Skip to main content

Integrate with GitLab

Support level: authentik

What is GitLab?​

GitLab is a DevSecOps platform for source code management, CI/CD, issue tracking, and software delivery workflows.

-- https://about.gitlab.com/

Preparation​

The following placeholders are used in this guide:

  • gitlab.company is the FQDN of the GitLab installation.
  • authentik.company is the FQDN of the authentik installation.

If you enable GitLab's omniauth_auto_sign_in_with_provider setting later, GitLab redirects every sign-in attempt to authentik. To use GitLab built-in authentication, open https://gitlab.company/users/sign_in?auto_sign_in=false.

info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

authentik configuration​

GitLab supports single sign-on with SAML or OpenID Connect (OIDC). Choose one method and follow the matching tab in the GitLab configuration section.

GitLab configuration​

Apply the GitLab configuration for the SSO method that you configured in authentik.

Configure SAML authentication​

Create an application and provider​

SAML provider changes in authentik 2026.5

authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the Issuer value to: https://authentik.company/application/saml/<application_slug>/metadata/

Older versions of authentik set this value to authentik by default. If you're running an older version, please set Issuer to https://authentik.company/application/saml/<application_slug>/metadata/, where <application_slug> is the slug that you selected for the application.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click New Application to open the application wizard.

    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the Slug because it will be required later.
    • Choose a Provider type: select SAML Provider as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Set ACS URL to https://gitlab.company/users/auth/saml/callback.
      • Set Audience to https://gitlab.company.
      • Under Advanced protocol settings, select an available Signing certificate.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.

  3. Click Submit to save the new application and provider.

  4. Navigate to System > Certificates and expand the certificate that you selected for the SAML provider. Take note of the Certificate Fingerprint (SHA1) because it will be required later.

Configure GitLab​

Edit the GitLab configuration file and add the following configuration:

/etc/gitlab/gitlab.rb
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
gitlab_rails['omniauth_block_auto_created_users'] = false
gitlab_rails['omniauth_auto_link_saml_user'] = true
gitlab_rails['omniauth_providers'] = [
  {
    name: 'saml',
    label: 'authentik',
    args: {
      assertion_consumer_service_url: 'https://gitlab.company/users/auth/saml/callback',
      idp_cert_fingerprint: '<Certificate Fingerprint (SHA1) from authentik>',
      idp_sso_target_url: 'https://authentik.company/application/saml/<application_slug>/',
      issuer: 'https://gitlab.company',
      name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
      attribute_statements: {
        email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
        name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
        nickname: ['http://schemas.goauthentik.io/2021/02/saml/username']
      }
    }
  }
]

Run gitlab-ctl reconfigure for a Linux package installation, or restart the container after making changes.

Configure SCIM provisioning (optional)​

GitLab SCIM for self-managed instances requires GitLab Premium or Ultimate and SAML single sign-on. GitLab SCIM supports user provisioning, but not group provisioning.

  1. In GitLab, open the Admin area.

  2. Navigate to Settings > General.

  3. Expand SCIM Token and click Generate a SCIM token.

  4. Take note of the SCIM API endpoint URL and Your SCIM token values because they will be required in authentik.

  5. In authentik, navigate to Applications > Providers and click Create.

  6. Select SCIM Provider as the provider type and click Next.

  7. Enter the following values:

    • Name: choose a descriptive name.
    • URL: paste the SCIM API endpoint URL from GitLab.
    • Token: paste the SCIM token from GitLab.
    • Compatibility Mode: select GitLab.
    • Group Property Mappings: remove all selected mappings.

  8. Click Finish to save the provider.

  9. Navigate to Applications > Applications and select your GitLab application.

  10. Click Edit.

  11. In the Backchannel Providers field, select the SCIM provider that you created.

  12. Click Update to save the application.

Configuration verification​

To confirm that authentik is properly configured with GitLab, open GitLab and select the authentik sign-in option. After successful authentication, you are redirected back to GitLab and signed in.

Resources​