From 8fc93d46967e6f15c48b9c402058a09d619583eb Mon Sep 17 00:00:00 2001 From: Alan Crosswell Date: Thu, 29 Oct 2020 16:57:16 -0400 Subject: [PATCH 1/3] Gitlab Enterprise documentation Most importantly documents the Gitlab callback URL but also the various scopes that seem appropriate. --- plugins/auth-backend/README.md | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend/README.md b/plugins/auth-backend/README.md index 355fcc1536..4f5a9ef6c7 100644 --- a/plugins/auth-backend/README.md +++ b/plugins/auth-backend/README.md @@ -52,9 +52,27 @@ export AUTH_GITHUB_ENTERPRISE_INSTANCE_URL=https://x ### Gitlab +#### Creating a Gitlab Enterprise OAuth application + +Follow this link, substituting `gitlab.example.com` for your Gitlab enterprise domain, https://gitlab.example.com/profile/applications + +1. Set Application Name to `backstage-dev` or something along those lines. +1. The Authorization Callback URL should match the redirect URI set in Backstage. + 1. Set this to `http://localhost:7000/api/auth/gitlab/handler/frame` for local development. + 1. Set this to `http://{APP_FQDN}:{APP_BACKEND_PORT}/api/auth/gitlab/handler/frame` for non-local deployments. + 1. Select the checked scopes from this list: + - [ ] `api` Grants complete read/write access to the API, including all groups and projects. + - [x] `read_user` Grants read-only access to the authenticated user's profile through the /user API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under /users. + - [x] `read_repository` Grants read-only access to repositories on private projects using Git-over-HTTP (not using the API). + - [x] `write_repository` Grants read-write access to repositories on private projects using Git-over-HTTP (not using the API). + - [ ] `sudo` Grants permission to perform API actions as any user in the system, when authenticated as an admin user. + - [x] `openid` Grants permission to authenticate with GitLab using OpenID Connect. Also gives read-only access to the user's profile and group memberships. + - [x] `profile` Grants read-only access to the user's profile data using OpenID Connect. + - [x] `email` Grants read-only access to the user's primary email address using OpenID Connect. + ```bash -export GITLAB_BASE_URL=x # default is https://gitlab.com -export AUTH_GITLAB_CLIENT_ID=x +export GITLAB_BASE_URL=https://gitlab.example.com # for GitLab Enterprise. default is https://gitlab.com +export AUTH_GITLAB_CLIENT_ID=x # Gitlab calls this the Application ID export AUTH_GITLAB_CLIENT_SECRET=x ``` From 992072cc9455430ad44cf8fd2d022754f15522af Mon Sep 17 00:00:00 2001 From: Alan Crosswell Date: Sat, 31 Oct 2020 10:37:00 -0400 Subject: [PATCH 2/3] add lowercase gitlab to styles vocab --- .github/styles/vocab.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/styles/vocab.txt b/.github/styles/vocab.txt index 0cbd0ffa05..e05c5f8623 100644 --- a/.github/styles/vocab.txt +++ b/.github/styles/vocab.txt @@ -62,6 +62,7 @@ Firekube Fredrik github Github +gitlab Gitlab graphql graphviz From 13e6a6d337d3076e92f134b9e03f0d0fb52f3f0d Mon Sep 17 00:00:00 2001 From: Alan Crosswell Date: Sat, 31 Oct 2020 14:41:07 -0400 Subject: [PATCH 3/3] update GitLab docs to include both gitlab.com and GitLab Enterprise configuration --- plugins/auth-backend/README.md | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/plugins/auth-backend/README.md b/plugins/auth-backend/README.md index 4f5a9ef6c7..affaca9987 100644 --- a/plugins/auth-backend/README.md +++ b/plugins/auth-backend/README.md @@ -52,30 +52,41 @@ export AUTH_GITHUB_ENTERPRISE_INSTANCE_URL=https://x ### Gitlab -#### Creating a Gitlab Enterprise OAuth application +#### Creating a GitLab OAuth application -Follow this link, substituting `gitlab.example.com` for your Gitlab enterprise domain, https://gitlab.example.com/profile/applications +Follow this link, [Add new application](https://gitlab.com/-/profile/applications). 1. Set Application Name to `backstage-dev` or something along those lines. 1. The Authorization Callback URL should match the redirect URI set in Backstage. 1. Set this to `http://localhost:7000/api/auth/gitlab/handler/frame` for local development. 1. Set this to `http://{APP_FQDN}:{APP_BACKEND_PORT}/api/auth/gitlab/handler/frame` for non-local deployments. - 1. Select the checked scopes from this list: - - [ ] `api` Grants complete read/write access to the API, including all groups and projects. + 1. Select the following scopes from the list: - [x] `read_user` Grants read-only access to the authenticated user's profile through the /user API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under /users. - [x] `read_repository` Grants read-only access to repositories on private projects using Git-over-HTTP (not using the API). - [x] `write_repository` Grants read-write access to repositories on private projects using Git-over-HTTP (not using the API). - - [ ] `sudo` Grants permission to perform API actions as any user in the system, when authenticated as an admin user. - [x] `openid` Grants permission to authenticate with GitLab using OpenID Connect. Also gives read-only access to the user's profile and group memberships. - [x] `profile` Grants read-only access to the user's profile data using OpenID Connect. - [x] `email` Grants read-only access to the user's primary email address using OpenID Connect. ```bash -export GITLAB_BASE_URL=https://gitlab.example.com # for GitLab Enterprise. default is https://gitlab.com +export GITLAB_BASE_URL=https://gitlab.com export AUTH_GITLAB_CLIENT_ID=x # Gitlab calls this the Application ID export AUTH_GITLAB_CLIENT_SECRET=x ``` +#### Creating a GitLab Enterprise OAuth application + +If you have GitLab Enterprise, perform the steps above, replacing `gitlab.example.com` in the following +with the domain of your GitLab Enterprise host: + +Create new application at: `https://gitlab.example.com/profile/applications`. + +```bash +export GITLAB_BASE_URL=https://gitlab.example.com +export AUTH_GITLAB_CLIENT_ID=x # GitLab calls this the Application ID +export AUTH_GITLAB_CLIENT_SECRET=x +``` + ### Okta ```bash