentials to connect your <provider> account.”
4. You sign in with your existing credentials, such as a username and password.
5. GitLab displays the Authorize identity provider link page.
6. Select Authorize

GitLab matches your email address against both your primary email and any confirmed secondary email addresses. After linking, you can use the OmniAuth provider to sign in to GitLab.

Because the link is established only after you prove ownership of the existing account by signing in, this flow is more secure than auto_link_user, which links accounts on email match alone.

Enable or disable sign-in with an OmniAuth provider without disabling import sources

Administrators can enable or disable sign-in for some OmniAuth providers.

To enable or disable an OmniAuth provider:

1. In the upper-right corner, select Admin.
2. In the left sidebar, select Settings > General.
3. Expand Sign-in restrictions.
4. In the Enabled OAuth authentication sources section, select or clear the checkbox for each provider you want to enable or disable.

Disable OmniAuth

OmniAuth is enabled by default. However, OmniAuth only works if providers are configured and enabled.

If OmniAuth providers are causing problems even when individually disabled, you can disable the entire OmniAuth subsystem by modifying the configuration file.

gitlab_rails['omniauth_enabled'] = false

omniauth:
  enabled: false

Link existing users to OmniAuth users

You can link OmniAuth users with existing GitLab users if their email addresses match. Two methods are available:

• Automatic linking (auto_link_user): GitLab links the OmniAuth identity to the matching account automatically on sign-in, without requiring the user to take any action.
• Guided linking (link_omniauth_to_existing_user_on_login feature flag): When auto_link_user is disabled, GitLab prompts the user to sign in with their existing credentials to confirm ownership before linking the identity. For more information, see Link an existing account when signing in with OmniAuth.

Automatic linking

To automatically link OmniAuth users with existing GitLab users when their email addresses match, enable auto_link_user.

The following example enables automatic linking for the OpenID Connect provider and the Google OAuth provider.

gitlab_rails['omniauth_auto_link_user'] = ["openid_connect", "google_oauth2"]

omniauth:
  auto_link_user: ["openid_connect", "google_oauth2"]

This method of enabling automatic linking works for all providers except SAML. To enable automatic linking for SAML, see the SAML setup instructions.

Create an external providers list

You can define a list of external OmniAuth providers. Users who create accounts or sign in to GitLab through the listed providers do not get access to internal projects and are marked as external users.

To define the external providers list, use the full name of the provider, for example, google_oauth2 for Google. For provider names, see the OmniAuth provider name column in the supported providers table.

gitlab_rails['omniauth_external_providers'] = ['saml', 'google_oauth2']

omniauth:
  external_providers: ['saml', 'google_oauth2']

Keep OmniAuth user profiles up to date

You can enable profile syncing from selected OmniAuth providers. You can sync any combination of the following user attributes:

• name
• email
• job_title
• location
• organization

When authenticating using LDAP, the user’s name and email are always synced.

Bypass two-factor authentication

With certain OmniAuth providers, users can sign in without using two-factor authentication (2FA).

To bypass 2FA, you can either:

• Define the allowed providers using an array (for example, ['saml', 'google_oauth2']).
• Specify true to allow all providers, or false to allow none.

This option should be configured only for providers that already have 2FA. The default is false.

This configuration doesn’t apply to SAML.

gitlab_rails['omniauth_allow_bypass_two_factor'] = ['saml', 'google_oauth2']

omniauth:
  allow_bypass_two_factor: ['saml', 'google_oauth2']

Sign in with a provider automatically

You can add the auto_sign_in_with_provider setting to your GitLab configuration to redirect login requests to your OmniAuth provider for authentication. This removes the need to select the provider before signing in.

For example, to enable automatic sign-in for the Azure v2 integration:

gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'azure_activedirectory_v2'

omniauth:
  auto_sign_in_with_provider: azure_activedirectory_v2

Keep in mind that every sign-in attempt is redirected to the OmniAuth provider, so you can’t sign in using local credentials. Ensure at least one of the OmniAuth users is an administrator.

You can also bypass automatic sign-in by browsing to https://gitlab.example.com/users/sign_in?auto_sign_in=false.

Use a custom OmniAuth provider icon

Most supported providers include a built-in icon for the rendered sign-in button.

To use your own icon, ensure your image is optimized for rendering at 64 x 64 pixels, then override the icon in one of two ways:

• Provide a custom image path:

  1. If you are hosting the image outside of your GitLab server domain, ensure your content security policies are configured to allow access to the image file.
  2. Depending on your method of installing GitLab, add a custom icon parameter to your GitLab configuration file. Read OpenID Connect OmniAuth provider for an example for the OpenID Connect provider.

• Embed an image directly in a configuration file: This example creates a Base64-encoded version of your image you can serve through a Data URL:

  1. Encode your image file with a GNU base64 command (such as base64 -w 0 <logo.png>) which returns a single-line <base64-data> string.

  2. Add the Base64-encoded data to a custom icon parameter in your GitLab configuration file:

     omniauth:
       providers:
         - { name: '...'
             icon: 'data:image/png;base64,<base64-data>'
             # Additional parameters removed for readability
           }

Change apps or configuration

Because OAuth in GitLab doesn’t support setting the same external authentication and authorization provider as multiple providers, GitLab configuration and user identification must be updated at the same time if the provider or app is changed. For example, you can set up saml and azure_activedirectory_v2 but cannot add a second azure_activedirectory_v2 to the same configuration.

These instructions apply to all methods of authentication where GitLab stores an extern_uid and it is the only data used for user authentication.

When changing apps within a provider, if the user extern_uid does not change, only the GitLab configuration must be updated.

To swap configurations:

1. Change provider configuration in your gitlab.rb file.
2. Update extern_uid for all users that have an identity in GitLab for the previous provider.

To find the extern_uid, look at an existing user’s current extern_uid for an ID that matches the appropriate field in your current provider for the same user.

There are two methods to update the extern_uid:

• Using the Users API. Pass the provider name and the new extern_uid.

• Using the Rails console:

  Identity.where(extern_uid: 'old-id').update!(extern_uid: 'new-id')

Known issues

Most supported OmniAuth providers don’t support Git over HTTP password authentication. As a workaround, you can authenticate using a personal access token.