GitLab Authentication

STEP 1

Create A GitLab App

In GitLab, navigate to User Settings > Applications and create a new application with the following settings:

• Application name: Loft Login via GitLab
• Redirect URI: https://loft.yourcompany.tld/auth/gitlab/callback = https:// + $LOFT_HOSTNAME + /auth/gitlab/callback
• Scopes: read_user + openid

Remember the $GITLAB_CLIENT_ID and $GITLAB_CLIENT_SECRET that GitLab generates for your OAuth application because you will need it in the next step.

STEP 2

Create Loft Config For GitLab

To tell Loft to use gitlab for SSO, navigate to Admin > Config in Loft and adjust your config as shown below:

auth:

# Tell loft to use gitlab authentication

gitlab:

#

#

# REQUIRED CONFIGURATION

#

#

# ClientID for the gitlab authentication. Can be string literal or pulled from the environment.

clientId: $CLIENTID

# ClientSecret for the gitlab authentication. Can be string literal or pulled from the environment.

clientSecret: $CLIENTSECRET

# Callback URL in the form of https://your-loft-domain/auth/gitlab/callback

redirectURI: https://loft.my.domain/auth/gitlab/callback

#

#

# OPTIONAL CONFIGURATION

#

#

# (Optional) BaseURL of the gitlab instance,

# default = https://gitlab.com

baseURL: https://my-gitlab-instance.com

# (Optional) Optional groups whitelist, communicated through the "groups" scope.

# If groups is omitted, all of the user's GitLab groups are returned.

# If groups is provided, this acts as a whitelist - only the user's GitLab

# groups that are in the configured groups below will go into the groups claim.

# Conversely, if the user is not in any of the configured groups, the user will

# not be authenticated.

groups:

- my-group

# (Optional) Cluster Account Templates that will be automatically added for new users

# logging in through this authentication

clusterAccountTemplates:

# The name of the cluster account template

- name: my-cluster-account-template

sync: true

# (Optional) A mapping between groups and cluster account templates.

# If the user has a certain group, the cluster account template

# will be added during creation

groupClusterAccountTemplates:

# Name of the group from the token

- group: my-group

# Names of the cluster account templates to apply

clusterAccountTemplates:

- name: my-cluster-account-template

sync: true

STEP 3

Authenticate via GitLab

After saving the new Loft configuration, Loft will restart itself and you should be able to log in via GitLab.

STEP 4

Disable Username + Password Authentication (optional)

To disable password-based authentication, navigate to Admin > Config add these two lines to your config:

auth:

oidc: ... # This is your SSO configuration (make sure this is working!)

password:

disabled: true # Disable password-based authentication