[Legacy] Gitlab

Owned by Jon Espen Ingvaldsen (Unlicensed)
Last updated: Mar 29, 2022 by Steinar Line
4 min read

This guide is for an older version of Kantega SSO Enterprise and is no longer maintained. New guides are here: https://kantega-sso.atlassian.net/l/c/rNTaTonz .

This guide takes you through the steps of setting up Gitlab login to the following Atlassian applications:

  • Jira SERVER DATA CENTER

  • Confluence SERVER DATA CENTER

  • Bitbucket SERVER DATA CENTER

  • Bamboo SERVER

  • Fisheye / Crucible SERVER

 

You find a link to Atlassian Marketplace in the upper right corner of your Atlassian application. Click Manage apps and search for “Kantega”. Click “Free trial” or “Buy now” to install the app.

 

 

Add identity provider

A welcome message is shown when you select to configure the app for the very first time. Click “Start setup” and then “Setup SAML / OIDC”.

Select “Gitlab” in the identity provider gallery.

Gitlab allow you to setup single sign-on over the OpenID Connect protocol.

Click “Next”. Follow the setup steps below.

1. Select provisioning method

The Atlassian applications needs to have information about users logging in and their permissions. At this wizard step, we choose whether user and permission data already exist when users log in with SSO or if user records should be created dynamically (just-in-time provisioning). More information about user provisioning alternatives are found here

You can also specify whether users logging in through Gitlab should be added as members to a set of default groups automatically.

Select provisioning method, default groups and click “Next”.

*Confluence specific example. Other Atlassian applications will be similar.

2. Callback URL

The field “Callback URL” will be needed when configuring your identity provider. Copy this URL value (We will make use of this in the next step)

3. Configure identity provider

Sign in to your Gitlab server as an admin user. Go into the Gitlab settings from the upper right menu.

Click “Applications”. Here you can create a new OIDC application. Give the app a name and paste in the callback url generated by the Kantega SSO add-on.

 

Select the “openid” scope to enable OIDC authentication. Select also the “profile” and “email” scopes if you want to make use of just-in-time provisioning.

Click “Save application”.

4. Import metadata

Type inn the host url in the import step of the Kantega SSO wizard. Click “Next”.

5. Identity provider name

Fill in a name for your configuration, by default this is “Gitlab. Click “Next”

6. Client id and secret

In this step, we will copy client credentials from Gitlab and paste them into the Secrets step of the Kantega SSO wizard.

7. Summary

Validate your setup and click “Finish”.

8. Test and verify setup

On the next page you will be given a link to perform a test of your setup.

The test verifies that users are allowed to authenticate with the current configuration, and you get feedback on whether the current user is found in Atlassian application. You are also able to fix user lookup issues (selecting the right username attribute and express username transformation rules) and select data attributes for just-in-time provisioning here. More info about testing av verifying identity provider configurations.

6. Redirection mode

By default, Kantega SSO Enterprise will forward all users to the configured identity provider. However, you can configure both a subset of users who should be login through this identity provider and how they are redirected. More about configuration of redirection rules.