GitLab signs users in with their GitLab.com account. Because GitLab's OAuth provider is OpenID Connect compliant, this connector gets a proper id_token and a userinfo endpoint, including a email_verified claim, which most developer connectors do not provide.
Copy the redirect URI
In the Authdog console, select the project and environment, open Authentication > Providers, find GitLab, and click Enable. Copy the redirect URI shown in the form:
https://identity.authdog.com/api/v1/callback/<connectionId>Create the application
- Open Applications in your GitLab user settings. For an app your team shares, create it under Group settings > Applications instead.
- Select Add new application.
- Name it.
- Under Redirect URI, paste the redirect URI from Authdog. GitLab accepts several, one per line, so all your environments can share one application.
- Leave Confidential checked, Authdog exchanges the code from the server with a client secret.
- Select the scopes
openid,email, andprofile. - Save, then copy the Application ID and Secret.
Configure Authdog
| Field | Value |
|---|---|
| Client ID | GitLab Application ID |
| Client Secret | GitLab Secret |
Save, then toggle the connection active.
What GitLab returns
Authdog requests openid email profile and reads the profile from https://gitlab.com/oauth/userinfo: the sub identifier, email and its verified flag, username, name, and avatar.
The connector targets GitLab.com. A self-managed GitLab instance runs the same endpoints on your own host, which this connector does not point at, configure it through the generic OpenID Connect connector under Enterprise SSO, using your instance's discovery URL.
Test it
- Open your environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select Continue with GitLab and authorize.
- Confirm the user appears under Users with a verified email.
Troubleshooting
| Symptom | Cause |
|---|---|
The redirect URI included is not valid |
The URI is missing from the application's redirect list |
invalid_scope |
openid, email, or profile was not selected on the application |
invalid_client |
Application ID or secret mismatch, or the application was created as non-confidential |
| Sign-in fails only for self-managed users | This connector targets GitLab.com, use an OIDC enterprise connection |
Related
| Read | To learn how to |
|---|---|
| Connectors | Set up any other social provider |
| GitHub | Add the other developer identity provider |
| Enterprise SSO | Point a generic OIDC connection at a self-managed instance |