Version of omniauth-shibboleth should be at least 1.1.2
It would be very helpful to set minimum version of omniauth-shibboleth gem to 1.1.2 since lower versions cannot use session state passed in headers which is, at least for now, the only way to make it work with Shibboleth SP and Apache/nginx.
The only way it could get it to work without headers is by using Phusion Passenger which can properly pass session env variables to GitLab.
You can find more info on this problem here: https://github.com/toyokazu/omniauth-shibboleth/issues/6
So to save us precious time when upgrading GitLab can you please put version in 1.1.2 in both Gemfile and Gemfile.lock files?