SSO and IAM for self-hosted gitlab, mattermost, reviewboard reddit / selfhosted ---------------------------------------------------------------------- ww_pt · 2023-10-27 15:05 Hey everyone, Our small company has self-hosted Gitlab, Mattermost and Reviewboard. Currently there are separate logins for all of them. I'm looking for a self-hosted SSO solution that could help my colleagues with user management and also help all of us have less logins to worry about. One think I need is managing which user has access to which application. For example: Only some people should be able to access the Gitlab, but all should be able to access Mattermost. I've already looked at the options and played with Zitadel and Logto but they don't seem to solve the access issues mentioned above (they have roles, but you can't block access to a application based on them as far as I tried). I've also looked at Keycloak and it seems to offer client roles which you can then add to users. I'm just not sure if they can be used for user access. Did anyone have similar issue? How did/would you solve it? Thank you for your answers. ---------------------------------------------------------------------- squatsforlife · 2023-10-28 05:52 Teleport does this. ---------------------------------------------------------------------- indykoning · 2023-10-28 08:21 I know Authentik supports managing access per role, it's how it's meant to be used. https://goauthentik.io/docs/applications#authorization Seems they have a doc on setting it up with gitlab. https://goauthentik.io/integrations/services/gitlab/ ---------------------------------------------------------------------- gorbak25 · 2023-10-29 10:39 For your usecase if you are fine with proxying your apps via cloudflare I would recommend using cloudflare access, the UI is slow and sluggish but it's quick to set up and hassle free. Also key cloak can get the job done by making a separate realm per app, we did that at one of my previous jobs. ---------------------------------------------------------------------- rrrmmmrrrmmm · 2023-10-30 08:21 No need for a separate service. [GitLab](https://docs.gitlab.com/ee/integration/oauth_provider.html) can be a SSO provider via OAuth/OIDC itself. ---------------------------------------------------------------------- ww_pt · 2023-11-01 19:46 Thank you for your answer. Do you have personal experience with it? How hard/easy is it to set it up? ---------------------------------------------------------------------- ww_pt · 2023-11-01 19:47 Thx, I'll look into it! ---------------------------------------------------------------------- ww_pt · 2023-11-01 19:50 Thx for the answer. Using separate realms to achieve it didn't occur to me, interesting. But I'll probably try Authentik first.Cloudflare access seems nice, but it cannot be self-hosted (If I didn't miss something.) ---------------------------------------------------------------------- ww_pt · 2023-11-01 20:00 Thank you for the answer. Wouldn't it mean that all the users have to have a Gitlab account/access? (This could probably be okay since the users that don't need to have GitLab would just not see anything.) I can see that you can add a group-owned application - I'm guessing this would take care of different groups of users having access to different applications. Seems nice. About ReviewBoard - This was decided before I was at the company. When I asked, the reasons were better tools, commenting, etc. (I didn't ask for specifics). They apparently tried both and chose Reviewboard. ---------------------------------------------------------------------- rrrmmmrrrmmm · 2023-11-01 21:16 Yes, all users would need to have a GitLab account.