Merge pull request #7725 from matusb/feature/shibboleth-support

shibboleth authentication support

5 files changed, 91 insertions, 0 deletions

diff --git a/CHANGELOG b/CHANGELOG
index efecd5ae671..6021da42422 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -25,6 +25,7 @@ v 7.3.0
   - Process git push --all much faster
   - Don't allow edit of system notes
   - Project wiki search (Ralf Seidler)
+  - Enabled Shibboleth authentication support (Matus Banas)
 
 v 7.2.1
   - Delete orphaned labels during label migration (James Brooks)
diff --git a/Gemfile b/Gemfile
index 996a89e4a0e..d67ecd72ccf 100644
--- a/Gemfile
+++ b/Gemfile
@@ -27,6 +27,7 @@ gem 'omniauth', "~> 1.1.3"
 gem 'omniauth-google-oauth2'
 gem 'omniauth-twitter'
 gem 'omniauth-github'
+gem 'omniauth-shibboleth'
 
 # Extracting information from a git repository
 # Provide access to Gitlab::Git library
diff --git a/Gemfile.lock b/Gemfile.lock
index a39935ac927..e8636fd7ac5 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -321,6 +321,8 @@ GEM
     omniauth-oauth2 (1.1.1)
       oauth2 (~> 0.8.0)
       omniauth (~> 1.0)
+    omniauth-shibboleth (1.1.1)
+      omniauth (>= 1.0.0)
     omniauth-twitter (1.0.1)
       multi_json (~> 1.3)
       omniauth-oauth (~> 1.0)
@@ -644,6 +646,7 @@ DEPENDENCIES
   omniauth-github
   omniauth-google-oauth2
   omniauth-twitter
+  omniauth-shibboleth
   org-ruby
   pg
   poltergeist (~> 1.5.1)
diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md
index 367fa0f0dda..00adae58dfa 100644
--- a/doc/integration/omniauth.md
+++ b/doc/integration/omniauth.md
@@ -50,6 +50,13 @@ Before configuring individual OmniAuth providers there are a few global settings
         # - { name: 'github', app_id: 'YOUR APP ID',
         #     app_secret: 'YOUR APP SECRET',
         #     args: { scope: 'user:email' } }
+        # - {"name": 'shibboleth',
+        #     args: { shib_session_id_field: "HTTP_SHIB_SESSION_ID",
+        #     shib_application_id_field: "HTTP_SHIB_APPLICATION_ID",
+        #     uid_field: "HTTP_EPPN",
+        #     name_field: "HTTP_CN",
+        #     info_fields: {"email": "HTTP_MAIL" } } }
+
     ```
 
 1.  Change `enabled` to `true`.
@@ -69,6 +76,7 @@ Before configuring individual OmniAuth providers there are a few global settings
 
 - [GitHub](github.md)
 - [Google](google.md)
+- [Shibboleth](shibboleth.md)
 - [Twitter](twitter.md)
 
 ## Enable OmniAuth for an Existing User
diff --git a/doc/integration/shibboleth.md b/doc/integration/shibboleth.md
new file mode 100644
index 00000000000..78317a5c0f2
--- /dev/null
+++ b/doc/integration/shibboleth.md
@@ -0,0 +1,78 @@
+# Shibboleth OmniAuth Provider
+
+This documentation is for enabling shibboleth with gitlab-omnibus package.
+
+In order to enable Shibboleth support in gitlab we need to use Apache instead of Nginx (It may be possible to use Nginx, however I did not found way to easily configure nginx that is bundled in gitlab-omnibus package). Apache uses mod_shib2 module for shibboleth authentication and can pass attributes as headers to omniauth-shibboleth provider. 
+
+
+To enable the Shibboleth OmniAuth provider you must:
+
+1. Configure Apache shibboleth module. Installation and configuration of module it self is out of scope of this document. 
+Check https://wiki.shibboleth.net/ for more info.
+
+1. You can find Apache config in gitlab-reciepes (https://github.com/gitlabhq/gitlab-recipes/blob/master/web-server/apache/gitlab-ssl.conf)
+
+Following changes are needed to enable shibboleth:
+
+protect omniauth-shibboleth callback url:
+```
+  <Location /users/auth/shibboleth/callback>
+    AuthType shibboleth
+    ShibRequestSetting requireSession 1
+    ShibUseHeaders On
+    require valid-user
+  </Location>
+
+  Alias /shibboleth-sp /usr/share/shibboleth
+  <Location /shibboleth-sp>
+    Satisfy any
+  </Location>
+
+  <Location /Shibboleth.sso>
+    SetHandler shib
+  </Location>
+```
+exclude shibboleth urls from rewriting, add "RewriteCond %{REQUEST_URI} !/Shibboleth.sso" and "RewriteCond %{REQUEST_URI} !/shibboleth-sp", config should look like this:
+```
+  #apache equivalent of nginx try files
+  RewriteEngine on
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{REQUEST_URI} !/Shibboleth.sso 
+  RewriteCond %{REQUEST_URI} !/shibboleth-sp 
+  RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]
+  RequestHeader set X_FORWARDED_PROTO 'https'
+```
+
+1.  Edit /etc/gitlab/gitlab.rb configuration file, your shibboleth attributes should be in form of "HTTP_ATTRIBUTE" and you should addjust them to your need and environment. Add any other configuration you need. 
+
+File it should look like this:
+```
+external_url 'https://gitlab.example.com'
+gitlab_rails['internal_api_url'] = 'https://gitlab.example.com'
+
+# disable nginx
+nginx['enable'] = false
+
+gitlab_rails['omniauth_allow_single_sign_on'] = true
+gitlab_rails['omniauth_block_auto_created_users'] = false
+gitlab_rails['omniauth_enabled'] = true
+gitlab_rails['omniauth_providers'] = [
+  {
+    "name" => 'shibboleth',
+        "args" => {
+        "shib_session_id_field" => "HTTP_SHIB_SESSION_ID",
+        "shib_application_id_field" => "HTTP_SHIB_APPLICATION_ID",
+        "uid_field" => 'HTTP_EPPN',
+        "name_field" => 'HTTP_CN',
+        "info_fields" => { "email" => 'HTTP_MAIL'}
+        }
+  }
+]
+
+```
+1. Save changes and reconfigure gitlab: 
+```
+sudo gitlab-ctl reconfigure
+```
+
+On the sign in page there should now be a "Sign in with: Shibboleth" icon below the regular sign in form. Click the icon to begin the authentication process. You will be redirected to IdP server (Depends on your Shibboleth module configuration). If everything goes well the user will be returned to GitLab and will be signed in.