Support SAML 2.0 as Login-Source (Service Provider) #5512

frostieDE · 2018-12-10T13:47:48Z

It would be nice to be able to configure Gitea as a SAML service provider in order to integrate Gitea with a corporate Single-Sign-On mechanism.

techknowlogick · 2018-12-12T00:02:42Z

@frostieDE which IDP are you using (so that it can be tested against)?

nigeltiany · 2018-12-12T03:12:09Z

gSuite/Google Admin is a good test

frostieDE · 2018-12-12T15:46:44Z

We are using an own implementation of a SAML IdP, you may use https://github.com/capriza/samling or https://simplesamlphp.org/ for testing (but I hope there is a library for SAML stuff) :-)

jtl999 · 2019-01-06T05:02:26Z

@frostieDE Very interesting with regards to your IdP implementation. I too think this would be a great feature for Gitea.

frostieDE · 2019-01-06T15:15:11Z

This library looks promising: https://github.com/crewjam/saml

Unfortunately, I do not have any experience with Go programming 😄

d-Pixie · 2019-02-06T09:58:37Z

I was also looking for a good way to extend our G Suite identities into Gitea. Any thoughts on this internally @techknowlogick ?

lpar · 2019-04-24T16:11:59Z

I have experience integrating Go web applications with IBM's SAML infrastructure. I've successfully used https://github.com/russellhaering/gosaml2 for the task.

techknowlogick · 2019-04-24T16:41:49Z

@d-Pixie you could use OpenID Connect (Oauth2) for GSuite for now.

I second @lpar's suggestion of https://github.com/russellhaering/gosaml2 as having used it and crewjam's, I prefer ressell's.

chb0github · 2020-04-21T07:46:11Z

Is SAML supported? I'm confused.

fuero · 2021-05-18T19:12:09Z

As SAML based authentication has lots of login flow scenarios with libraries in different languages supporting them often poorly, I'd suggest leaving the heavy SAML2 lifting to a proxy/preauthentication scenario.
Examples given are for the Shibboleth SAML2 reference SP implementation.

How it would work:

Set up a webserver in front of gitea with lazy saml2 session initialization
Introduce config settings in gitea to map HTTP Headers to user id and roles/groups, similar to the attribute mapping done for LDAP. (e.g. REMOTE_USER, uid, entitlement, X-Forwarded-*, etc.)
Make header name and header value to group mapping configurable (e.g.: entitlement = https://gitea.example.com/role/([^/]+) -> $1, mapping https://gitea.example.com/role/admin to the admin group)
Redirect the user on login to a configurable "magic url" (e.g. /Shibboleth.sso/Login)
Verify a SAML session via presence of a configurable HTTP Header (e.g. Shib_Session_ID)

Zocker1999NET · 2021-05-24T11:12:47Z

@fuero Good idea, this would allow Gitea to "support" any authentication scheme available. To extend this approach:

make it possible to create or reconfigure a user using this scheme (a cool feature nearly every SAML implementation I use does support, e.g. Nextcloud)
- if a user does not exist, create it with the given configuration parameters
- if a user does exist, update the given parameters if required
- X-GITEA-USERNAME configures username
- X-GITEA-FULLNAME configures display/full name
- X-GITEA-MAIL configures mail address

nlincke · 2022-04-15T18:37:48Z

This is a bad idea! This would blow GITEA up alot! SAML2, or OIDC for that matter, are quite simple (you do not have to integrate everithing since gitea needs to act as a service and not as an IDP. And since oAuth is already incoperated into gitea OIDC is just a "small" addon. If you are making use of well known libaries like (https://github.com/crewjam/saml), it will be mor complicatetd to come up with a well designed user admin interface....

I am always a fan of doing the security right in the application not infront of the application.

MohammedNoureldin · 2022-08-27T08:05:22Z

Isn't there at the moment any workaround to get SSO in GitTea?

Zocker1999NET · 2022-08-27T08:46:24Z

Isn't there at the moment any workaround to get SSO in GitTea?

Gitea already supports OpenID Connect (OIDC) / OAuth2. If your identity provider does only support SAML, you can implement a middle-man service to "translate" between SAML & OIDC. Keycloak can do that, it is a little bit heavy to configure but it does its job well. There are maybe also alternatives to Keycloak which can do the same.

MohammedNoureldin · 2022-08-27T08:54:23Z

Isn't there at the moment any workaround to get SSO in GitTea?

Gitea already supports OpenID Connect (OIDC) / OAuth2. If your identity provider does only support SAML, you can implement a middle-man service to "translate" between SAML & OIDC. Keycloak can do that, it is a little bit heavy to configure but it does its job well. There are maybe also alternatives to Keycloak which can do the same.

Thanks! I am still a noob in SSO, SAML and OIDC. I have to educate myself a bit more in these topics.

