Skip to main content

Auth Configuration

Auth is only configurable in the Enterprise version of BuildBuddy.

Section​

auth: The Auth section enables BuildBuddy authentication using an OpenID Connect provider that you specify. Optional

Options​

  • oauth_providers: A list of configured OAuth Providers.
    • issuer_url: The issuer URL of this OIDC Provider.
    • client_id: The oauth client ID.
    • client_secret: The oauth client secret.
  • enable_anonymous_usage: If true, unauthenticated build uploads will still be allowed but won't be associated with your organization.

Redirect URL​

If during your OpenID provider configuration you're asked to enter a Redirect URL, you should enter https://YOUR_BUILDBUDDY_URL/auth/. For example if your BuildBuddy instance was hosted on https://buildbuddy.acme.com, you'd enter https://buildbuddy.acme.com/auth/ as your redirect url.

Google auth provider​

If you'd like to use Google as an auth provider, you can easily obtain your client id and client secret here.

Example:

auth:
  oauth_providers:
    - issuer_url: "https://accounts.google.com"
      client_id: "12345678911-f1r0phjnhbabcdefm32etnia21keeg31.apps.googleusercontent.com"
      client_secret: "sEcRetKeYgOeShErE"

Gitlab auth provider​

You can use Gitlab as an OIDC identity provider for BuildBuddy. This feature is available for both Gitlab On-Prem Deployment and Gitlab SaaS offering.

For more details, please refer to Gitlab's latest Official Documentation

Note: Because Gitlab has yet to support refresh tokens, you need to configure BuildBuddy to not request the offline_access scope from Gitlab:

auth:
  disable_refresh_token: true

Configuration:

Once the Gitlab application is created, you can configure it as a BuildBuddy auth provider like so:

auth:
  oauth_providers:
    - issuer_url: "https://gitlab.com"
      client_id: "<GITLAB APPLICATION ID>"
      client_secret: "<GITLAB APPLICATION SECRET>"