# GitLab OmniAuth plugin
**URL:** https://meta.discourse.org/t/gitlab-omniauth-plugin/24382
**Category:** Plugin
**Tags:** auth-plugins
**Created:** [January 24, 2015, 12:52am UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382 "2015-01-24T00:52:41Z")
**Posts on this page:** 17
**Page:** 2
### Author:  [@axil](https://meta.discourse.org/u/axil)
#### Post date: [March 15, 2016, 12:49pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/21 "2016-03-15T12:49:24Z")
Hi @hellekin seems I misunderstood your issue. Here’s what I did:
1. Create a new account in [GitLab.com](http://GitLab.com)
2. Create a new account in [forum.gitlab.com](http://forum.gitlab.com) with the same e-mail as above
3. Logout from forum
4. Login using GitLab OAuth
5. Successfully logged in to [forum.gitlab.com](http://forum.gitlab.com), the accounts were associated, Discourse even pulled my gravatar
Even if you don’t manually create a new user in Discourse and use the login using gitlab-omniauth, you are asked to create a new user with the e-mail from GitLab.
I can’t seem to reproduce it 😕
Did you try to use a different regular e-mail (not `user+foo@example.org`)?
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [March 15, 2016, 2:56pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/22 "2016-03-15T14:56:10Z")
> Hi @hellekin seems I misunderstood your issue. Here’s what I did:
I reproduced the above on [talk.devuan.org](http://talk.devuan.org):
1. Create a new account in talk.
2. Logout from talk.
3. Create a new account in gitlab, using the same email (and username)
4. Login to talk “using gitlab”.
What happens: user logs in properly. \o/
**BUT**
Now, I have **existing accounts** on the Discourse instance, who existed
prior to installing the plugin, with a matching Gitlab account, who
**won’t login**. Instead, they ask to create “user1” and claim the
username is already taken. Same username, same email on the Gitlab.
> Even if you don’t manually create a new user in Discourse and use the login using gitlab-omniauth, you are asked to create a new user with the e-mail from GitLab.
That’s the normal case, when you have an existing Gitlab account and no
Discourse account. Works fine.
> Did you try to use a different regular e-mail (not `user+foo@example.org`)?
Yes, I changed the email in gitlab and discourse to remove `+`, although
this influencing the process would be a bug. Same same.
Anyway I think **this** might be the source of the problem. I have in
the database emails like `user+foo@example.net`. I suspect that the
auth process is **assuming** unique emails, but the verification **drops
the `+`**, making unique emails collide. Is that possible? That would
explain why the accounts with `user@example.org` can’t login when
`user+foo@example.org` exists as well. Basically the code would expect
a single User object but instead receive an Array of them.
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [March 25, 2016, 4:10am UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/23 "2016-03-25T04:10:59Z")
I had a look at storage. I should have done that earlier, but well, I was consuming the software, not really into it. Of course there was a stale record for my `gl_uid` associated with another (deleted) discourse account. The plugin was silently failing.
I’m looking into fixing these issues. I found another one: you need to check the validity of the username. I had a record with a gitlab user `mr.foo`, and the key was `gl_uid_` instead of `gl_uid_123` probably because the period is invalid in Discourse usernames. I fixed the entry manually pending another login to see whether that causes a problem.
I can now login successfully!
---
### Author:  [@axil](https://meta.discourse.org/u/axil)
#### Post date: [March 26, 2016, 8:46am UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/24 "2016-03-26T08:46:25Z")
Cool that you got it working! Should these issues be fixed in the plugin or is it a server-side issue?
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [March 26, 2016, 7:44pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/25 "2016-03-26T19:44:11Z")
I guess the plugin could do some consistency check on error but I have the impression as well that it’s not really its role either.
