I've been tinkering with GitLab and Azure ActiveDirectory with OAuth and allowing AD users to connect to GitLab accounts. This is set up and works just fine. However, GitLab won't create users for AD users on the first login - they have to create a GitLab account first.

Is there a way to automatically allow AD users into GitLab without first creating an account and/or automatically creating the GitLab account for the AD user?

For reference, the relevant GitLab configuration:

 gitlab_rails['omniauth_enabled'] = true
 gitlab_rails['omniauth_allow_single_sign_on'] = ['azure']
 gitlab_rails['omniauth_external_providers'] = ['azure_oauth2']
 gitlab_rails['omniauth_block_auto_created_users'] = false
 gitlab_rails['sync_profile_from_provider'] = ['azure_oauth2']
 gitlab_rails['sync_profile_attributes'] = ['name', 'email']
 gitlab_rails['omniauth_providers'] = [
      "name" => "azure_oauth2",
      "args" => {
        "client_id" => "my client id",
        "client_secret" => "my client secret",
        "tenant_id" => "my tenant id"

You need to specify the providers that will be allowed to create new accounts in the field allow_single_sign_on. You have set azure on this field, but the correct name of the provider is azure_oauth2. Setting the correct provider name should fix your problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.