To enable automatic linking for SAML, see the [SAML setup instructions](saml.md#general-setup).
You can define which OmniAuth providers you want to be `external`. Users
## Create an external providers list
creating accounts, or logging in by using these `external` providers cannot have
access to internal projects. You must use the full name of the provider,
You can define a list of external OmniAuth providers.
like `google_oauth2` for Google. Refer to the examples for the full names of the
Users who create accounts or sign in to GitLab through the listed providers do not get access to [internal projects](../public_access/public_access.md#internal-projects-and-groups).
supported providers.
To define the external providers list, use the full name of the provider,
for example, `google_oauth2` for Google. For provider names, see the
**OmniAuth provider name** column in the [supported providers table](#supported-providers).
NOTE:
NOTE:
If you decide to remove an OmniAuth provider from the external providers list,
If you remove an OmniAuth provider from the external providers list,
you must manually update the users that use this method to sign in if you want
you must manually update the users that use this sign-in method so their
their accounts to be upgraded to full internal accounts.
accounts are upgraded to full internal accounts.
-**For Omnibus installations**
-**For Omnibus installations**
...
@@ -184,70 +185,67 @@ their accounts to be upgraded to full internal accounts.
...
@@ -184,70 +185,67 @@ their accounts to be upgraded to full internal accounts.
## Use a custom OmniAuth provider
## Use a custom OmniAuth provider
NOTE:
NOTE:
The following information only applies for installations from source.
The following information only applies to installations from source.
GitLab uses [OmniAuth](https://github.com/omniauth/omniauth) for authentication and already ships
If you have to integrate with an authentication solution other than the [OmniAuth](https://github.com/omniauth/omniauth) providers included with GitLab,
with a few providers pre-installed, such as LDAP, GitHub, and Twitter. You may also
you can use a custom OmniAuth provider.
have to integrate with other authentication solutions. For
these cases, you can use the OmniAuth provider.
These steps are fairly general and you must figure out the exact details
These steps are general. Read the OmniAuth provider's documentation for the exact
from the OmniAuth provider's documentation.
implementation details.
- Stop GitLab:
1. Stop GitLab:
```shell
```shell
sudo service gitlab stop
sudo service gitlab stop
```
```
- Add the gem to your [`Gemfile`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/Gemfile):
1. Add the gem to your [`Gemfile`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/Gemfile):
```shell
```shell
gem "omniauth-your-auth-provider"
gem "omniauth-your-auth-provider"
```
```
- Install the new OmniAuth provider gem by running the following command:
1. Install the new OmniAuth provider gem:
```shell
```shell
sudo-u git -H bundle install--without development test mysql --path vendor/bundle --no-deployment
sudo-u git -H bundle install--without development test mysql --path vendor/bundle --no-deployment
```
```
> These are the same commands you used during initial installation in the [Install Gems section](../install/installation.md#install-gems) with `--path vendor/bundle --no-deployment` instead of `--deployment`.
These commands are the same as the commands for [installing gems](../install/installation.md#install-gems)
during initial installation, with `--path vendor/bundle --no-deployment` instead of `--deployment`.
- Start GitLab:
1. Start GitLab:
```shell
```shell
sudo service gitlab start
sudo service gitlab start
```
```
### Custom OmniAuth provider examples
### Custom OmniAuth provider examples
If you have successfully set up a provider that is not shipped with GitLab itself,
If you have successfully set up a provider that is not already integrated with GitLab,
please let us know.
let us know.
While we can't officially support every possible authentication mechanism out there,
We can't officially support every possible authentication mechanism available,
we'd like to at least help those with specific needs.
but we'd like to at least help those with specific needs.
## Enable or disable sign-in with an OmniAuth provider without disabling import sources
## Enable or disable sign-in with an OmniAuth provider without disabling import sources
Administrators are able to enable or disable **Sign In** by using some OmniAuth providers.
Administrators can enable or disable sign-in for some OmniAuth providers.
NOTE:
NOTE:
By default, **Sign In** is enabled by using all the OAuth Providers that have been configured in `config/gitlab.yml`.
By default, sign-in is enabled for all the OAuth providers configured in `config/gitlab.yml`.
To enable/disable an OmniAuth provider:
To enable or disable an OmniAuth provider:
1. On the top bar, select **Menu > Admin**.
1. On the top bar, select **Menu > Admin**.
1. On the left sidebar, go to **Settings**.
1. On the left sidebar, select **Settings**.
1. Scroll to the **Sign-in Restrictions** section, and click **Expand**.
1. Expand **Sign-in restrictions**.
1. Below **Enabled OAuth Sign-In sources**, select the checkbox for each provider you want to enable or disable.
1. In the **Enabled OAuth authentication sources** section, select or clear the checkbox for each provider you want to enable or disable.
