Google OAuth2 OmniAuth Provider

To enable the Google OAuth2 OmniAuth provider you must register your application with Google. Google will generate a client ID and secret key for you to use.

Enabling Google OAuth

In Google's side:

Navigate to the cloud resource manager page
Select Create Project
Provide the project information:
- Project name - "GitLab" works just fine here.
- Project ID - Must be unique to all Google Developer registered applications. Google provides a randomly generated Project ID by default. You can use the randomly generated ID or choose a new one.
Refresh the page and you should see your new project in the list
Go to the Google API Console
Select the previously created project form the upper left corner
Select Credentials from the sidebar
Select OAuth consent screen and fill the form with the required information
In the Credentials tab, select Create credentials > OAuth client ID
Fill in the required information
- Application type - Choose "Web Application"
- Name - Use the default one or provide your own
- Authorized JavaScript origins -This isn't really used by GitLab but go ahead and put https://gitlab.example.com
- Authorized redirect URIs - Enter your domain name followed by the callback URIs one at a time:
```
https://gitlab.example.com/users/auth/google_oauth2/callback
https://gitlab.exampl.com/-/google_api/auth/callback
```
You should now be able to see a Client ID and Client secret. Note them down or keep this page open as you will need them later.
From the Dashboard select ENABLE APIS AND SERVICES > Google Cloud APIs > Container Engine API > Enable

On your GitLab server:

Open the configuration file.

For Omnibus GitLab:

sudo editor /etc/gitlab/gitlab.rb

For installations from source:

cd /home/git/gitlab
sudo -u git -H editor config/gitlab.yml

See Initial OmniAuth Configuration for initial settings.

Add the provider configuration:

For Omnibus GitLab:

gitlab_rails['omniauth_providers'] = [
  {
    "name" => "google_oauth2",
    "app_id" => "YOUR_APP_ID",
    "app_secret" => "YOUR_APP_SECRET",
    "args" => { "access_type" => "offline", "approval_prompt" => '' }
  }
]

For installations from source:

- { name: 'google_oauth2', app_id: 'YOUR_APP_ID',
  app_secret: 'YOUR_APP_SECRET',
  args: { access_type: 'offline', approval_prompt: '' } }

Change YOUR_APP_ID to the client ID from the Google Developer page
Similarly, change YOUR_APP_SECRET to the client secret
Make sure that you configure GitLab to use an FQDN as Google will not accept raw IP addresses.

For Omnibus packages:
```
external_url 'https://gitlab.example.com'
```
For installations from source:
```
gitlab:
  host: https://gitlab.example.com
```
Save the configuration file.
Reconfigure or restart GitLab for the changes to take effect if you installed GitLab via Omnibus or from source respectively.

On the sign in page there should now be a Google icon below the regular sign in form. Click the icon to begin the authentication process. Google will ask the user to sign in and authorize the GitLab application. If everything goes well the user will be returned to GitLab and will be signed in.

Further Configuration

This further configuration is not required for Google authentication to function but it is strongly recommended. Taking these steps will increase usability for users by providing a little more recognition and branding.

At this point, when users first try to authenticate to your GitLab installation with Google they will see a generic application name on the prompt screen. The prompt informs the user that "Project Default Service Account" would like to access their account. "Project Default Service Account" isn't very recognizable and may confuse or cause users to be concerned. This is easily changeable:

Select 'Consent screen' in the left menu. (See steps 1, 4 and 5 above for instructions on how to get here if you closed your window).
Scroll down until you find "Product Name". Change the product name to something more descriptive.
Add any additional information as you wish - homepage, logo, privacy policy, etc. None of this is required, but it may help your users.