Skip to content

Enable omniauth by default

Nick Thomas requested to merge (removed):default-omnibus-enabled into master

Per https://gitlab.com/gitlab-org/gitlab-ce/issues/49990

From %11.1, the gitlab_rails['omniauth_enabled'] setting began to be respected in GitLab. This broke a number of incorrect-by-documentation setups that specified providers (and expected them to be available) while not making this setting true.

Since omniauth enabled with 0 providers configured is functionally equivalent to omniauth disabled, and since this setting has only been respected for a short time, I think we can make this functionality be enabled by default instead.

There is a risk that a subset of installations have providers configured, but are relying on the default value to keep them from being enabled. This change would lead to these installations enabling authentication methods. So we're trading the happiness of some users off against the security of some (theoretical, but plausible) users here.

I think we can mitigate the trade-off through documentation updates and a call-out in the release post. If we don't think that's sufficient, we could delay this MR until %12.0 ?

/cc @stanhu @godfat @DouweM

Edited by Nick Thomas

Merge request reports