Skip to content

Make oauth provider login generic

What does this MR do?

Extended the oauth login implementation to allow different login implementation specific for each provider (using polymorphism).

Are there points in the code the reviewer needs to double check?

Why was this MR needed?

The current implementation is relying only on the password stored in the Gitlab DB, which in some situations is not recommended/possible/allowed as it requires to store the password of an user outside of the identity provider system.

Some examples where this approach could be used are:

  • LDAP login: the login function for the LDAP provider can do a BIND instead of synchronizing the user password in Gitlab DB
  • Token based login: the user could provide a token as password, token that is generated by an third party identity provider (i.e. OIDC)

At the same time this approach will ease the introduction of new providers in the future.

Does this MR meet the acceptance criteria?

What are the relevant issue numbers?

Edited by username-removed-384663

Merge request reports