Allow omniauth username claim to be configurable
What does this MR do and why?
This MR allows administrators to specify a custom claim from a provider's auth_hash to use as the username in GitLab.
This allows self-hosted instances to handle auth_hash mappings outside of their control (i.e. from external identity providers or omniauth providers). For example, GitLab's OpenID Connect provider exposes a subset of data in info and remaps others. If the desired username is returned in a field outside of that set, like in sub, there's no way to retrieve the correct username.
This is not to be confused with the configurable uid_field mentioned in the docs:
<uid_field> (optional) is the field name from the user_info.raw_attributes that defines the value for uid. For example, preferred_username. If this value is not provided or the field with the configured value is missing from the user_info.raw_attributes details, the uid uses the sub field.
This option affects the user's extern_uid.
Screenshots or screen recordings
Here's a sample where I changed my username to my gitlab.com uid:
How to set up and validate locally
With gdk and this MR checked out:
-
Create an application on gitlab.com to use as an authentication provider (using
read_userscope for minimal access) - Modify the
config/gitlab.ymlforgitlabin yourgdksetup with the application credentials from step1and the following args:
development:
<<: *base
omniauth:
block_auto_created_users: false
allow_single_sign_on: ['gitlab']
providers:
- { name: 'gitlab',
app_id: 'APP_ID',
app_secret: 'APP_SECRET',
args: { gitlab_username_claim: 'uid', scope: 'read_user' } } # using uid as it is available and not generally used
- Run
gdk openand click sign-in with GitLab button - After signing in, click the user avatar in the top-right corner, the username should now be your
uid(instead of the same name on gitlab.com, see screenshot).
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
