google.md 4.39 KB
Newer Older
1
---
2 3
stage: Create
group: Ecosystem
4
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
5 6
---

7
# Google OAuth2 OmniAuth Provider **(FREE)**
Drew Blessing's avatar
Drew Blessing committed
8

9
To enable the Google OAuth2 OmniAuth provider you must register your application
10
with Google. Google generates a client ID and secret key for you to use.
11 12 13 14 15 16

## Enabling Google OAuth

In Google's side:

1. Navigate to the [cloud resource manager](https://console.cloud.google.com/cloud-resource-manager) page
17
1. Select **Create Project**
18
1. Provide the project information:
19 20 21 22
   - **Project name** - "GitLab" works just fine here.
   - **Project ID** - Must be unique to all Google Developer registered applications.
     Google provides a randomly generated Project ID by default. You can use
     the randomly generated ID or choose a new one.
23 24
1. Refresh the page and you should see your new project in the list
1. Go to the [Google API Console](https://console.developers.google.com/apis/dashboard)
25
1. Select the previously created project in the upper left corner
26 27 28
1. Select **Credentials** from the sidebar
1. Select **OAuth consent screen** and fill the form with the required information
1. In the **Credentials** tab, select **Create credentials > OAuth client ID**
29
1. Fill in the required information
30 31 32 33 34 35 36
   - **Application type** - Choose "Web Application"
   - **Name** - Use the default one or provide your own
   - **Authorized JavaScript origins** -This isn't really used by GitLab but go
     ahead and put `https://gitlab.example.com`
   - **Authorized redirect URIs** - Enter your domain name followed by the
     callback URIs one at a time:

37
     ```plaintext
38 39 40
     https://gitlab.example.com/users/auth/google_oauth2/callback
     https://gitlab.example.com/-/google_api/auth/callback
     ```
41

42
1. You should now be able to see a Client ID and Client secret. Note them down
43
   or keep this page open as you need them later.
44 45 46 47 48
1. To enable projects to access [Google Kubernetes Engine](../user/project/clusters/index.md), you must also
   enable these APIs:
   - Google Kubernetes Engine API
   - Cloud Resource Manager API
   - Cloud Billing API
49

50 51 52 53 54 55 56
   To do so you need to:

   1. Go to the [Google API Console](https://console.developers.google.com/apis/dashboard).
   1. Click on **ENABLE APIS AND SERVICES** button at the top of the page.
   1. Find each of the above APIs. On the page for the API, press the **ENABLE** button.
      It may take a few minutes for the API to be fully functional.

57
On your GitLab server:
58

59
1. Open the configuration file.
60

61
   For Omnibus GitLab:
62

63
   ```shell
64 65
   sudo editor /etc/gitlab/gitlab.rb
   ```
66

67
   For installations from source:
68

69
   ```shell
70 71 72
   cd /home/git/gitlab
   sudo -u git -H editor config/gitlab.yml
   ```
73

74 75
1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings.
1. Add the provider configuration:
76

77
   For Omnibus GitLab:
78

79 80 81 82 83 84 85 86 87 88
   ```ruby
   gitlab_rails['omniauth_providers'] = [
     {
       "name" => "google_oauth2",
       "app_id" => "YOUR_APP_ID",
       "app_secret" => "YOUR_APP_SECRET",
       "args" => { "access_type" => "offline", "approval_prompt" => '' }
     }
   ]
   ```
89

90
   For installations from source:
Drew Blessing's avatar
Drew Blessing committed
91

92
   ```yaml
93 94 95 96
   - { name: 'google_oauth2',
       app_id: 'YOUR_APP_ID',
       app_secret: 'YOUR_APP_SECRET',
       args: { access_type: 'offline', approval_prompt: '' } }
97
   ```
Drew Blessing's avatar
Drew Blessing committed
98

99 100
1. Change `YOUR_APP_ID` to the client ID from the Google Developer page
1. Similarly, change `YOUR_APP_SECRET` to the client secret
101
1. Make sure that you configure GitLab to use a fully-qualified domain name, as Google doesn't accept
102
   raw IP addresses.
Kanchana Wickremasinghe's avatar
Kanchana Wickremasinghe committed
103

104
   For Omnibus packages:
Kanchana Wickremasinghe's avatar
Kanchana Wickremasinghe committed
105

106 107 108
   ```ruby
   external_url 'https://gitlab.example.com'
   ```
Kanchana Wickremasinghe's avatar
Kanchana Wickremasinghe committed
109

110
   For installations from source:
Kanchana Wickremasinghe's avatar
Kanchana Wickremasinghe committed
111

112 113 114 115
   ```yaml
   gitlab:
     host: https://gitlab.example.com
   ```
Kanchana Wickremasinghe's avatar
Kanchana Wickremasinghe committed
116

117
1. Save the configuration file.
118
1. [Reconfigure](../administration/restart_gitlab.md#omnibus-gitlab-reconfigure) or [restart GitLab](../administration/restart_gitlab.md#installations-from-source) for the changes to take effect if you
119
   installed GitLab via Omnibus or from source respectively.
Drew Blessing's avatar
Drew Blessing committed
120

121
On the sign in page there should now be a Google icon below the regular sign in
122
form. Click the icon to begin the authentication process. Google asks the
123
user to sign in and authorize the GitLab application. If everything goes well
124
the user is returned to GitLab and is signed in.