There’s an obvious use-case that could be addressed: applications usually have a different notion of what a valid username is. Discourse and Gitlab disagree on the presence of a period in a username: when a Gitlab user named `john.doe` tries to connect to Discourse, **apparently** what happens is that Discourse, unable to validate the username, return an inconsistent result (where the `gl_uid` is empty), leaving the account without a possibility to login (as the username is invalid, and the email is registered into the PluginStore without reference to the original `gl_uid`: in effect, a new login will tell the user the email is already taken and goto fail.
Now this is interesting because it converges to my case, where a random failure remains quiet, and the plugin doesn’t differentiate between a login failure and an internal error. Validating the fields (or invalidating them rather) should report to the plugin somehow.
Sorry to be a bit dense and confused. I’m thinking aloud. Better let the code talk.
---
### Author:  [@axil](https://meta.discourse.org/u/axil)
#### Post date: [March 27, 2016, 7:20am UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/26 "2016-03-27T07:20:16Z")
Hmm, I’m wondering how different the the other oauth plugins are.
---
### Author:  [@fantasticfears](https://meta.discourse.org/u/fantasticfears)
#### Post date: [March 27, 2016, 8:32am UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/27 "2016-03-27T08:32:21Z")
> [@hellekin](#):
>
> unable to validate the username, return an inconsistent result (where the gl\_uid is empty), leaving the account without a possibility to login (as the username is invalid, and the email is registered into the PluginStore without reference to the original gl\_uid: in effect, a new login will tell the user the email is already taken and goto fail.
Discourse will just ask you for a new username while it should still remember that uid. My oauth providers won’t gives a email so the users have to type their account information on their own after authenticated from a provider. In the meantime, I am so sure Discourse will remember the uid.
I would say…you have to try whether it’s working in a clean install (I know it’s painful to debug this)
@axil `after_create_account` takes previous information from the return value of `after_authenticate`. These previous information comes along with the `session[:authentication]`.
The most chance is oauth strategy fails to return a valid uid thus the code set a nil in the `extra_data`. In the end, without the uid, the code can’t set a proper key in the plugin row.
---
### Author:  [@mntbighker](https://meta.discourse.org/u/mntbighker)
#### Post date: [July 13, 2016, 9:28pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/28 "2016-07-13T21:28:16Z")
I have the plugin set up, and I’m getting the popup. It begins to authenticate, and if you are already logged in with Gitlab you get an Auth or Deny choice. If I select Authorize, the browser says the site is unable to handle the request. And the Discourse error log shows:
> Faraday::SSLError (SSL\_connect returned=1 errno=0 state=error: certificate verify failed)
> /usr/local/lib/ruby/2.3.0/net/http.rb:933:in `connect\_nonblock’
Both my Gitlab site and my Discourse site have Treasury dept signed SSL certs.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [July 13, 2016, 10:25pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/29 "2016-07-13T22:25:01Z")
Did you add the Treasury dept root certificate to the docker container certificate store?
---
### Author:  [@mntbighker](https://meta.discourse.org/u/mntbighker)
#### Post date: [July 13, 2016, 10:38pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/30 "2016-07-13T22:38:51Z")
No. In the case of the Discourse docker image, where is that located? What commands need to be run after it’s added? Do I need to modify any files or just add the cert to the directory? I think I know where I can grab the root cert.
Thanks for the help
---
### Author:  [@mntbighker](https://meta.discourse.org/u/mntbighker)
#### Post date: [July 14, 2016, 12:34am UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/31 "2016-07-14T00:34:05Z")
I added the root/int certs, and I see in the log they get added, but the error remains the same.
> run:
>
> - exec: echo “Beginning of custom commands”
>
> - file:
> path: /usr/local/share/ca-certificates/treasury-root.crt
> chmod: 444
> contents: |
> -----BEGIN CERTIFICATE-----
>
> - exec: /usr/sbin/update-ca-certificates
>
> - file:
> path: /usr/local/share/ca-certificates/treasury-int.crt
> chmod: 444
> contents: |
> -----BEGIN CERTIFICATE-----
>
> - exec: /usr/sbin/update-ca-certificates
> - exec: echo “End of custom commands”
---
### Author:  [@mntbighker](https://meta.discourse.org/u/mntbighker)
#### Post date: [July 14, 2016, 12:54am UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/32 "2016-07-14T00:54:05Z")
It’s worth a mention that googling for the Faraday::SSLError you find a fair number of people who claim updating to a later ruby resolved the error. This is in other rails apps of course.
