GitLab signs users in with their GitLab.com account. Because GitLab's OAuth provider is OpenID Connect compliant, this connector gets a proper id_token and a userinfo endpoint — including a email_verified claim, which most developer connectors do not provide.
Copy the redirect URI
In the Authdog console, select the project and environment, open Authentication > Providers, find GitLab, and click Enable. Copy the redirect URI shown in the form:
https://identity.authdog.com/api/v1/callback/<connectionId>Create the application
- Open Applications in your GitLab user settings. For an app your team shares, create it under Group settings > Applications instead.
- Select Add new application.
- Name it.
- Under Redirect URI, paste the redirect URI from Authdog. GitLab accepts several, one per line, so all your environments can share one application.
- Leave Confidential checked — Authdog exchanges the code from the server with a client secret.
- Select the scopes
openid,email, andprofile. - Save, then copy the Application ID and Secret.
Configure Authdog
| Field | Value |
|---|---|
| Client ID | GitLab Application ID |
| Client Secret | GitLab Secret |
Save, then toggle the connection active.
What GitLab returns
Authdog requests openid email profile and reads the profile from https://gitlab.com/oauth/userinfo: the sub identifier, email and its verified flag, username, name, and avatar.
The connector targets GitLab.com. A self-managed GitLab instance runs the same endpoints on your own host, which this connector does not point at — configure it through the generic OpenID Connect connector under Enterprise SSO, using your instance's discovery URL.
Test it
- Open your environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select Continue with GitLab and authorize.
- Confirm the user appears under Users with a verified email.
Troubleshooting
| Symptom | Cause |
|---|---|
The redirect URI included is not valid |
The URI is missing from the application's redirect list |
invalid_scope |
openid, email, or profile was not selected on the application |
invalid_client |
Application ID or secret mismatch, or the application was created as non-confidential |
| Sign-in fails only for self-managed users | This connector targets GitLab.com — use an OIDC enterprise connection |
Related
| Read | To learn how to |
|---|---|
| Connectors | Set up any other social provider |
| GitHub | Add the other developer identity provider |
| Enterprise SSO | Point a generic OIDC connection at a self-managed instance |