GitLab Support Team, 5 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Google Workspace SAML as idP on a GitLab.com group and setting up Group Links

Description

In this video call with Anton and Alvin, we look at how to integrate Google Workspace as a SAML identity Provider into a GitLab.com Group.

We also set up Group Links and test how it works.

Documentation links:

- Setting up Google Workspace as your Identity Provider:
https://docs.gitlab.com/ee/user/group/saml_sso/#set-up-google-workspace

- SAML debugging tools
https://docs.gitlab.com/ee/user/group/saml_sso/troubleshooting.html#saml-debugging-tools

- Setting up SAML Group Sync
https://docs.gitlab.com/ee/user/group/saml_sso/group_sync.html

Command to generate SHA1 fingerprint from downloaded Google Workspace cert:

openssl x509 -noout -fingerprint -sha1 -inform pem -in "GoogleIDPCertificate-domain.com.pem"

A

All right, uh hey, Anton uh today.

B

A

Will be doing this will be setting up a Google workspace um with Google links, um saml configuration on gitlab.com.

B

I really mate. Let's start all.

A

Right so we've already got a Google Groups um Google workspace ready here. We've got some users set up.

A

So if we look here, we've got some users configured. Now these users there are two groups and user. One is a member of gitlab owner group. User 2 is a member of the gitlab Dev group. Okay. So what we're going to do is we're going to go and create an app.

A

In web and mobile apps add a custom saml app call this gitlab HD. You can call this whatever you want, but my group's name is oh: if you look over here, my group's name is A.G saml, so we'll call it AG saml.

A

Give it a description.

A

All right now, very important note here is: you need to have gitlab uses the Sha one fingerprint, so this fingerprint will not work. We need to download the set and convert it into a sha1 fingerprint, so click download the command is available in our docs, but for now you'll see over here.

A

We've got the Xiao and fingerprints using this command, so we'll take that cell and fingerprint, and we will put that we're in the saml page, the saml SSO page here so we'll take the shower and fingerprint we'll put it here and then we'll take the SSO URL and put that here enable well leave it leave it on disabled. For now you can set the default, the internet membership role yeah.

A

Now this is quite important because whenever a user signs in, if they aren't already a user, if they're brand new user- that's just signing in, they will be granted. This default membership role at the top level group or wherever you're configuring this. um So it's quite important that you set it to a reasonable level of security.

A

All right, so we've got that click save all right. So now we'll do the Google side of things we go continue.

A

um The ACs, the session consumer, your service URL, is here so we'll take that oops put it there. uh The identifies here so we'll take that. But here we don't really need the start. Url now the name ID format is email and the basic information you'll put as primary email.

A

We'll add mappings, so first name gitlab expects to receive an attribute called first underscore name. uh uh Last name: gitlab expects to receive an attribute called last underscore name and primary email. Gitlab expects to receive an attribute called email.

A

Now, if you're going to be setting up group links, you need to configure which groups are going to be able to which group's name which group names will be sent to in the seminal response right. So we've got only two groups here, so I'll just add the two groups that we've got um you'll want to add the groups that are relevant to your application. Gitlab expects to retrieve receive in the SEMO response and attributes called groups right so finished.

A

Now the app has been created, you'll notice, that it's turned off for everyone, so we need to turn it on for everyone.

A

Right so people can actually access it. Another point to note is that if you do, if you do add more groups, so say, for example, if you created a group for reporters, you need to go and add that GL reporter's group here right, so otherwise that SEMO response won't be sent right. So now that we've got this up in this application configured saved, we can go and test it out.

A

So, let's enable sample authentication for this group now you'll notice. At this stage we haven't actually configured group links. That's because we want to make sure that the saml response returns groups attributes, because if you configure group links, if we configure group links now, but our SEMO response, we made a mistake in the configuration here and assemble response does not return the group's attributes. Those users will automatically have all their permissions removed and they'll be set to whatever the default membership role is.

A

So we want to make sure first before configuring group link step okay, so let's try and sign in with the user.

A

This is the URL that you will send to your users that they will use to sign in so I'm, going to open the new incognito tab and sign in now yeah, because of my location. Google thinks that um so user, one.

A

Is the Anton's, New or good empty.

B

All good so far.

A

All right now here's uh the important thing right you can configure um you can configure bypassing the confirmation email. So if you go to gitlab uh bypass confirmation, email.

