From 860fc26086003f2d17c282a30dc1b61669146aba Mon Sep 17 00:00:00 2001 From: Daniel Schaaff Date: Fri, 7 Apr 2023 11:21:48 -0700 Subject: [PATCH] Add missing scopes to GitLab auth provider docs closes #17189 The auth docs are missing some scopes required by the GitLab provider. Without these scopes the RepoUrlPicker in software templates is unable to retrieve oauth tokens for the user. Signed-off-by: Daniel Schaaff --- docs/auth/gitlab/provider.md | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/docs/auth/gitlab/provider.md b/docs/auth/gitlab/provider.md index dc41617812..ed7fa6aec3 100644 --- a/docs/auth/gitlab/provider.md +++ b/docs/auth/gitlab/provider.md @@ -14,15 +14,17 @@ To support GitLab authentication, you must create an Application from the [GitLab settings](https://gitlab.com/-/profile/applications). The `Redirect URI` should point to your Backstage backend auth handler. -Settings for local development: - -- Name: Backstage (or your custom app name) -- Redirect URI: `http://localhost:7007/api/auth/gitlab/handler/frame` -- Scopes: `read_user` for sign-in. If you also need ID tokens (e.g. if you are - using the Kubernetes plugin and have clusters with `authProvider: oidc` and - [`oidcTokenProvider: -gitlab`](https://backstage.io/docs/features/kubernetes/configuration/#clustersoidctokenprovider-optional)), - add the `openid` scope. +1. Set Application Name to `backstage-dev` or something along those lines. +2. The Authorization Callback URL should match the redirect URI set in Backstage. + 1. Set this to `http://localhost:7007/api/auth/gitlab/handler/frame` for local development. + 2. Set this to `http://{APP_FQDN}:{APP_BACKEND_PORT}/api/auth/gitlab/handler/frame` for non-local deployments. + 3. Select the following scopes from the list: + - [x] `read_user` Grants read-only access to the authenticated user's profile through the /user API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under /users. + - [x] `read_repository` Grants read-only access to repositories on private projects using Git-over-HTTP (not using the API). + - [x] `write_repository` Grants read-write access to repositories on private projects using Git-over-HTTP (not using the API). + - [x] `openid` Grants permission to authenticate with GitLab using OpenID Connect. Also gives read-only access to the user's profile and group memberships. + - [x] `profile` Grants read-only access to the user's profile data using OpenID Connect. + - [x] `email` Grants read-only access to the user's primary email address using OpenID Connect. ## Configuration