Microsoft Azure OAuth2 OmniAuth Provider

To enable the Microsoft Azure OAuth2 OmniAuth provider you must register your application with Azure. Azure will generate a client ID and secret key for you to use.

Sign in to the Azure Portal, and follow the instructions in the Microsoft Quickstart documentation.

As you go through the Microsoft procedure, keep the following in mind:

• If you have multiple instances of Azure Active Directory, you can switch to the desired tenant.
• You're setting up a Web application.
• For the redirect URI, you'll need the URL of the Azure OAuth callback of your GitLab installation (for example, https://gitlab.mycompany.com/users/auth/azure_oauth2/callback). The type dropdown should be set to "Web".
• The client ID and client secret are terms associated with OAuth 2. In some Microsoft documentation, the terms may be listed as Application ID and Application Secret.
• If you need to generate a new client secret, follow the Microsoft documentation on how to Create a new application secret.
• Save the client ID and client secret for your new app. Once you leave the Azure portal, you won't be able to find the client secret again.

1. On your GitLab server, open the configuration file.

   For Omnibus package:

   sudo editor /etc/gitlab/gitlab.rb

   For installations from source:

   cd /home/git/gitlab
   
   sudo -u git -H editor config/gitlab.yml

2. See Initial OmniAuth Configuration for initial settings.

3. Add the provider configuration:

   For Omnibus package:

   gitlab_rails['omniauth_providers'] = [
     {
       "name" => "azure_oauth2",
       "args" => {
         "client_id" => "CLIENT ID",
         "client_secret" => "CLIENT SECRET",
         "tenant_id" => "TENANT ID",
       }
     }
   ]

   For installations from source:

   - { name: 'azure_oauth2',
     args: { client_id: "CLIENT ID",
     client_secret: "CLIENT SECRET",
     tenant_id: "TENANT ID" } }

   The base_azure_url is optional and can be added for different locales; e.g. base_azure_url: "https://login.microsoftonline.de".

4. Replace 'CLIENT ID', 'CLIENT SECRET' and 'TENANT ID' with the values you got above.

5. Save the configuration file.

6. Reconfigure or restart GitLab for the changes to take effect if you installed GitLab via Omnibus or from source respectively.

On the sign-in page, you should now see a Microsoft icon below the regular sign in form. Click the icon to begin the authentication process. Microsoft then asks you to sign in and authorize the GitLab application. If everything goes well, you are returned to GitLab and signed in. See Enable OmniAuth for an Existing User for information on how existing GitLab users can connect to their newly-available Azure AD accounts.