GitLab Deep Dives, 9 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SCIM Deep Dive (Support) EMEA Q&A 2020-12-09

Description

Follow up Q&A for SCIM Deep Dive (Support) 2020-12-07
with Cynthia "Arty" Ng, Senior Support Engineer

A

uh Good morning, good evening, for, I think most of the people here, um thank you for joining. This is follow up for mia and ayway east for the skin deep dive. My name is cynthia ing, also known as erdichan, uh mostly on slack, but thank you for joining and we are going to just kind of see what comes up today um ice.

A

We are going to go off the dock for any questions, uh but uh since we don't have any questions in the doc at the moment, uh actually caitlyn, if you weren't, actually just repeating uh your your comment like a minute ago, um we can actually just start there.

B

All right, so um I mostly joined because, as a self-managed engineer, my entire experience with skim has been people who come across, say the octa app in the octa marketplace and don't realize that skim is only for gitlab.com and they'll set up saml instead and then wonder why users aren't being created.

B

So I joined mostly to kind of like dive into those differences, and I feel like I got a lot out of it. So I appreciate it.

A

Yeah and thanks for your kind, so I do want to um actually just kind of briefly cover that since we're here, so I'm just gonna very quickly share.

A

So in slime three, I do mention at the bottom here right like that um bringing skin to self-managed is in issue one two, eight two three. um I actually never opened this issue in the presentation, so I just wanna kind of quickly uh take a look at that now. uh So, as I mentioned, this kind of covers actually a couple of different features. So most likely these will be split off into separate issues in the future, but for now this is kind of the one that we're pointing to, because this this is a feature request.

A

So what they're talking about here is basically um extending whatever we have in saml sso for groups on gitlab.com to the instance level for self manage so- and you can see right here in this line in the second bullet point here um that it is in. You know that we want to bring uh sso enforce uh group managed account, isn't quite there so uh but, most importantly, skim all the way at the bot at the end here uh to self-managed.

A

um So the plan is it's coming, uh but we don't. We just don't have a specific timeline, yet you'll see as well that actually the self-managed has some things uh like two of a bypass. Actually, this is a big one for a lot of the dot com customers and we actually get tickets. Quite often, um I wouldn't say it. Let's say we get it very often, but we do occasionally it's not uncommon that we will get a ticketing.com saying, hey. I don't know how to like.

A

I can't get past my 2fa um and but then they mentioned they're using sso. I literally had one this week where someone said: oh, I'm using the octa verify app and I'm like you would not be using the octa app to enter your 2fa code for git lab and the user did have their gitlab 2fa turned on, so you know I basically had to explain to them. It's like you must have used this different app to set up the 2fa on gitlab.com, so you know see if you can find it.

A

They had no record of ever setting it up. They probably set it up and just completely forgot about it. So then we ended up uh just you know. Going through the verification process and disabling it for them, um but yeah, so this is this- is this will probably turn into an epic? I wouldn't even be surprised if it did, but it's basically, you know actually kind of merging what we have in terms of feature set for self management.com for saml or for sso actually, and then that includes skim.

A

So if you ever get any more self-managed, you know customers or users in general, asking about skim. You can feel free to point them to this.

B

Issue will eventually all of the features that are present in the ldap sync come to saml skin.

A

So ldap and saml are separate, and I don't like in in the sense that I don't know that it's capable to do that. Like the samo protocol itself, I'm not sure that that's like that's fair.

B

I just had a couple of people ask because a couple of the providers of ldap say ldap is outdated. Please use saml instead, but.

A

We're missing features right, so they're they're they're two different protocols right, so I don't know that it's going to work this exact same way, but we did recently get um so again. This kind of goes into saml and like straying a bit from skim, but that's okay.

A

So let me just bring up the docs page and I'll show you this actually just landed and it actually technically landed next release because we didn't get it in. uh We didn't get everything in time for the previous release post because of the cutoff date.

A

So uh one of the things we actually added is group sync, and this is what I imagine you're you're, basically talking about like what most people using ldap really want. um Is that if you specify a group in saml so say like you know this uh this example says: okay! Well, if you have a group of product managers right so in your identity provider, I like to use, you know opta as an example.

A

This is what we use at gitlab, but you know, like we say: okay, we have a group called product managers in optus, on your saml identity provider, side and in gitlab. What you can do now is basically oops.

A

You can basically say: oh for this particular group: oh okay, here they switched to a group called figure answer answers right, so you say: okay, this is the name of my saml group and then this is the role that they should have in the group.

A

So what I imagine is that when they bring it to self-manage, um you know obviously will still be configured at the instance level and then in each group you would be able to set this group link it's coming in 13, 7 or planned for 13 and 7. I believe in self-managed.

A

I can find you the issue and add it to the doc, um but it wasn't in the presentation because, as I said, that that's more of a saddle thing than a skin thing, but I can definitely find it for you, because I've been I've been following.

A

A

Other questions comments things you've encountered.

A

Just things you want to know.

A

A

Okay, in that case, I will go ahead and stop the recording.