diff --git a/chart/templates/gitlab/secret-sso.yaml b/chart/templates/gitlab/secret-sso.yaml index 55c41b7269a277b93c58a7625143ac1ff6a5a0ff..5cbd8db6b52d5ebf3a5baadacca8a215388d5147 100644 --- a/chart/templates/gitlab/secret-sso.yaml +++ b/chart/templates/gitlab/secret-sso.yaml @@ -16,20 +16,32 @@ stringData: "args": { "name": "openid_connect", "scope": [ - "Gitlab" + {{- $scopes := .Values.addons.gitlab.sso.scopes | default (list "Gitlab") | uniq }} + {{- range $index, $scopes }} + {{ $index | quote }}{{if ne $index (last $scopes)}},{{end}} + {{- end }} ], "response_type": "code", + {{- if .Values.addons.gitlab.sso.issuer_uri }} + "issuer": "{{ .Values.addons.gitlab.sso.issuer_uri }}" + {{- else }} "issuer": "https://{{ .Values.sso.oidc.host }}/auth/realms/{{ .Values.sso.oidc.realm }}", + {{- end }} "client_auth_method": "query", "discovery": true, - "uid_field": "preferred_username", + "uid_field": {{ .Values.addons.gitlab.sso.uid_field | default "preferred_username" | quote }}, "client_options": { "identifier": "{{ .Values.addons.gitlab.sso.client_id | default .Values.sso.client_id }}", "secret": "{{ .Values.addons.gitlab.sso.client_secret | default .Values.sso.client_secret }}", "redirect_uri": "https://{{ .Values.addons.gitlab.hostnames.gitlab }}.{{ $domainName }}/users/auth/openid_connect/callback", + {{- if .Values.addons.gitlab.sso.end_session_uri }} + "end_session_endpoint": "{{ .Values.addons.gitlab.sso.end_session_uri }}" + {{- else }} "end_session_endpoint": "https://{{ .Values.sso.oidc.host }}/auth/realms/{{ .Values.sso.oidc.realm }}/protocol/openid-connect/logout" + {{- end }} } } } + {{- end }} -{{- end}} \ No newline at end of file +{{- end}} diff --git a/chart/values.yaml b/chart/values.yaml index 9e9134c4b3aafb2a0da64f99cd2a07b2d54f186f..e5e737f7095a3fff1f3995d913ec8d8777397478 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -751,6 +751,21 @@ addons: # -- Gitlab SSO login button label label: "" + # -- Gitlab SSO Scopes, default is ["Gitlab"] + scopes: + - Gitlab + + # -- GitLab SSO Issuer URI, + # Only needed if your SSO is non-Keycloak + issuer_uri: "" + + # -- GitLab SSO End Session URI, + # Only needed if your SSO is non-Keycloak + end_session_uri: "" + + # -- Gitlab SSO UID field + uid_field: preferred_username + database: # -- Hostname of a pre-existing PostgreSQL database to use for Gitlab. # Entering connection info will disable the deployment of an internal database and will auto-create any required secrets.