Allow omniauth username claim to be configurable
What does this MR do and why?
This MR allows administrators to specify a custom claim from a provider's auth_hash
to use as the username in GitLab.
This allows self-hosted instances to handle auth_hash
mappings outside of their control (i.e. from external identity providers or omniauth providers). For example, GitLab's OpenID Connect provider exposes a subset of data in info
and remaps others. If the desired username is returned in a field outside of that set, like in sub
, there's no way to retrieve the correct username.
This is not to be confused with the configurable uid_field
mentioned in the docs:
<uid_field> (optional) is the field name from the user_info.raw_attributes that defines the value for uid. For example, preferred_username. If this value is not provided or the field with the configured value is missing from the user_info.raw_attributes details, the uid uses the sub field.
This option affects the user's extern_uid
.
Screenshots or screen recordings
Here's a sample where I changed my username to my gitlab.com uid
:
How to set up and validate locally
With gdk
and this MR checked out:
-
Create an application on gitlab.com to use as an authentication provider (using
read_user
scope for minimal access) - Modify the
config/gitlab.yml
forgitlab
in yourgdk
setup with the application credentials from step1
and the following args:
development:
<<: *base
omniauth:
block_auto_created_users: false
allow_single_sign_on: ['gitlab']
providers:
- { name: 'gitlab',
app_id: 'APP_ID',
app_secret: 'APP_SECRET',
args: { gitlab_username_claim: 'uid', scope: 'read_user' } } # using uid as it is available and not generally used
- Run
gdk open
and click sign-in with GitLab button - After signing in, click the user avatar in the top-right corner, the username should now be your
uid
(instead of the same name on gitlab.com, see screenshot).
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.