Use Auth0 as an OAuth 2.0 authentication provider

DETAILS: Tier: Free, Premium, Ultimate Offering: Self-managed

To enable the Auth0 OmniAuth provider, you must create an Auth0 account, and an application.

1. Sign in to the Auth0 Console. You can also create an account using the same link.

2. Select New App/API.

3. Enter the Application Name. For example, 'GitLab'.

4. After creating the application, you should see the Quick Start options. Disregard these options and select Settings instead.

5. At the top of the Settings screen, you should see your Domain, Client ID, and Client Secret in the Auth0 Console. Note these settings to complete the configuration file later. For example:

   • Domain: test1234.auth0.com
   • Client ID: t6X8L2465bNePWLOvt9yi41i
   • Client Secret: KbveM3nqfjwCbrhaUy_gDu2dss8TIlHIdzlyf33pB7dEK5u_NyQdp65O_o02hXs2

6. Fill in the Allowed Callback URLs:

   • http://<your_gitlab_url>/users/auth/auth0/callback (or)
   • https://<your_gitlab_url>/users/auth/auth0/callback

7. Fill in the Allowed Origins (CORS):

   • http://<your_gitlab_url> (or)
   • https://<your_gitlab_url>

8. On your GitLab server, open the configuration file.

   For Linux package installations:

   sudo editor /etc/gitlab/gitlab.rb

   For self-compiled installations:

   cd /home/git/gitlab
   sudo -u git -H editor config/gitlab.yml

9. Configure the common settings to add auth0 as a single sign-on provider. This enables Just-In-Time account provisioning for users who do not have an existing GitLab account.

10. Add the provider configuration:

    For Linux package installations:

    gitlab_rails['omniauth_providers'] = [
      {
        name: "auth0",
        # label: "Provider name", # optional label for login button, defaults to "Auth0"
        args: {
          client_id: "<your_auth0_client_id>",
          client_secret: "<your_auth0_client_secret>",
          domain: "<your_auth0_domain>",
          scope: "openid profile email"
        }
      }
    ]

    For self-compiled installations:

    - { name: 'auth0',
        # label: 'Provider name', # optional label for login button, defaults to "Auth0"
        args: {
          client_id: '<your_auth0_client_id>',
          client_secret: '<your_auth0_client_secret>',
          domain: '<your_auth0_domain>',
          scope: 'openid profile email' }
      }

11. Replace <your_auth0_client_id> with the client ID from the Auth0 Console page.

12. Replace <your_auth0_client_secret> with the client secret from the Auth0 Console page.

13. Replace <your_auth0_domain> with the domain from the Auth0 Console page.

14. Reconfigure or restart GitLab, depending on your installation method:

    • If you installed using the Linux package, reconfigure GitLab.
    • If you self-compiled your installation, restart GitLab.

On the sign-in page there should now be an Auth0 icon below the regular sign-in form. Select the icon to begin the authentication process. Auth0 asks the user to sign in and authorize the GitLab application. If the user authenticates successfully, the user is returned to GitLab and signed in.