A

A

So if we're searching in gitlab stocks for bypassing the confirmation, email, you'll notice, that we talk about it in this dock, so what you want to do is you'll want to configure gitlab with a custom domain, and this will allow gitlab to know that a certain email address is fully accepted by the owner of the group, and it will not require the user to confirm the email address.

A

However, in our case, we haven't configured this, so what we'll do is we will sign in as this user.

A

I think that's all.

B

In today's email, yes,.

A

So we'll go into the Gmail and.

A

Says confirm your account. So I'll click confirm your accounts and.

A

We are now able to sign in so you'll notice that we can go and here and see all the members and I have been so. This user has been granted the developerable. Yes, okay, so I forgot to capture the Samo response.

A

um So let's just do this again and we will capture the same response all right. So, let's sign in again now the way I'll show you is one way of capturing the camera response. There are other ways and you'll find those in our Docs.

A

I think it's here.

A

So you'll see the same old debugging tools and you can install one of these and capture the same or response, but I will show you how I do it so you open up the inspection panel make sure it's on a network and you're preserving the logs. So you go sign in.

A

All right now, when this happens, you'll notice in the in the network inspection tool, there will be a event called callback. Now in callback is a saml response. This is a base64 encoded response. So if we go into uh terminal, if you've got the base64 encoder installed, you can go uh Echo that and type type it into base64 decode and then we'll just start putting into a XML file.

A

Anton's got some commands that will allow you to purify it, but I just use Visual Studio code and.

B

Yeah, whatever.

A

Works, yes, it it works right, easy! So so there we go I'm going to open this in code.

A

So here's the semi response and I've got a XML profile here, so I use the prettifier and you'll see it's formatted nicely, and the important thing we want to check here is that a group's attribute is being retained.

A

So we see that the groups attribute is being returned and the value of the group because we signed into the user one who's a member of the GL owner group. They got this returned right, so we'll take that and now we will create in in gitlab, okay.

B

Just before you move on yes, um the verify symbol, configuration button, also Returns the semi response.

A

C

B

Which is which is a quicker way but um I think it's good to kind of illustrate how you would get that manually.

A

B

That's a good point: no.

A

The the only issue with that with this one I have is my user, doesn't have a um I haven't linked my user to the Google workspace so.

B

All right, yeah.

A

um But yes, so you know most most of the time when you're configuring, this your user will have a Google workspace identity um so clicking the verify demo will allow you to see the simple response. Yes, it's good.

B

Good cash, good cash.

A

All right, no, this is really useful. This is a very good thing and I'd advise people to use this, because you can see it's much easier to retrieve a similar response using this all right. So now, I will go back to kitlab and we will configure a group link.

A

Now a very important thing to note about group links is, if you configure a group link it if a user signs in- and they are not a member of at least one of the group links that you have configured, that user will be removed from all the subgroups and they will be relegated back to the default membership at the top level group.

A

Okay, so let's say a user was a owner was an owner of a subgroup, but they are not a member of this new saml group link that I created they will be, their permissions will be removed and they will be sent back to developer and because that's my default membership role here, right so very important thing to note there all right so we'll set the name of the group which I retrieved from the saml response earlier and then we'll set this to owner, save.

A

B

You got the case right.

A

Yeah this time, I got the case right. um The casing is very important. Thank you, and on the casing is very important uh when we're doing this area I put in an accidental uppercase and that caused the user to be set to default membership again. Okay, so we've got this now we'll go back and sign in as the user. So, let's close that close, that.

A

And you'll notice right now, if we go and look at members, you'll notice that user one, the user that I'm signing in with is a developer right. So now we'll sign in.

A

All right- and this is a was able to sign in now if we go and look at this user now refresh this page, oh he's an owner now so you'll notice that I signed in with user one and user one is now and on it, so group links works now if we enter our distinction test, show the effect of what happens when, when a user isn't a member of a group and they sign in yeah, why.

B

Not good start.

A

Okay, so I've just closed that excellent okay,.

B

Okay, so if a member is not part of a group, they'll just be set to that default base, membership.

A

B

A

So we can, we can show this here. So let me just pull this out and.

A

I lost my browser tip for a moment. Sorry.

B

A

B

I just thought of another interesting question: can what, if a user matches multiple group link rules.

A

Okay, so there is a external group sync, so there.

B

A

Was that sorry.

B

To go off track a little bit.

