Using Gitlab as authentication provider

[aranvir]

Hi, I tried to use a private Gitlab server as an authentication provider. I have no experience with setting up OpenID authentication so I just thought I give it a try.

I used the following resources as references:

• https://wave.h2o.ai/docs/security#single-sign-on
• https://docs.gitlab.com/ee/integration/oauth_provider.html
• https://docs.gitlab.com/ee/api/oauth2.html

Unfortunately, the gitlab documentation is not the greatest for this (imo), since the information is a bit spread out...

I used http://gitlab.example.com/oauth/authorize as the -oidc-provider-url (but replaced gitlab.example.com with my private server address. This is also why http is used instead of https since it's internal only). I created a group application in my repo and set the scopes for openid, profile and email.

Using wave 0.25.2, I get the following error message:

panic: failed connecting to OIDC provider: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": invalid character '<' looking for beginning of value

I then tried to do the same request manually with Insomnia to investigate, and it returns an HTML instead of json, so I guess I've been using the wrong API endpoint there.

So this leads me to two questions:

• Does anyone have experience for how to set this up with Gitlab?
• And based on Offer multiple OpenID options to user #1754 I was wondering: Is it even possible to use Gitlab for this or are there some provider limitations that I'm unaware of?

Also, I'm happy to be redirect to a Gitlab forum or so, if that's the more appropriate area to ask these questions, but I thought I'd start here 😅

[mturoci]

Hi @aranvir.

It's most likely the wrong provider URL as you say. Its goal is to read http://localhost:8080/realms/master/.well-known/openid-configuration this config so maybe try to poke around and try to see if you can find that .well-known/configuration thing, then just strip the URL as needed.

As for #1754 this is about using multiple providers at the same time. If you just need to replace Keycloak with Gitlab, that should work fine. Please let me know whether you managed to successfully integrate, would be good to know if there are any other caveats that need to be done on our side to provide a smoother experience.

Edit: Maybe this is what you are after?

[aranvir]

Removing the trailing slash works!
However, when clicking on the "Log In using OpenID connect" button it forwards me to https://gitlab.ORGANIZATION.lan/oauth/authorize instead of to the http:// address. If I manually remove the s I get forwarded to gitlab but receive the error message The redirect URI included is not valid.. Within the address, the redirect uri got encoded to http%3A%2F%2Flocalhost%3A10101%2F_auth%2Fcallback which should be correct.

[mturoci]

forwards me to https://gitlab.ORGANIZATION.lan/oauth/authorize instead of to the http:// address

I would be surprised if gitlab supported plain http. My guess is they upgrade all the incoming traffic to https automatically. Better ask them though.

I get forwarded to gitlab but receive the error message The redirect URI included is not valid.

This usually happens when you forget to set your redirect URLs within your provider conf (usually a UI text field). For example, Keycloak has it like this.

Within the address, the redirect uri got encoded to http%3A%2F%2Flocalhost%3A10101%2F_auth%2Fcallback which should be correct.

Not sure how exactly this mechanism works, but if the redirect uri is a webhook, this won't work as Gitlab server is not within your local network, thus will try to its own localhost. However, if it's just a query URL param and the client (Wave server) is supposed to do the redirect, then it's correct. You need to try.

[aranvir]

Yea, I had forgotten to adjust the callback uri in the gitlab application settings as well. Then it worked.

The remaining issue seems to be the https thing, but that I have then to discuss internally!

Thanks so much for your help!
Maybe it would be useful to add a list of troubleshooting steps to your OpenID guide. But at the same time it might be hard to do this in a generic way for all providers and it is a bit out of scope for wave itself. Just a thought!

[mturoci]

Maybe it would be useful to add a list of troubleshooting steps to your OpenID guide. But at the same time it might be hard to do this in a generic way for all providers and it is a bit out of scope for wave itself. Just a thought!

Agreed, we might add an FAQ since the steps should be the same for all the OIDC-compliant providers. Feel free to open a PR with the FAQ list in https://wave.h2o.ai/docs/security/#single-sign-on since you went through all this and know the best what is confusing and what made it click for you.

Edit: Once resolved, mark this as answered so that other people can have easier time finding this.