Admin Settings
Maintenance
Dashboard Self Check
Identity & Access
Authentication Sources Organizations User Accounts Badges User Email Addresses
Code Assets
Packages Repositories
Integrations
Applications Webhooks
Actions
Runners Variables Scoped Workflows Job queue
Configuration
Summary Settings
System Notices
Monitoring
Audit Log Stats Cron Tasks Queues Trace

Add Authentication Source

LDAP (via BindDN)
LDAP (via BindDN)
LDAP (simple auth)
SMTP
OAuth2
SPNEGO with SSPI
Unencrypted
Unencrypted
LDAPS
StartTLS

Leave empty to not set any users as restricted. Use an asterisk ('*') to set all users that do not match Admin Filter as restricted.

Leaving unset means local users with 2FA set will still have to pass 2FA to log on

PLAIN
PLAIN
LOGIN
CRAM-MD5

SMTPS is always used on port 465. Set this to force SMTPS on other ports. (Otherwise STARTTLS will be used on other ports if it is supported by the host.)

Hostname sent with HELO. Leave blank to send current hostname.

Leave empty to allow all domains. Separate multiple domains with a comma (',').

Leaving unset means local users with 2FA set will still have to pass 2FA to log on

Leaving unset means local users with 2FA set will still have to pass 2FA to log on

aws-cognito
AWS Cognito
Bitbucket
Discord
Dropbox
Facebook
Gitea
GitHub
GitLab
Google
Mastodon
Nextcloud
OpenID Connect
Twitter
Yandex

Leaving unset means local users with 2FA set will still have to pass 2FA to log on

Claim name to use as the user's external identity. Defaults to "sub". For Azure AD / Entra ID, set this to "oid" to maintain continuity when migrating from the Azure AD V2 provider. Note: the "oid" claim requires the "profile" scope to be included in the Scopes field above.

Set this name to restrict login from this source to users with a claim with this name

Set this value to restrict login from this source to users with a claim with this name and value

Allow SSPI auth method to automatically create new accounts for users that log in for the first time

Allow SSPI auth method to automatically activate new users

If checked, domain names will be removed from logon names (e.g. "DOMAIN\user" and "user@example.org" both will become just "user").

The character to use to replace the separators of down-level logon names (e.g. the \ in "DOMAIN\user") and user principal names (e.g. the @ in "user@example.org").

Default language for users automatically created by SSPI auth method. Leave empty if you prefer the language to be automatically detected.

Tips

GMail Settings:

Host: smtp.gmail.com, Port: 587, Enable TLS Encryption: true

OAuth2 Authentication

When registering a new OAuth2 authentication, the callback/redirect URL should be:

OAuth2 Provider
  • Bitbucket
    Register a new OAuth consumer on https://bitbucket.org/account/user/{your-username}/oauth-consumers/new and add the permission 'Account' - 'Read'
  • Dropbox
    Create a new application at https://www.dropbox.com/developers/apps
  • Facebook
    Register a new application at https://developers.facebook.com/apps and add the product "Facebook Login"
  • GitHub
    Register a new OAuth application on https://github.com/settings/applications/new
  • GitLab
    Register a new application on https://gitlab.com/-/profile/applications
  • Google
    Obtain OAuth2 client credentials from the Google API console at https://console.developers.google.com/
  • OpenID Connect
    Use the OpenID Connect Discovery URL "https://{server}/.well-known/openid-configuration" to specify the endpoints
  • Twitter
    Go to https://dev.twitter.com/apps, create an application and ensure that the “Allow this application to be used to Sign in with Twitter” option is enabled
  • Discord
    Register a new application on https://discordapp.com/developers/applications/me
  • Gitea
    Register a new OAuth2 application. Guide can be found at https://docs.gitea.com/development/oauth2-provider
  • Nextcloud
    Register a new OAuth consumer on your instance by selecting "Settings -> Security -> OAuth 2.0 client" in the menu
  • Yandex
    Create a new application at https://oauth.yandex.com/client/new. Select following permissions from the "Yandex.Passport API" section: "Access to email address", "Access to user avatar" and "Access to username, first name and surname, gender"
  • Mastodon
    Input a custom instance URL for the mastodon instance you want to authenticate with (or use the default one)