gitleb 登陆方式_为gitlab10.x增加使用remote_user HTTP头的方式登录

项目的结构是这样的:

客户端通过Apache来访问后端的gitlab(gitlab的版本是10.4,手动从源码安装的简体中文版) , Apache作为gitlab的反向代理服务器

Apache内置了CAS的客户端,未登录的用户会重定向到CAS去登录,登录之后,跳转到gitlab,带上一个名为 remote_user的http header 来标识用户的身份

gitlab需要接收这个header,并让用户登录,若系统中不存在该用户,gitlab要从ldap中拿到用户的信息,创建用户,然后让用户登录

实现的方法:

gitlab没有现成的配置来实现这个需求, omniauth-http-header等方案,原理上是可行的,但是在实际操作过程中,很难集成到gitlab中去(因为要修改Gemfile)

所以,我在做的过程中,采用了如下的方法: 参考 omniauth-http-header的代码,自己实现一个 omniauth的provider,添加到gitlab中去(不使用gem包的方式)

首先,在/home/git/gitlab/lib文件夹下,新建http_header.rb,并修改文件的归属为git用户,内容如下:

require 'omniauth'

module OmniAuth

module Strategies

class HttpHeader

include OmniAuth::Strategy

option :name, 'http_header'

option :authorization_uri, nil

option :uid_header, 'remote_user'

option :info_headers, {}

option :remote_ip, nil

def request_phase

redirect callback_url

end

def callback_phase

if options.remote_ip && !Array(options.remote_ip).include?(request.ip)

raise ::OmniAuth::Error, "Callback from unauthorized IP #{request.ip}"

end

super

end

uid do

fetch_header options.uid_header

end

info do

options.info_headers.each_with_object({}) do |(attribute, header), info|

info[attribute] = fetch_header header

end

end

private

def fetch_header(header)

print request.env

request.env.fetch "HTTP_#{header.upcase.gsub('-', '_')}"

end

end

end

end

在omniauth的初始化文件(/home/git/gitlab/config/initializers/omniauth.rb)里require和加载这个文件:

增加了首行的require

require '/home/git/gitlab/lib/http_header.rb'

和最后的

Rails.application.config.middleware.use OmniAuth::Builder do

provider :http_header,

uid_header: 'remote_user'

end

整个文件如下:

require '/home/git/gitlab/lib/http_header.rb'

if Gitlab::LDAP::Config.enabled?

module OmniAuth::Strategies

Gitlab::LDAP::Config.available_servers.each do |server|

# do not redeclare LDAP

next if server['provider_name'] == 'ldap'

const_set(server['provider_class'], Class.new(LDAP))

end

end

end

OmniAuth.config.full_host = Settings.gitlab['base_url']

OmniAuth.config.allowed_request_methods = [:post]

# In case of auto sign-in, the GET method is used (users don't get to click on a button)

OmniAuth.config.allowed_request_methods << :get if Gitlab.config.omniauth.auto_sign_in_with_provider.present?

OmniAuth.config.before_request_phase do |env|

Gitlab::RequestForgeryProtection.call(env)

end

if Gitlab.config.omniauth.enabled

provider_names = Gitlab.config.omniauth.providers.map(&:name)

require 'omniauth-kerberos' if provider_names.include?('kerberos')

end

module OmniAuth

module Strategies

autoload :Bitbucket, Rails.root.join('lib', 'omni_auth', 'strategies', 'bitbucket')

end

end

Rails.application.config.middleware.use OmniAuth::Builder do

provider :http_header,

uid_header: 'remote_user'

end

3.在gitlab.yml文件里配置ldap和omniauth的provider,没有的信息从ldap中拿到

相关配置如下(ldap配置和主题无关,被省略了):

omniauth:

enabled: true

auto_sign_in_with_provider: http_header

auto_link_ldap_user: true

providers:

- { name: 'http_header',

label: 'http_header',

args: {

uid_header: 'remote_user'

} }

4.nginx默认是会去掉带下划线的header,所以,remote_user在经过nginx的时候被干掉了,需要在nginx的server结点下配置这个指令:

underscores_in_headers on;

关于单点退出的问题:让apache拦截gitlab的退出地址,重定向到cas的退出地址上,在cas退出的时候,清除掉gitlab设置的sessioncookie _gitlab_session即可实现单点退出