Sign in through omniauth openid_connect gives 404 page for URI users/auth/openid_connect
Summary
Using omnibus package gitlab CE 11.11.0 el7.
Configured OpenID Connect OmniAuth provider according to the document: https://docs.gitlab.com/11.11/ce/administration/auth/oidc.html
Auto discovery is enabled. The OpenID Connect issuer is https://oauth.aliyun.com. Discovery endpoint is https://oauth.aliyun.com/.well-known/openid-configuration
After reconfigure and restart gitlab, I was able to see the SSO sign in icon. But when i click it to login through the OpenID Connect provider, the 404 page appears. The request URL is http://my_gitlab_url/users/auth/openid_connect
Steps to reproduce
The configuration is like this:
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = false
gitlab_rails['omniauth_auto_link_ldap_user'] = false
gitlab_rails['omniauth_auto_link_saml_user'] = false
gitlab_rails['omniauth_block_auto_created_users'] = true
gitlab_rails['omniauth_providers'] = [
{ 'name' => 'openid_connect',
'label' => 'aliyunRAM',
'args' => {
'scope' => ['openid','aliuid','profile'],
'response_type' => 'code',
'issuer' => 'https://oauth.aliyun.com',
'discovery' => true,
'client_auth_method' => 'query',
'uid_field' => 'name',
'client_options' => {
'identifier' => 'my_oidc_client_id',
'secret' => 'my_oidc_client_secret',
'redirect_uri' => 'http://my_gitlab_url/users/auth/openid_connect/callback'
}
}
}
]Example Project
(If possible, please create an example project here on GitLab.com that exhibits the problematic behavior, and link to it here in the bug report)
(If you are using an older version of GitLab, this will also determine whether the bug is fixed in a more recent version)
What is the current bug behavior?
404 page appears
What is the expected correct behavior?
Should redirect to authorization_endpoint: "https://signin.aliyun.com/oauth2/v1/auth"
Relevant logs and/or screenshots
==> /var/log/gitlab/gitlab-rails/production.log <==
Started POST "/users/auth/openid_connect" for 116.230.93.230 at 2019-05-23 07:05:48 +0000
Processing by OmniauthCallbacksController#passthru as HTML
Parameters: {"authenticity_token"=>"[FILTERED]"}
Completed 404 Not Found in 9ms (Views: 0.3ms | ActiveRecord: 0.0ms)
==> /var/log/gitlab/gitlab-rails/production_json.log <==
{"method":"POST","path":"/users/auth/openid_connect","format":"html","controller":"OmniauthCallbacksController","action":"passthru","status":404,"duration":11.05,"view":0.26,"db":0.0,"time":"2019-05-23T07:05:48.978Z","params":[{"key":"_method","value":"post"},{"key":"authenticity_token","value":"[FILTERED]"}],"remote_ip":"116.230.93.230","user_id":null,"username":null,"ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36","queue_duration":null,"correlation_id":"AAZL3ioUJz7"}
==> /var/log/gitlab/gitlab-rails/sidekiq_exporter.log <==
[2019-05-23 07:05:49] 127.0.0.1 - - [23/May/2019:07:05:49 UTC] "GET /metrics HTTP/1.1" 200 25 "-" "Prometheus/1.8.2"
==> /var/log/gitlab/gitlab-workhorse/current <==
2019-05-23_07:05:48.99040 gitlabxtransfer.chinanorth2.cloudapp.chinacloudapi.cn 116.230.93.230:0 - - [2019/05/23:07:05:48 +0000] "POST /users/auth/openid_connect HTTP/1.1" 404 3108 "http://gitlabxtransfer.chinanorth2.cloudapp.chinacloudapi.cn/users/sign_in" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36" 0.022
==> /var/log/gitlab/nginx/gitlab_access.log <==
116.230.93.230 - - [23/May/2019:07:05:48 +0000] "POST /users/auth/openid_connect HTTP/1.1" 404 3108 "http://gitlabxtransfer.chinanorth2.cloudapp.chinacloudapi.cn/users/sign_in" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"Output of checks
(If you are reporting a bug on GitLab.com, write: This bug happens on GitLab.com)
Results of GitLab environment info
Expand for output related to GitLab environment info
System information System: Current User: git Using RVM: no Ruby Version: 2.5.3p105 Gem Version: 2.7.9 Bundler Version:1.17.3 Rake Version: 12.3.2 Redis Version: 3.2.12 Git Version: 2.21.0 Sidekiq Version:5.2.7 Go Version: unknown
GitLab information Version: 11.11.0 Revision: 3e8ca2fb781 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 9.6.11 URL: http://gitlabxtransfer.chinanorth2.cloudapp.chinacloudapi.cn HTTP Clone URL: http://gitlabxtransfer.chinanorth2.cloudapp.chinacloudapi.cn/some-group/some-project.git SSH Clone URL: git@gitlabxtransfer.chinanorth2.cloudapp.chinacloudapi.cn:some-group/some-project.git Using LDAP: no Using Omniauth: yes Omniauth Providers: openid_connect
GitLab Shell Version: 9.1.0 Repository storage paths:
- default: /var/opt/gitlab/git-data/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git
Results of GitLab application Check
Expand for output related to the GitLab application check
Checking GitLab subtasks ...
Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 9.1.0 ? ... OK (9.1.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Check GitLab API access: OK Redis available via internal API: OK
Access to /var/opt/gitlab/.ssh/authorized_keys: OK gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... LDAP is disabled in config/gitlab.yml
Checking LDAP ... Finished
Checking GitLab App ...
Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet) Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... can't check, you have no projects Redis version >= 2.8.0? ... yes Ruby version >= 2.5.3 ? ... yes (2.5.3) Git version >= 2.21.0 ? ... yes (2.21.0) Git user has default SSH configuration? ... yes Active users: ... 1
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished
Possible fixes
(If you can, link to the line of code that might be responsible for the problem)