Add support for querying epics with GraphQL

What does this MR do?

Allows one to query for epics using a Group GraphQL query.

Example

{
  group(fullPath: "h5bp") {
    id
    path
    fullPath
    epic(iid: 1) {
      id
      iid
      title
      path
      userPermissions {
        adminEpic
        createEpic
      }
      children {
        edges {
          node {
            id
            iid
            title
            state
            path
            reference(full: true)
            relationPath
            createdAt
            closedAt
            hasChildren
            hasIssues
            userPermissions {
              adminEpic
              createEpic
            }
            group {
              fullPath
            }
          }
        }
      }
      issues {
        edges {
          node {
            iid
            title
            closedAt
            state
            createdAt
            confidential
            webUrl
            dueDate
            weight
            path
            reference
            relationPath
            assignees {
              edges {
                node {
                  webUrl
                  name
                  username
                  avatarUrl
                }
              }
            }
            milestone {
              title
              startDate
              dueDate
            }
          }
        }
      }
    }
  }
}

This MR requires (and is based on) https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/13246. It has been extracted from https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/10999

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation created/updated or follow-up review issue created
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Performance and testing

• Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• Tested in all supported browsers

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• Label as security and @ mention @gitlab-com/gl-security/appsec
• The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team

Closes #10795 (closed)

doc/user/group/saml_sso/index.md

@@ -5,12 +5,12 @@
 NOTE: **Note:**
 This topic is for SAML on GitLab.com Silver tier and above. For SAML on self-managed GitLab instances, see [SAML OmniAuth Provider](../../../integration/saml.md).
 
-Currently SAML on GitLab.com can be used to automatically add users to a group, and does not yet sign users into GitLab.com. Users should already have an account on the GitLab instance, or can create one when logging in for the first time.
+SAML on GitLab.com allows users to be automatically added to a group, and then allows those users to sign into GitLab.com. Users should already have an account on the GitLab instance, or can create one when logging in for the first time.
 
 User synchronization for GitLab.com is partially supported using [SCIM](scim_setup.md).
 
 NOTE: **Note:**
-SAML SSO for groups is used only as a convenient way to add users and does not sync users between providers without using SCIM. If a group is not using SCIM, group Owners will still need to manage user accounts, such as removing users when necessary.
+SAML SSO for GitLab.com groups does not sync users between providers without using SCIM. If a group is not using SCIM, group Owners will still need to manage user accounts (for example, removing users when necessary).
 
 ## Configuring your Identity Provider
 
@@ -83,6 +83,23 @@ Once you've set up your identity provider to work with GitLab, you'll need to co
 | OneLogin | [Use the OneLogin SAML Test Connector](https://onelogin.service-now.com/support?id=kb_article&sys_id=93f95543db109700d5505eea4b96198f) |
 | Ping Identity | [Add and configure a new SAML application](https://docs.pingidentity.com/bundle/p1_enterpriseConfigSsoSaml_cas/page/enableAppWithoutURL.html) |
 
+## Linking SAML to your existing GitLab.com account
+
+To link SAML to your existing GitLab.com account:
+
+1. Sign in to your GitLab.com account.
+1. Locate the SSO URL for the group you are signing in to. A group Admin can find this on the group's **Settings > SAML SSO** page.
+1. Visit the SSO URL and click **Authorize**.
+1. Enter your credentials on the Identity Provider if prompted.
+1. You will be redirected back to GitLab.com and should now have access to the group. In the future, you can use SAML to sign in to GitLab.com.
+
+## Signing in to GitLab.com with SAML
+
+1. Locate the SSO URL for the group you are signing in to. A group Admin can find this on a group's **Settings > SAML SSO** page. If configured, it might also be possible to sign in to GitLab starting from your Identity Provider.
+1. Visit the SSO URL and click the **Sign in with Single Sign-On** button.
+1. Enter your credentials on the Identity Provider if prompted.
+1. You will be signed in to GitLab.com and redirected to the group.
+
 ## Unlinking accounts
 
 Users can unlink SAML for a group from their profile page. This can be helpful if: