# \#omniauth

**URL:** https://forum.gitlab.com/tag/omniauth/102.md

[Latest](https://forum.gitlab.com/latest.md) · [Categories](https://forum.gitlab.com/categories.md) · [Tags](https://forum.gitlab.com/tags.md)

---

## [Using Keycloak as SSO for Gitlab with pre-existing users (no autocreate)](https://forum.gitlab.com/t/using-keycloak-as-sso-for-gitlab-with-pre-existing-users-no-autocreate/67833)

<div class="topic-metadata">

**Author:** [@igittigitt](https://forum.gitlab.com/u/igittigitt)\
**Replies:** 3\
**Last updated:** [October 24, 2026, 10:06pm UTC](https://forum.gitlab.com/t/using-keycloak-as-sso-for-gitlab-with-pre-existing-users-no-autocreate/67833 "2026-10-24T22:06:32Z")

</div>

I’ve connected my Gitlab to a Keycloak SSO using the OmniAuth configuration like described here: gitlab\_rails\['omniauth\_enabled'\] = true gitlab\_rails\['omniauth\_providers'\] = \[ { "name" =\> "keycloak", "label" …

---

## [After GitLab 18.x upgrade (Omnibus), omniauth-oauth2-generic fails – id\_path broken](https://forum.gitlab.com/t/after-gitlab-18-x-upgrade-omnibus-omniauth-oauth2-generic-fails-id-path-broken/130142)

<div class="topic-metadata">

**Author:** [@misterchen21308](https://forum.gitlab.com/u/misterchen21308)\
**Replies:** 5\
**Last updated:** [October 9, 2025, 6:44am UTC](https://forum.gitlab.com/t/after-gitlab-18-x-upgrade-omnibus-omniauth-oauth2-generic-fails-id-path-broken/130142 "2025-10-09T06:44:00Z")

</div>

Description Environment: GitLab Omnibus, using omniauth-oauth2-generic strategy. In 17.x (including fresh Omnibus installs), login works fine. After upgrading to 18.x, login fails: email / name must be lowerca…

---

## [Generic\_oauth login fails after GitLab 18.x upgrade – id\_path not working](https://forum.gitlab.com/t/generic-oauth-login-fails-after-gitlab-18-x-upgrade-id-path-not-working/130107)

<div class="topic-metadata">

**Author:** [@misterchen21308](https://forum.gitlab.com/u/misterchen21308)\
**Replies:** 0\
**Last updated:** [August 27, 2025, 8:35am UTC](https://forum.gitlab.com/t/generic-oauth-login-fails-after-gitlab-18-x-upgrade-id-path-not-working/130107 "2025-08-27T08:35:03Z")

</div>

After upgrading GitLab to 18.x, our generic\_oauth login stopped working. Key points: Fresh GitLab 17.x installation works correctly. After upgrade to 18.x, login fails with 422 Email is blank. Changing email an…

---

## [Self Managaed Gitlab SAML authentication with Oracle IDCS](https://forum.gitlab.com/t/self-managaed-gitlab-saml-authentication-with-oracle-idcs/120014)

<div class="topic-metadata">

**Author:** [@AbijithS](https://forum.gitlab.com/u/AbijithS)\
**Replies:** 0\
**Last updated:** [January 18, 2025, 4:57am UTC](https://forum.gitlab.com/t/self-managaed-gitlab-saml-authentication-with-oracle-idcs/120014 "2025-01-18T04:57:37Z")

</div>

Has anybody used Oracle IDCS as an omniauth IDP? The redirection to Oracle IDCS is not exactly reaching the right entity? The error states something about signature.

---

## [GitHub OAuth: Sync profile picture / set description](https://forum.gitlab.com/t/github-oauth-sync-profile-picture-set-description/115045)

<div class="topic-metadata">

**Author:** [@3rdcycle](https://forum.gitlab.com/u/3rdcycle)\
**Replies:** 0\
**Last updated:** [October 9, 2024, 9:38am UTC](https://forum.gitlab.com/t/github-oauth-sync-profile-picture-set-description/115045 "2024-10-09T09:38:37Z")

</div>

I managed to set up OmniAuth with GitHub, allowing GitHub users to log in to our GitLab instance. I use gitlab\_rails\['omniauth\_sync\_profile\_attributes'\] = \['name', 'email', 'location'\] Is there any way to sync GitHub p…

---

## [2FA Bypass didn´t work](https://forum.gitlab.com/t/2fa-bypass-didn-t-work/80411)

<div class="topic-metadata">

**Author:** [@matzeeg3](https://forum.gitlab.com/u/matzeeg3)\
**Replies:** 2\
**Last updated:** [August 27, 2024, 8:07am UTC](https://forum.gitlab.com/t/2fa-bypass-didn-t-work/80411 "2024-08-27T08:07:41Z")

</div>

Hi everyone, i am using an Gitlab 15.7.5 Server on an VM and i added 2 Omniauth Provider. These two Providers work fine but because the users coming from the Omniauth Providers are allready 2FA authed i like to bypass …

---

## [OpenID Connect Invalid Client or credentials](https://forum.gitlab.com/t/openid-connect-invalid-client-or-credentials/43292)

<div class="topic-metadata">

**Author:** [@bb.bonnot](https://forum.gitlab.com/u/bb.bonnot)\
**Replies:** 1\
**Last updated:** [April 16, 2024, 8:57am UTC](https://forum.gitlab.com/t/openid-connect-invalid-client-or-credentials/43292 "2024-04-16T08:57:16Z")

</div>

Hello everyone, I am trying to authenticate on GitLab via OpenId Connect service. I followed this documentation Use OpenID Connect as an OAuth 2.0 authentication provider | GitLab. However I still encounter some issue. …

---

## [Shibboleth integration with docker gitlab-ce 16.8 behind apache 2.4 proxy](https://forum.gitlab.com/t/shibboleth-integration-with-docker-gitlab-ce-16-8-behind-apache-2-4-proxy/100520)

<div class="topic-metadata">

**Author:** [@mecobu](https://forum.gitlab.com/u/mecobu)\
**Replies:** 0\
**Last updated:** [February 28, 2024, 2:58pm UTC](https://forum.gitlab.com/t/shibboleth-integration-with-docker-gitlab-ce-16-8-behind-apache-2-4-proxy/100520 "2024-02-28T14:58:46Z")

</div>

I have a problem configuring gitlab authentication with omniauth and shibboleth ( i’m using an old version idp3) . In particular i’m using docker version (20.10.7) with image gitlab/gitlab-ce:16.8.2-ce.0 , with this gitl…

---

## [Sign in directly with an omniauth provider when several are configured](https://forum.gitlab.com/t/sign-in-directly-with-an-omniauth-provider-when-several-are-configured/97635)

<div class="topic-metadata">

**Author:** [@baby-gnu](https://forum.gitlab.com/u/baby-gnu)\
**Replies:** 2\
**Last updated:** [February 26, 2024, 9:57am UTC](https://forum.gitlab.com/t/sign-in-directly-with-an-omniauth-provider-when-several-are-configured/97635 "2024-02-26T09:57:30Z")

</div>

Hello. We have a self managed gitlab 16.7 with 2 OIDC omniauth providers to authenticates users. When they go to the /users/sign\_in page, they got 2 buttons to choose which provider to use for authentication. Both com…

---

## [Enable authentication for registry, without permitting creation of new accounts via JWT](https://forum.gitlab.com/t/enable-authentication-for-registry-without-permitting-creation-of-new-accounts-via-jwt/100284)

<div class="topic-metadata">

**Author:** [@andrew2758](https://forum.gitlab.com/u/andrew2758)\
**Replies:** 3\
**Last updated:** [February 23, 2024, 8:54pm UTC](https://forum.gitlab.com/t/enable-authentication-for-registry-without-permitting-creation-of-new-accounts-via-jwt/100284 "2024-02-23T20:54:57Z")

</div>

Problem to solve We get errors when pushing to our registry with Docker and Podman. Podman’s error is: Error: writing blob: uploading layer to ... received unexpected HTTP status: 204 No Content So I am reviewing the r…

---

## [500 error after Keycloak login -- certificate verify failed unable to get local issuer certificate](https://forum.gitlab.com/t/500-error-after-keycloak-login-certificate-verify-failed-unable-to-get-local-issuer-certificate/49065)

<div class="topic-metadata">

**Author:** [@bhovan](https://forum.gitlab.com/u/bhovan)\
**Replies:** 6\
**Last updated:** [December 28, 2023, 2:39pm UTC](https://forum.gitlab.com/t/500-error-after-keycloak-login-certificate-verify-failed-unable-to-get-local-issuer-certificate/49065 "2023-12-28T14:39:53Z")

</div>

I’m integrating a Gitlab CE instance with a Keycloak instance for SSO following the guide below: I’ve been working at this off and on for a couple of weeks now and I cannot get it to work. The integration is enabled an…

---

## [Authentication on MS Azure (Entra) fails after updating app secret](https://forum.gitlab.com/t/authentication-on-ms-azure-entra-fails-after-updating-app-secret/93865)

<div class="topic-metadata">

**Author:** [@pere](https://forum.gitlab.com/u/pere)\
**Replies:** 2\
**Last updated:** [October 13, 2023, 1:09pm UTC](https://forum.gitlab.com/t/authentication-on-ms-azure-entra-fails-after-updating-app-secret/93865 "2023-10-13T13:09:34Z")

</div>

We’re using omniauth to authenticate users via the azure\_activedirectory\_v2 method, and our app secret was close to expiring, so I updated it earlier today. (Something we’ve done multiple times before) But, after updati…

---

## [Activate omniauth feature in gitlab on openshift](https://forum.gitlab.com/t/activate-omniauth-feature-in-gitlab-on-openshift/91609)

<div class="topic-metadata">

**Author:** [@guillaume.ginis](https://forum.gitlab.com/u/guillaume.ginis)\
**Replies:** 0\
**Last updated:** [August 23, 2023, 11:43am UTC](https://forum.gitlab.com/t/activate-omniauth-feature-in-gitlab-on-openshift/91609 "2023-08-23T11:43:09Z")

</div>

Hello, For a Proof of concept, we are installing gitlab under our own okd bare-metal install. We used latest version of openshift and gitlab operator even if we know that they may not be compatible. Basically, our gitl…

---

## [Oauth2\_generic: invalid oauthscope](https://forum.gitlab.com/t/oauth2-generic-invalid-oauthscope/90414)

<div class="topic-metadata">

**Author:** [@vinodsingh](https://forum.gitlab.com/u/vinodsingh)\
**Replies:** 2\
**Last updated:** [August 15, 2023, 4:58am UTC](https://forum.gitlab.com/t/oauth2-generic-invalid-oauthscope/90414 "2023-08-15T04:58:00Z")

</div>

I am running a self hosted GitLab 15.5.4 and trying to use ‘oauth2\_generic’ for authentication. The configuration in gitlab.rb is given below. ### OmniAuth Settings ###! Docs: https://docs.gitlab.com/ee/integration/omni…

---

## [How do I add Shibboleth as an OmniAuth provider?](https://forum.gitlab.com/t/how-do-i-add-shibboleth-as-an-omniauth-provider/89075)

<div class="topic-metadata">

**Author:** [@BerryJuceMilk](https://forum.gitlab.com/u/BerryJuceMilk)\
**Replies:** 4\
**Last updated:** [August 9, 2023, 1:35pm UTC](https://forum.gitlab.com/t/how-do-i-add-shibboleth-as-an-omniauth-provider/89075 "2023-08-09T13:35:48Z")

</div>

Hello All, I hope this is the right subforum for this. I have followed the very brief instructions Shibboleth OmniAuth Provider | GitLab and have also googled, but am getting nowhere. Here’s the problem I’m having: W…

---

## [SAML Enforcement for EE (Self-hosted)](https://forum.gitlab.com/t/saml-enforcement-for-ee-self-hosted/90239)

<div class="topic-metadata">

**Author:** [@nick.p.doyle](https://forum.gitlab.com/u/nick.p.doyle)\
**Replies:** 0\
**Last updated:** [July 24, 2023, 9:37am UTC](https://forum.gitlab.com/t/saml-enforcement-for-ee-self-hosted/90239 "2023-07-24T09:37:47Z")

</div>

I see gitlab.com cloud has ability to enforce SAML, but can’t see how to do this with self-hosted. My use case is, once a user is offboarded from AzureAD, want to be sure they can’t also access the org’s Gitlab.

---

## [Custom label using openid omniauth provider not working](https://forum.gitlab.com/t/custom-label-using-openid-omniauth-provider-not-working/86079)

<div class="topic-metadata">

**Author:** [@Fred81](https://forum.gitlab.com/u/Fred81)\
**Replies:** 0\
**Last updated:** [May 8, 2023, 11:17am UTC](https://forum.gitlab.com/t/custom-label-using-openid-omniauth-provider-not-working/86079 "2023-05-08T11:17:05Z")

</div>

I successfully configured openid authentication with my keycloak instance. However, the label text of the OpenID login button is always “OpenID Connect”, even though I tried to change it. What am I doing wrong? gitlab\_r…

---

## [OpendIDConnect issues, invalid 'state' parameter and parse failures](https://forum.gitlab.com/t/opendidconnect-issues-invalid-state-parameter-and-parse-failures/83557)

<div class="topic-metadata">

**Author:** [@evergreen](https://forum.gitlab.com/u/evergreen)\
**Replies:** 0\
**Last updated:** [March 20, 2023, 4:44pm UTC](https://forum.gitlab.com/t/opendidconnect-issues-invalid-state-parameter-and-parse-failures/83557 "2023-03-20T16:44:14Z")

</div>

I have the setup for OpenIDConnect mostly working, but when it gets redirected back to gitlab after logging in it says: Could not authenticate you from OpenIDConnect because "Invalid 'state' parameter". I have checked …

---

## [Possibility to use LDAP as IDM and additionally Keycloak Omniauth configuration as SSO provider](https://forum.gitlab.com/t/possibility-to-use-ldap-as-idm-and-additionally-keycloak-omniauth-configuration-as-sso-provider/79762)

<div class="topic-metadata">

**Author:** [@RobertLiebauCG](https://forum.gitlab.com/u/RobertLiebauCG)\
**Replies:** 0\
**Last updated:** [January 6, 2023, 12:31pm UTC](https://forum.gitlab.com/t/possibility-to-use-ldap-as-idm-and-additionally-keycloak-omniauth-configuration-as-sso-provider/79762 "2023-01-06T12:31:05Z")

</div>

Hello, we have configured LDAP as the authentication provider and want to also enable SSO based on the Omniauth provider with Keycloak backend. Currently it is not possible to activate the SSO feature in the user profi…

---

## [Omniauth saml fails to create users - email blank](https://forum.gitlab.com/t/omniauth-saml-fails-to-create-users-email-blank/78423)

<div class="topic-metadata">

**Author:** [@Craig\_S](https://forum.gitlab.com/u/Craig_S)\
**Replies:** 1\
**Last updated:** [December 2, 2022, 12:16am UTC](https://forum.gitlab.com/t/omniauth-saml-fails-to-create-users-email-blank/78423 "2022-12-02T00:16:58Z")

</div>

I have enabled saml omniauth and can successfully use saml for authentication. I have wanted to enable omniauth\_auto\_sign\_in\_with\_provider = ‘saml’ and it works for those with existing accounts, however a user without a…

---

## [OmniAuth Integration without E-Mail - possible?](https://forum.gitlab.com/t/omniauth-integration-without-e-mail-possible/77878)

<div class="topic-metadata">

**Author:** [@chariri](https://forum.gitlab.com/u/chariri)\
**Replies:** 2\
**Last updated:** [November 21, 2022, 9:42am UTC](https://forum.gitlab.com/t/omniauth-integration-without-e-mail-possible/77878 "2022-11-21T09:42:32Z")

</div>

Describe your question in as much detail as possible: What are you seeing, and how does it differ from what you expect to see? When I configure an OmniAuth provider using omniauth-oauth2-generic connect to an OAuth2 a…

---

## [Gitlab integration with SSO Cas](https://forum.gitlab.com/t/gitlab-integration-with-sso-cas/76951)

<div class="topic-metadata">

**Author:** [@admincauce](https://forum.gitlab.com/u/admincauce)\
**Replies:** 2\
**Last updated:** [November 3, 2022, 2:30pm UTC](https://forum.gitlab.com/t/gitlab-integration-with-sso-cas/76951 "2022-11-03T14:30:46Z")

</div>

Hi I have a Gitlab CE version 13 instance installed from source. I have it configured to authenticate against LDAP, but now I need it to authenticate against a CAS server. I’ve been reviewing the Gitlab integration docu…

---

## [Can Omnibus with SASL be configured to require auth for ALL https access?](https://forum.gitlab.com/t/can-omnibus-with-sasl-be-configured-to-require-auth-for-all-https-access/75153)

<div class="topic-metadata">

**Author:** [@kfsone](https://forum.gitlab.com/u/kfsone)\
**Replies:** 0\
**Last updated:** [September 16, 2022, 9:58pm UTC](https://forum.gitlab.com/t/can-omnibus-with-sasl-be-configured-to-require-auth-for-all-https-access/75153 "2022-09-16T21:58:08Z")

</div>

Self-hosted, omnibus linux installation in a VPC with JumpCloud’s SASL provider for authentication. Periodically we have to provide external contractors/vendors access, so, we would like to guarantee that any https requ…

---

## [After successful SAML authentication, self hosted GitLab gives a 500 error](https://forum.gitlab.com/t/after-successful-saml-authentication-self-hosted-gitlab-gives-a-500-error/70878)

<div class="topic-metadata">

**Author:** [@mehunter7](https://forum.gitlab.com/u/mehunter7)\
**Replies:** 2\
**Last updated:** [July 27, 2022, 2:46pm UTC](https://forum.gitlab.com/t/after-successful-saml-authentication-self-hosted-gitlab-gives-a-500-error/70878 "2022-07-27T14:46:46Z")

</div>

I just upgraded to GitLab 15.0.2, and everything went well, including the reconfiguration. Afterwards, I tried to log in and was presented with a 500 error. I noticed that the SAML certificate was expired, so I renewed i…

---

## [Federated authentiction? (Omniauth + oAuth2 provider)](https://forum.gitlab.com/t/federated-authentiction-omniauth-oauth2-provider/72700)

<div class="topic-metadata">

**Author:** [@menathor](https://forum.gitlab.com/u/menathor)\
**Replies:** 0\
**Last updated:** [July 22, 2022, 12:17pm UTC](https://forum.gitlab.com/t/federated-authentiction-omniauth-oauth2-provider/72700 "2022-07-22T12:17:24Z")

</div>

Hi all Does anyone know if Gitlab (self-hosted) can function as a federated authentication provider? I.e. can I set up Omniauth use my Okta account for login, and then create oAuth2 apps in Gitlab for other apps (eg. Ma…

---

## [Gitlab - Omniauth CAS3 - error 422 (OAuth) Error saving user \["Email is invalid"\]](https://forum.gitlab.com/t/gitlab-omniauth-cas3-error-422-oauth-error-saving-user-email-is-invalid/47425)