Does it have to be KeyCloak for some reason? Or does Authentik for example also work?

Zocker1999NET · 2022-09-11T10:27:26Z

Thanks! I am still a noob in SSO, SAML and OIDC. I have to educate myself a bit more in these topics.

Does it have to be KeyCloak for some reason? Or does Authentik for example also work?

Following their comparison chart, Authentik seems to support this as they can provide OIDC and support federating with SAML. So it should be possible.

timka · 2022-10-20T14:29:54Z

Isn't there at the moment any workaround to get SSO in GitTea?

Gitea already supports OpenID Connect (OIDC) / OAuth2. If your identity provider does only support SAML, you can implement a middle-man service to "translate" between SAML & OIDC. Keycloak can do that, it is a little bit heavy to configure but it does its job well. There are maybe also alternatives to Keycloak which can do the same.

Thanks! I am still a noob in SSO, SAML and OIDC. I have to educate myself a bit more in these topics.

Does it have to be KeyCloak for some reason? Or does Authentik for example also work?

I'm using Gitea with Authentic OpenID as in their docs. It works but I still have some issues which at the first glance don't have anything to do with this auth provider. Namely Gitea doesn't set session cookie expiration time and my users keep complaining they need to do 5 click sign-in too often. Obviously this isn't quite SSO yet but this shouldn't be hard to fix.

MohammedNoureldin · 2022-10-25T17:50:11Z

@timka @Zocker1999NET , thank you both! Should there be any difference between using Authentik or KeyCloak for this puprose? I don't think so right?

timka · 2022-10-26T07:08:04Z

I haven't used KeyCloak. I've chosen Authentic simply b/c it's not Java and has more features.

…

On Tue, 25 Oct 2022 at 20:50, Mohammed Noureldin ***@***.***> wrote: @timka <https://github.com/timka> @Zocker1999NET <https://github.com/Zocker1999NET> , thank you both! Should there be any difference between using Authentik or KeyCloak? I don't think so right? — Reply to this email directly, view it on GitHub <#5512 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAU6AR2J37MSRILO5IXPVTWFAMV3ANCNFSM4GJNSWCQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- Timur Izhbulatov +7 (910) 4604059

Zocker1999NET · 2022-11-02T20:10:27Z

@timka @Zocker1999NET , thank you both! Should there be any difference between using Authentik or KeyCloak for this puprose? I don't think so right?

Don't know much about Authentik (have only used Keycloak until now) but it seems to me that Keycloak is the "can more than you need & want" solution (highly adaptable but sometimes a mess to configure & some features require custom JavaScript code extensions) and Authentik looks more like the "Apple" solution to me (may has not all features you may dream of, but is much easier to configure). I think for your use case, Authentik should be good enough & the better choice.

6543 · 2023-02-20T20:18:23Z

need to look at https://github.com/mattermost/gosaml2, https://github.com/russellhaering/gosaml2, https://github.com/crewjam/saml ...

6543 · 2023-02-20T20:30:49Z

saml:Attribute Name="memberOf" is also interesting to do some mapping to org/team memberships ...

... but that's an addition to the initial support I would say :)

bwinston-sdp · 2023-07-07T19:35:59Z

hey @wfjake let me know if you'd like some help, i'm definitely interested in this feature as well!

@jackHay22

Closes #5512 This PR adds basic SAML support - Adds SAML 2.0 as an auth source - Adds SAML configuration documentation - Adds integration test: - Use bare-bones SAML IdP to test protocol flow and test account is linked successfully (only runs on Postgres by default) - Adds documentation for configuring and running SAML integration test locally Future PRs: - Support group mapping - Support auto-registration (account linking) Co-Authored-By: @jackHay22 --------- Co-authored-by: jackHay22 <jack@allspice.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: morphelinho <morphelinho@users.noreply.github.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: silverwind <me@silverwind.io>

This reverts #25165 (5bb8d19), as there was a chance some important reviews got missed. so after reverting this patch it will be resubmitted for reviewing again #25165 (comment) temporary Open #5512 again

@jackHay22

Closes go-gitea#5512 This PR adds basic SAML support - Adds SAML 2.0 as an auth source - Adds SAML configuration documentation - Adds integration test: - Use bare-bones SAML IdP to test protocol flow and test account is linked successfully (only runs on Postgres by default) - Adds documentation for configuring and running SAML integration test locally Future PRs: - Support group mapping - Support auto-registration (account linking) Co-Authored-By: @jackHay22 --------- Co-authored-by: jackHay22 <jack@allspice.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: morphelinho <morphelinho@users.noreply.github.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: silverwind <me@silverwind.io>

techknowlogick added type/proposal The new feature has not been accepted yet but needs to be discussed first. type/feature Completely new functionality. Can only be merged if feature freeze is not active. labels Dec 12, 2018

techknowlogick added the issue/confirmed Issue has been reviewed and confirmed to be present or accepted to be implemented label Apr 24, 2019

benyanke mentioned this issue Apr 2, 2020

Add SAML to Feature Comparison Page #10924

Closed

Mortein mentioned this issue Aug 9, 2022

Add SAML SP status to Feature Comparison docs #20743

Merged

6543 changed the title ~~Gitea as SAML SP~~ Support SAML 2.0 as Login-Source Feb 20, 2023

6543 changed the title ~~Support SAML 2.0 as Login-Source~~ Gitea as SAML Service Provider Feb 20, 2023

This comment was marked as outdated.

