Skip to content

Installing and configuring OIDC SSO

The functionality is available in Enterprise, Atlas, and On-premise versions

Configuring OIDC SSO in GitFlic

Refer to the documentation of your authorization service to learn how to configure the basic connection. Use one of the specified Redirect Url values when configuring the connection to GitFlic:

  • If Standard Flow is used {base.url}/oidc/callback
  • If Implicit Flow is used {base.url}/oidc/callback/implicit

Configuration when using Standard Flow

On the OIDC connection settings page, specify the following data taken from your authorization service: Client ID, Client Secret, Configuration Url.

Client ID and Client Secret must be taken from the settings of your client application created in the authorization service. Configuration Url is usually located in the settings of the service itself, since it has a static nature.

Important! A user who authenticates through OIDC must have an email address and a unique username.

When using Standard Flow, be sure to specify the connection type to the authorization service in Client Authenticator.

Configuration when using JWT with and without Client Secret.

The Signed JWT connection implies the use of a JWT token that is requested by the authorization service from GitFlic. The authorization service can obtain JWT for connection at {base.url}/oidc/discovery/keys; specify this endpoint in the jwks_uri field of your authorization service.

If you use the JWT with Client Secret policy, specify this policy in the authorization service and also fill in the Сlient Secret field in the GitFlic OIDC connection settings.

Configuration when using Implicit Flow.

When Implicit Flow is enabled, any Secret or JWT will be ignored, because Implicit Flow implies obtaining an Access token through Client Id. Information synchronization is unavailable because there is no Refresh Token support. Entering Client Secret is optional.

Additional connection settings

When synchronization is enabled, user data will be updated once a day.

When permission to change the login is enabled, users who authenticated through OIDC will be able to change their username in GitFlic.

Please note that when changing LDAP to OIDC as the authorization provider, a special scheme applies for identifying users: the setting for changing the login affects the user's ability to authenticate. If the previous username is used, but email differs between authorization methods, then with the setting disabled, the user will not be able to authenticate. With the username change setting enabled, a new user will be created based on email from OIDC, and their uid from OIDC will be used instead of username. To authenticate to the created LDAP account through OIDC, permission for collisions between OIDC and LDAP must be enabled, users' email values must match, and username in this case will use the previously saved value.

Automated translation!

This page has been automatically translated. The text may contain inaccuracies.