google.md 4.79 KB
Newer Older
Drew Blessing's avatar
Drew Blessing committed
1 2
# Google OAuth2 OmniAuth Provider

3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29
To enable the Google OAuth2 OmniAuth provider you must register your application
with Google. Google will generate a client ID and secret key for you to use.

## Enabling Google OAuth

In Google's side:

1. Navigate to the [cloud resource manager](https://console.cloud.google.com/cloud-resource-manager) page
1. Select **Create Project**
1. Provide the project information:
    - **Project name** - "GitLab" works just fine here.
    - **Project ID** - Must be unique to all Google Developer registered applications.
      Google provides a randomly generated Project ID by default. You can use
      the randomly generated ID or choose a new one.
1. Refresh the page and you should see your new project in the list
1. Go to the [Google API Console](https://console.developers.google.com/apis/dashboard)
1. Select the previously created project form the upper left corner
1. Select **Credentials** from the sidebar
1. Select **OAuth consent screen** and fill the form with the required information
1. In the **Credentials** tab, select **Create credentials > OAuth client ID**
1. Fill in the required information
    - **Application type** - Choose "Web Application"
    - **Name** - Use the default one or provide your own
    - **Authorized JavaScript origins** -This isn't really used by GitLab but go
      ahead and put `https://gitlab.example.com`
    - **Authorized redirect URIs** - Enter your domain name followed by the
      callback URIs one at a time:
30

31 32 33 34
        ```
        https://gitlab.example.com/users/auth/google_oauth2/callback
        https://gitlab.exampl.com/-/google_api/auth/callback
        ```
35

36 37 38
1. You should now be able to see a Client ID and Client secret. Note them down
   or keep this page open as you will need them later.
1. From the **Dashboard** select **ENABLE APIS AND SERVICES > Google Cloud APIs > Container Engine API > Enable**
39

40
On your GitLab server:
41

42
1. Open the configuration file.
43

44
    For Omnibus GitLab:
45 46

    ```sh
47
    sudo editor /etc/gitlab/gitlab.rb
48 49
    ```

50
    For installations from source:
51

Drew Blessing's avatar
Drew Blessing committed
52
    ```sh
53 54
    cd /home/git/gitlab
    sudo -u git -H editor config/gitlab.yml
Drew Blessing's avatar
Drew Blessing committed
55
    ```
56

57 58
1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings.
1. Add the provider configuration:
59

60
    For Omnibus GitLab:
61 62

    ```ruby
63 64 65 66 67 68 69 70
    gitlab_rails['omniauth_providers'] = [
      {
        "name" => "google_oauth2",
        "app_id" => "YOUR_APP_ID",
        "app_secret" => "YOUR_APP_SECRET",
        "args" => { "access_type" => "offline", "approval_prompt" => '' }
      }
    ]
71
    ```
72

73
    For installations from source:
Drew Blessing's avatar
Drew Blessing committed
74 75

    ```
76 77 78
    - { name: 'google_oauth2', app_id: 'YOUR_APP_ID',
      app_secret: 'YOUR_APP_SECRET',
      args: { access_type: 'offline', approval_prompt: '' } }
Drew Blessing's avatar
Drew Blessing committed
79 80
    ```

81 82 83 84
1. Change `YOUR_APP_ID` to the client ID from the Google Developer page
1. Similarly, change `YOUR_APP_SECRET` to the client secret
1. Make sure that you configure GitLab to use an FQDN as Google will not accept
   raw IP addresses.
Kanchana Wickremasinghe's avatar
Kanchana Wickremasinghe committed
85 86 87 88

    For Omnibus packages:

    ```ruby
89
    external_url 'https://gitlab.example.com'
Kanchana Wickremasinghe's avatar
Kanchana Wickremasinghe committed
90 91 92 93 94 95 96 97 98
    ```

    For installations from source:

    ```yaml
    gitlab:
      host: https://gitlab.example.com
    ```

99
1.  Save the configuration file.
100 101
1.  [Reconfigure][] or [restart GitLab][] for the changes to take effect if you
    installed GitLab via Omnibus or from source respectively.
Drew Blessing's avatar
Drew Blessing committed
102

103 104 105 106
On the sign in page there should now be a Google icon below the regular sign in
form. Click the icon to begin the authentication process. Google will ask the
user to sign in and authorize the GitLab application. If everything goes well
the user will be returned to GitLab and will be signed in.
Drew Blessing's avatar
Drew Blessing committed
107

108
## Further Configuration
Drew Blessing's avatar
Drew Blessing committed
109

110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125
This further configuration is not required for Google authentication to function
but it is strongly recommended. Taking these steps will increase usability for
users by providing a little more recognition and branding.

At this point, when users first try to authenticate to your GitLab installation
with Google they will see a generic application name on the prompt screen. The
prompt informs the user that "Project Default Service Account" would like to
access their account. "Project Default Service Account" isn't very recognizable
and may confuse or cause users to be concerned. This is easily changeable:

1. Select 'Consent screen' in the left menu. (See steps 1, 4 and 5 above for
   instructions on how to get here if you closed your window).
1. Scroll down until you find "Product Name". Change the product name to
   something more descriptive.
1. Add any additional information as you wish - homepage, logo, privacy policy,
   etc. None of this is required, but it may help your users.
126 127

[reconfigure]: ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure
128
[restart GitLab]: ../administration/restart_gitlab.md#installations-from-source