I tried adding the Gitlab server SSL cert instead of the Treasury root cert and still had the same problem.
I also found this (apparently a common problem with SSL/ruby):
> **[SSLError and Rubyist, sitting in a tree](https://mislav.net/2013/07/ruby-openssl/)**
>
> Helping you debug the dreaded SSLError.
Of course it’s 3 years old, so not sure how relevant it is now.
---
### Author:  [@mntbighker](https://meta.discourse.org/u/mntbighker)
#### Post date: [July 14, 2016, 9:22pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/33 "2016-07-14T21:22:28Z")
I finally have this working. Here is the app.yml with the entries to get the 175 NASA certs imported.
```
## GitLab OmniAuth settings
GITLAB_APP_ID: foo
GITLAB_SECRET: bar
GITLAB_URL: https://xxx.yyy.zzz
## The Docker container is stateless; all data is stored in /shared
volumes:
- volume:
host: /var/discourse/shared/standalone
guest: /shared
- volume:
host: /var/discourse/shared/standalone/log/var-log
guest: /var/log
## Plugins go here
## see https://meta.discourse.org/t/19157 for details
hooks:
after_code:
- exec:
cd: $home/plugins
cmd:
- git clone https://github.com/discourse/docker_manager.git
- git clone https://gitlab.com/gitlab-org/discourse-omniauth-gitlab.git
run:
- exec: echo "Beginning of custom commands"
## If you want to set the 'From' email address for your first registration, uncomment and change:
## After getting the first signup email, re-comment the line. It only needs to run once.
#- exec: rails r "SiteSetting.notification_email='info@unconfigured.discourse.org'"
- exec: apt install unzip
- exec: unzip /shared/ssl/NTAM_Collection_Ubuntu_2016.2.zip -d /usr/local/share/ca-certificates/
- exec: chmod 444 /usr/local/share/ca-certificates/*
- exec: c_rehash /usr/local/share/ca-certificates
- exec: update-ca-certificates
- exec: echo "End of custom commands"
```
---
### Author:  [@axil](https://meta.discourse.org/u/axil)
#### Post date: [July 15, 2016, 9:45am UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/34 "2016-07-15T09:45:55Z")
@mntbighker thanks a lot for getting back with the solution 🙂
---
### Author:  [@Metin\_Yorulmaz](https://meta.discourse.org/u/Metin_Yorulmaz)
#### Post date: [January 11, 2017, 2:39pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/35 "2017-01-11T14:39:52Z")
Hi all, I am getting this error while installing the plugin. Just followed the tutorial and added it to `after_code` hook.
It throws this error when running `'bundle exec rake db:migrate` after cloning etc.
```plaintext
You are specifying the gem omniauth-gitlab in /var/www/discourse/plugins/discourse-omniauth-gitlab/plugin.rb, however it does not exist!
```
Thanks!
---
### Author:  [@arthur\_ynh](https://meta.discourse.org/u/arthur_ynh)
#### Post date: [July 18, 2022, 3:35pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/36 "2022-07-18T15:35:33Z")
Hello guys.
Any update on this plugin? I’m trying to make it working on Discourse V2.7.13 but when I click on the “connect to GitLab” button it redirects me to a weird URL “oauth…”. I don’t really know what’s wrong 😕
---
### Author:  [@user12](https://meta.discourse.org/u/user12)
#### Post date: [August 7, 2022, 3:25pm UTC](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382/37 "2022-08-07T15:25:13Z")
Is it possible to use this plugin with [Gitlab.com](http://Gitlab.com)?
[Previous page](https://meta.discourse.org/t/gitlab-omniauth-plugin/24382.md?page=1)