You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/admin/auth.md
+32-7Lines changed: 32 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -54,7 +54,7 @@ First, [register a GitLab OAuth application](https://docs.gitlab.com/ee/integrat
54
54
55
55
-**Redirect URI**: Set to `https://coder.domain.com/api/v2/users/oidc/callback`
56
56
57
-
### Step 2: Configure Coder with the OpenID Connect credentials
57
+
### Step 2: Configure Coder with the Gitlab OpenID Connect credentials
58
58
59
59
Navigate to your Coder host and run the following command to start up the Coder
60
60
server:
@@ -96,7 +96,7 @@ First, [register a Google OAuth application](https://support.google.com/cloud/an
96
96
-**Authorized JavaScript origins**: Set to your Coder domain (e.g. `https://coder.domain.com`)
97
97
-**Redirect URIs**: Set to `https://coder.domain.com/api/v2/users/oidc/callback`
98
98
99
-
### Step 2: Configure Coder with the OpenID Connect credentials
99
+
### Step 2: Configure Coder with the Google OpenID Connect credentials
100
100
101
101
Navigate to your Coder host and run the following command to start up the Coder
102
102
server:
@@ -120,18 +120,24 @@ Once complete, run `sudo service coder restart` to reboot Coder.
120
120
121
121
## OIDC Claims
122
122
123
-
Coder requires all OIDC email addresses to be verified by default. If the `email_verified` claim is present in the token response from the identity provider, Coder will validate that its value is `true`.
124
-
If needed, you can disable this behavior with the following setting:
123
+
Coder requires all OIDC email addresses to be verified by default. If the
124
+
`email_verified` claim is present in the token response from the identity
125
+
provider, Coder will validate that its value is `true`. If needed, you can
126
+
disable this behavior with the following setting:
125
127
126
128
```console
127
129
CODER_OIDC_IGNORE_EMAIL_VERIFIED=true
128
130
```
129
131
130
-
> **Note:** This will cause Coder to implicitly treat all OIDC emails as "verified".
132
+
> **Note:** This will cause Coder to implicitly treat all OIDC emails as
133
+
> "verified".
131
134
132
-
When a new user is created, the `preferred_username` claim becomes the username. If this claim is empty, the email address will be stripped of the domain, and become the username (e.g. `example@coder.com` becomes `example`).
135
+
When a new user is created, the `preferred_username` claim becomes the username.
136
+
If this claim is empty, the email address will be stripped of the domain, and
137
+
become the username (e.g. `example@coder.com` becomes `example`).
133
138
134
-
If you'd like to change the OpenID Connect button text and/or icon, you can configure them like so:
139
+
If you'd like to change the OpenID Connect button text and/or icon, you can
140
+
configure them like so:
135
141
136
142
```console
137
143
CODER_OIDC_SIGN_IN_TEXT="Sign in with Gitea"
@@ -157,3 +163,22 @@ If your OpenID Connect provider requires client TLS certificates for authenticat
157
163
CODER_TLS_CLIENT_CERT_FILE=/path/to/cert.pem
158
164
CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
159
165
```
166
+
167
+
## Group Sync (enterprise)
168
+
169
+
If your OpenID Connect provider supports group claims, you can configure Coder
170
+
to synchronize groups in your auth provider to groups within Coder.
171
+
172
+
To enable group sync, ensure that the `group` claim is set:
173
+
174
+
```console
175
+
# as an environment variable
176
+
CODER_OIDC_SCOPES=openid,profile,email,groups
177
+
# as a flag
178
+
--oidc-scopes openid,profile,email,groups
179
+
```
180
+
181
+
On login, users will automatically be assigned to groups that have matching
182
+
names in Coder and removed from groups that the user no longer belongs to.
0 commit comments