SSO

Keycloak

We’re hosting our own Keycloak as our IAM, while the users are stored in the LDAP.

All realms enforce two-factor authentication with the YubiKey.

Note

The deployment, and all documentation for Keycloak can be found in the GitLab SSO project.

LDAP

As mentioned in the Keycloak chapter, our users are stored in our own LDAP server.

Note

The deployment, and all documentation for Keycloak can be found in the GitLab LDAP project.

Use the 👥 LDIF user generator to create the LDIF for the LDAP user.

OIDC

Whenever possible, we’re using OpenID to connect our services to Keycloak. However, there are also some services which don’t support OpenID out of the box. These services can use LDAP instead.

Note

In case the service doesn’t provide any useful authentication mechanism, we’re trying to leverage the Proxy OIDC authentication and Proxy LDAP authentication plugins.