Sign in to view

6543 changed the title ~~Gitea as SAML Service Provider~~ Support SAML 2.0 as Login-Source Feb 20, 2023

6543 changed the title ~~Support SAML 2.0 as Login-Source~~ Support SAML 2.0 as Login-Source (Service Provider) Feb 20, 2023

6543 mentioned this issue Feb 20, 2023

Support SAML 2.0 as Login-Source #23016

Closed

wxiaoguang mentioned this issue Feb 21, 2023

Add setting to force login through openid #21851

Open

dirkmueller mentioned this issue Mar 30, 2023

MFA OpenID Connect for Internal-Gitea openSUSE/openSUSE-git#14

Open

jrjake mentioned this issue Jun 8, 2023

Plans for Gitea 1.21 #25123

Closed

techknowlogick mentioned this issue Dec 1, 2023

Support SAML authentication #25165

Merged

6543 closed this as completed in #25165 Feb 23, 2024

6543 mentioned this issue Feb 24, 2024

Revert "Support SAML authentication (#25165)" #29358

Merged

6543 reopened this Feb 24, 2024

6543 linked a pull request Feb 25, 2024 that will close this issue

Support SAML authentication #29403

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support SAML 2.0 as Login-Source (Service Provider) #5512

Support SAML 2.0 as Login-Source (Service Provider) #5512

frostieDE commented Dec 10, 2018

techknowlogick commented Dec 12, 2018

nigeltiany commented Dec 12, 2018 •

edited

Loading

frostieDE commented Dec 12, 2018

jtl999 commented Jan 6, 2019 •

edited

Loading

frostieDE commented Jan 6, 2019

d-Pixie commented Feb 6, 2019

lpar commented Apr 24, 2019

techknowlogick commented Apr 24, 2019

chb0github commented Apr 21, 2020

fuero commented May 18, 2021

Zocker1999NET commented May 24, 2021

nlincke commented Apr 15, 2022

MohammedNoureldin commented Aug 27, 2022 •

edited

Loading

Zocker1999NET commented Aug 27, 2022

MohammedNoureldin commented Aug 27, 2022 •

edited

Loading

Zocker1999NET commented Sep 11, 2022

timka commented Oct 20, 2022

MohammedNoureldin commented Oct 25, 2022 •

edited

Loading

timka commented Oct 26, 2022 via email

Zocker1999NET commented Nov 2, 2022

This comment was marked as outdated.

6543 commented Feb 20, 2023

6543 commented Feb 20, 2023

bwinston-sdp commented Jul 7, 2023

Support SAML 2.0 as Login-Source (Service Provider) #5512

Support SAML 2.0 as Login-Source (Service Provider) #5512

Comments

frostieDE commented Dec 10, 2018

techknowlogick commented Dec 12, 2018

nigeltiany commented Dec 12, 2018 • edited Loading

frostieDE commented Dec 12, 2018

jtl999 commented Jan 6, 2019 • edited Loading

frostieDE commented Jan 6, 2019

d-Pixie commented Feb 6, 2019

lpar commented Apr 24, 2019

techknowlogick commented Apr 24, 2019

chb0github commented Apr 21, 2020

fuero commented May 18, 2021

Zocker1999NET commented May 24, 2021

nlincke commented Apr 15, 2022

MohammedNoureldin commented Aug 27, 2022 • edited Loading

Zocker1999NET commented Aug 27, 2022

MohammedNoureldin commented Aug 27, 2022 • edited Loading

Zocker1999NET commented Sep 11, 2022

timka commented Oct 20, 2022

MohammedNoureldin commented Oct 25, 2022 • edited Loading

timka commented Oct 26, 2022 via email

Zocker1999NET commented Nov 2, 2022

This comment was marked as outdated.

6543 commented Feb 20, 2023

6543 commented Feb 20, 2023

bwinston-sdp commented Jul 7, 2023

nigeltiany commented Dec 12, 2018 •

edited

Loading

jtl999 commented Jan 6, 2019 •

edited

Loading

MohammedNoureldin commented Aug 27, 2022 •

edited

Loading

MohammedNoureldin commented Aug 27, 2022 •

edited

Loading

MohammedNoureldin commented Oct 25, 2022 •

edited

Loading