Skip to content

config_gitlab_oauth.md

Latest commit

 

History

History
83 lines (65 loc) · 2.47 KB

config_gitlab_oauth.md

File metadata and controls

83 lines (65 loc) · 2.47 KB
Raw
title Create a GitLab OAuth application
sidebar_position 75

Prerequisites

Steps

  1. Navigate to GitLab User Settings > Applications

  2. Click Add new application and enter the following details:

    • Name: Minder (or any name you prefer)
    • Redirect URI (add both URIs, one per line): 
      http://localhost:8080/api/v1/auth/callback/gitlab/cli
http://localhost:8080/api/v1/auth/callback/gitlab/web
    • Confidential: Yes (checked)
    • Scopes: Check api, read_user, and read_repository

  3. Click Save application. Copy the Application ID and Secret — the secret is only shown once.

  4. Add the following to your server-config.yaml under the provider: section:

    provider:
  gitlab:
    client_id: "YOUR_APPLICATION_ID"
    client_secret: "YOUR_SECRET"
    redirect_uri: "http://localhost:8080/api/v1/auth/callback/gitlab"
    webhook_secret: "a-random-secret-string"
    scopes:
      - "api"
      - "read_user"
      - "read_repository"

    The redirect_uri should be the base path without /cli or /web — Minder appends the correct suffix automatically.

  5. Enable the gitlab_provider feature flag by creating flags-config.yaml in the root of your Minder directory:

    gitlab_provider:
  variations:
    enabled: true
    disabled: false
  defaultRule:
    variation: enabled

  6. (Re)start the Minder server:

    make run-docker

  7. Enroll the GitLab provider using the CLI:

    minder provider enroll --class gitlab

    A browser window will open to GitLab's OAuth authorization page. After authorizing, the browser will show Minder enrollment complete and the CLI will print Provider enrolled successfully.

Known limitations

  • GitLab support is currently only available on self-hosted Minder instances. The hosted instance at api.custcodian.dev does not yet support GitLab enrollment.
  • Webhook-based event delivery requires an externally reachable URL. For local development, tools like ngrok can expose your local server.
  • Token identity verification after enrollment is not yet implemented.