<div class="topic-metadata">

**Author:** [@Antoine](https://forum.gitlab.com/u/Antoine)\
**Replies:** 1\
**Last updated:** [June 17, 2022, 1:29pm UTC](https://forum.gitlab.com/t/gitlab-omniauth-cas3-error-422-oauth-error-saving-user-email-is-invalid/47425 "2022-06-17T13:29:36Z")

</div>

Hi all, I’ve been trying to setup gitlab ce with omniauth against our cas3 server (apereo) the gitblab.rb : gitlab\_rails\['omniauth\_enabled'\] = true gitlab\_rails\['omniauth\_allow\_single\_sign\_on'\] = \['cas3'\] gitlab\_rails…

---

## [How to pull job title information via SAML into gitlab?](https://forum.gitlab.com/t/how-to-pull-job-title-information-via-saml-into-gitlab/70386)

<div class="topic-metadata">

**Author:** [@eswarap](https://forum.gitlab.com/u/eswarap)\
**Replies:** 0\
**Last updated:** [June 1, 2022, 9:07am UTC](https://forum.gitlab.com/t/how-to-pull-job-title-information-via-saml-into-gitlab/70386 "2022-06-01T09:07:48Z")

</div>

Integrated self-managed instance via SAML for login. SAML assertion sends job title and setting job title to tile field or description field doesnt work. Is there a way to map values at the time of SAML response mapping …

---

## [Does the azure\_oauth2 provider have a autolink setting similar to omniauth\_auto\_link\_saml\_user?](https://forum.gitlab.com/t/does-the-azure-oauth2-provider-have-a-autolink-setting-similar-to-omniauth-auto-link-saml-user/22168)

<div class="topic-metadata">

**Author:** [@annerajb](https://forum.gitlab.com/u/annerajb)\
**Replies:** 1\
**Last updated:** [May 5, 2022, 10:02pm UTC](https://forum.gitlab.com/t/does-the-azure-oauth2-provider-have-a-autolink-setting-similar-to-omniauth-auto-link-saml-user/22168 "2022-05-05T22:02:08Z")

</div>

I have azure\_oauth2 working on my gitlab ce 10.8.7 installation. My intention is to remove disable/local user accounts from gitlab and next time a user logs into gitlab using azure\_oauth2 provider sso automatically appe…

---

## [Error 404 in callback after successful SAML authentication](https://forum.gitlab.com/t/error-404-in-callback-after-successful-saml-authentication/68944)

<div class="topic-metadata">

**Author:** [@edward\_vocus](https://forum.gitlab.com/u/edward_vocus)\
**Replies:** 1\
**Last updated:** [May 3, 2022, 1:34am UTC](https://forum.gitlab.com/t/error-404-in-callback-after-successful-saml-authentication/68944 "2022-05-03T01:34:06Z")

</div>

I have Gitlab CE Omnibus (v14.9) as a Docker container and I’ve been trying to configure SAML authentication via Okta provider. The issue is that, after a successful authentication I get redirected to Gitlab and a 404 er…

---

## [Omniauth + Gitlab API with Oauth2 token](https://forum.gitlab.com/t/omniauth-gitlab-api-with-oauth2-token/9530)

<div class="topic-metadata">

**Author:** [@kwent7](https://forum.gitlab.com/u/kwent7)\
**Replies:** 6\
**Last updated:** [February 9, 2022, 12:00am UTC](https://forum.gitlab.com/t/omniauth-gitlab-api-with-oauth2-token/9530 "2022-02-09T00:00:49Z")

</div>

Hello, I’ve configured my Gitlab instance with Omniauth to use a Keycloak server as an Oauth2 provider. This is working fine, users can log in to Gitlab with their Keycloak account. In addition, I’d like to use the Gi…

[Next page](https://forum.gitlab.com/tag/omniauth/102.md?match_all_tags=true&page=1&tags%5B%5D=omniauth)