GitLab 单点登录

用 Casdoor 配置 GitLab

1. 1

   在 Casdoor 中注册 GitLab

   在 Casdoor 控制台打开 应用，为 GitLab 添加一个应用，在它的 OIDC/OAuth 标签页复制 客户端ID 和 客户端密钥。把下面的地址加到 重定向URLs：

   • https://gitlab.example.com/users/auth/openid_connect/callback
2. 2

   Add Casdoor to gitlab.rb

   GitLab only talks to OpenID providers over HTTPS, so serve Casdoor over HTTPS. Add this to /etc/gitlab/gitlab.rb and run sudo gitlab-ctl reconfigure.

   gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect']
   gitlab_rails['omniauth_block_auto_created_users'] = false
   gitlab_rails['omniauth_providers'] = [
     {
       name: "openid_connect",
       label: "Casdoor",
       args: {
         name: "openid_connect",
         scope: ["openid", "profile", "email"],
         response_type: "code",
         issuer: "https://auth.example.com",
         discovery: true,
         client_auth_method: "query",
         uid_field: "sub",
         pkce: true,
         client_options: {
           identifier: "<client ID>",
           secret: "<client secret>",
           redirect_uri: "https://gitlab.example.com/users/auth/openid_connect/callback"
         }
       }
     }
   ]

3. 3

   Map Casdoor groups (GitLab Premium and Ultimate)

   To make members of a Casdoor group GitLab administrators, or to mark contractors as external users, add a gitlab block inside client_options. Set the Casdoor application's Token group format to Name so the values match.

   gitlab: {
     groups_attribute: "groups",
     admin_groups: ["gitlab-admins"],
     external_groups: ["contractors"]
   }

4. 4

   Sign in

   The sign-in page now has a Casdoor button. People who already have a GitLab account can connect Casdoor under User settings → Account → Service sign-in.

GitLab 的设置取自它的官方文档（核对于 2026年10月：GitLab OpenID Connect）；另见Casdoor 文档。GitLab 是其所有者的商标。