A

No, no, it's a it's a good question. um There is a we've got um some notes about that in the saml group link.

A

A

A

Here so if a user is a member of multiple demo, groups mapped to the same gitlab group, the user gets the highest role from the groups, so say.

C

A

Example, a user has a user saml response contains both developers and product managers um and they sign in so because maintainer is higher than developer.

A

They will be granted the maintainable.

B

A

Yep excellent, all right so now we're going to sign in as user two now, let's sign in as user three, because user3 is not a member of any groups right.

A

Oh, let's get that out of there.

A

When you, when you first, when you first create a user in Google, they generate this Auto generate these passwords. So uh I'll have to reset that password in the next stage. Yeah.

A

Okay, let's give him a new password.

A

Excellent, so there's the confirmation, email we'll go again to gmail.com.

A

Confirm our email address.

A

Sign in okay, so now this user is signed in and you'll notice that this user has been given the developer role right. So this user is developer because this user is not a member of any other things.

A

So what I'm going to do is as an administrator I'm going to go and I'm going to change the membership of this user to be owner right, so user3 is now going to be an owner at the top level group, but remember user3 does not is not a member of so, if we go to here, we go to directory uses no well.

B

So they're not currently a member of a Google group of.

A

A Google group, yes yeah, um so that means that this user will, when he signs in there will be no attributes right. Let's just make sure.

A

Yes, okay, so we'll go back here and I've made this I've made use of three and owner right, so we're gonna go and sign in.

B

Signing in as owner all is user3 as.

A

User three and remember: I made the user and owner here right, so I'm going to sign in now as this user. What I'm expecting to see is that this owner will be reduced to developer and that's because is not a member of their group link and my default membership role is developer right. Okay,.

B

So all right right.

A

So we can, we can reduce this. If you want, we can make him reporter.

B

Okay, so group links take precedence over locally configured permissions. Yes,.

A

But if the user, that signs in is not a member of any of the group links that have been configured, um then the this will take precedence right.

B

So, let's use it that sounds fun.

A

It can be okay, so it's very important because it can be pretty nasty if you've got hundreds of users and you suddenly create a group link like this. It's going to set all of the user's permissions back to the default, so all the granular permissions that you granted to the users manually. Okay, so we're going to see this effect. Oh yeah, you.

B

Definitely don't want that.

A

A

That's yeah. That's.

A

All right, so this is assigned in now we're expecting to see oops foreign.

B

I blame Android too.

A

A

User Theory still! Oh, no, oh, okay! Sorry. The reason why this has happened is because of this. We have not enforced SS. Only Authentication.

A

Right, so if you do this and then we'll sign in again, oh that was a good good catch.

A

Okay, so we go to members and user. Three is now reporter see.

B

A

So that enforce uh there is so I would suggest. Now. Group links is a very complicated uh Beast, so you want to make sure that you read the.

A

You want to make sure that you read that groupsync's document thoroughly and ask any questions, because, especially the.

A

Automatic member removal, so these these things are really important to to read because they will cause issues if you, if you get it wrong.

B

Yeah one other thing: did you have anything else to discuss about group monks.

A

B

Think I think okay, yeah uh I just realized that right at the very beginning, when we were setting up the seml application in Google workspace, we didn't actually show the documentation on gitlab's end on what we were actually doing. Do you want to just quickly bring that up, so anyone watching can reference that.

A

Okay, so this is the documentation for SEMO SSO for gitlab.com groups that we've been using now Ezra, you'll notice, Ezra's and octa's configurations is slightly different, because Azure does provide a Shar one fingerprint, for example, OCTA also provides Xiao and fingerprint Google. Workspace is slightly different, so it's important to pay attention to the um differences right. So this is the command that we ran. You'll notice that this is the command that we um here in order to retrieve the shell one fingerprint.

A

um We also you'll notice that we've got the the attributes here, so primary email we set Google's the application side to be email, so it's underscore name now. This name ID is also very important, because Google only provides you the ability to use um certain like specific formats, whereas, like with octane Azure, you can set the object. Identifier Which is far more.

B

Well, it's just the value that never changes, whereas an email address technically could change and speak to all kinds of um account hijack issues later on. Yes,.

A

Yeah, so um yes, so this is the configuration page that we followed for Google workspace awesome, excellent, good questions. Thank you. Anton.

B

Thank you for taking us through that today.

A

You're welcome all right I'm going to stop the recording now.

B