felix-gitlab-oidc-application

CLI to simply create GitLab OIDC applications. This makes it trivial to add Gitlab as an IdP to any OpenID Connect enabled application, for example Grafana.

Usage

felix-gitlab-oidc-application \
  -g git.example.com \
  --redirect-url https://grafana.example.com/login/gitlab

creates an application on git.example.com (infers grafana.example.com as application name) and outputs both GITLAB_OIDC_CLIENT_ID and GITLAB_OIDC_CLIENT_SECRET

If you do use mise, you can output to .config/mise.prod.toml instead:

felix-gitlab-oidc-application \
  --mise-file=.config/mise.prod.toml \
    https://grafana.example.com/login/gitlab

Development

git clone https://codeberg.org/felixhummel/gitlab-oidc-application.git
cd gitlab-oidc-application
mise trust
mise i
uv sync
ln -s $(which felix-gitlab-oidc-application) ~/.local/bin/felix-gitlab-oidc-application

Explanation

This tool replaces the following manual flow:

Create application

gitlab \
  -g git.example.com \
  -ojson \
  application create \
  --name grafana.example.com \
  --redirect-uri https://grafana.example.com/login/gitlab \
  --scopes 'openid profile email' \
  --confidential true

-->

{"id": 14, "application_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "application_name": "grafana.example.com", "callback_url": "https://grafana.example.com/login/gitlab", "confidential": true, "secret": "gloas-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}

Somehow echo

GITLAB_OIDC_CLIENT_ID=...
GITLAB_OIDC_CLIENT_SECRET=...