Yes. GitLab Self-Managed can show sign-in buttons for Google, GitHub, generic OAuth 2.0, OpenID Connect (OIDC), SAML, and other supported OmniAuth strategies at the same time. Add one provider definition for each identity service, give every provider its own client registration and callback, apply the configuration for your deployment type, and test account linking before opening it to users.
The safest setup keeps a local administrator login available, stores client secrets outside public documentation, blocks automatically created accounts until an administrator approves them, and treats repeated OIDC or SAML integrations as separate named instances. The provider name, callback path, username claim, and stored extern_uid values must remain consistent or existing users can lose access.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What “multiple OAuth providers” means in GitLab
GitLab Self-Managed uses OmniAuth to broker external sign-in. A deployment can expose several strategies, such as google_oauth2 for Google, github for GitHub, a generic OAuth 2.0 strategy, openid_connect for OIDC, and SAML. Each button represents a separate provider definition and a separate application registration at the identity provider.
Adding two buttons is different from registering the same external service twice. GitLab’s identity model permits only one provider entry for a unique external authentication and authorization provider. Two applications at the same service cannot safely be treated as independent providers merely by giving them different labels. If you need two OIDC or SAML services, use the documented repeated-strategy pattern with unique names, labels, issuers, and callback paths.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
What users see
When OmniAuth is enabled and providers are configured, the GitLab sign-in page displays the enabled provider buttons. A user can sign in through any allowed provider. Existing users can also connect a provider from Profile → Access → Password and authentication, provided the administrator has not disabled that provider.
Plan the provider inventory before editing GitLab
Write down every identity service and classify it before creating credentials. The classification determines the strategy name, required claims, callback format, and configuration syntax.
| Identity service type | GitLab strategy or pattern | Information to collect | Important distinction |
|---|---|---|---|
google_oauth2 |
Client ID, client secret, authorized callback, requested scopes | Register a Google application specifically for this GitLab host. | |
| GitHub | github |
OAuth App client ID, client secret, full callback URL | The callback must include /users/auth/github/callback, not only the host name. |
| Generic OAuth 2.0 | The exact supported OAuth strategy name | Authorization and token endpoints, client credentials, scopes, and claims | Use GitLab’s current provider matrix for the exact name and arguments. |
| OIDC | openid_connect with an explicit strategy class and unique provider name |
Issuer or discovery endpoint, client credentials, scopes, claims, callback | Every OIDC instance needs its own issuer and unique name or label. |
| SAML | Distinct provider names such as saml and saml_2 |
Entity ID, SSO certificate and endpoint, attribute mappings, callback | Each name must appear consistently in arguments, labels, callbacks, and allowlists. |
Record values in a change sheet
- GitLab base URL, including the externally reachable scheme and host.
- Provider name exactly as GitLab expects it, including capitalization and underscores.
- Client ID and secret, stored in your secret manager or protected deployment variables.
- Issuer and discovery URL for OIDC, or metadata and certificate details for SAML.
- Scopes and the claims used for email, display name, and username.
- Whether a provider-created account is internal or external, and whether it requires approval.
- The current user-to-provider mapping before any application replacement.
Register an application at each identity provider
Create a separate OAuth or OIDC application for every external service you intend to expose. Do not reuse one provider’s client secret for another provider. Enter GitLab’s public HTTPS URL and the complete callback path required by the strategy.
Create a Google-registered application, generate a client ID and secret, and add the callback URL for the GitLab host. The commonly used OmniAuth path is https://gitlab.example.com/users/auth/google_oauth2/callback; verify the exact path in the current GitLab integration instructions for your release before saving it. Record the scopes that supply a stable email and profile identity.
GitHub
Create a GitHub OAuth App and set its authorization callback to the full URL, for example https://gitlab.example.com/users/auth/github/callback. A host-only redirect such as https://gitlab.example.com is incomplete and causes the callback to fail. Copy the generated client ID and secret into protected deployment storage.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
OIDC and SAML
For OIDC, collect the issuer or discovery endpoint, client credentials, and the claims GitLab will use. For SAML, obtain the identity provider metadata, signing certificate, SSO endpoint, and the exact attribute names. If two services use the same protocol, reserve unique provider names before registering their applications; those names become part of the callback URL and GitLab configuration.
Configure two providers on an Omnibus Linux installation
For the Linux package, provider definitions belong in /etc/gitlab/gitlab.rb. The following is a safe structural example using environment variables rather than embedding secrets. Replace the variable values in your protected service environment with the real credentials.
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_providers'] = [
{
name: 'google_oauth2',
app_id: ENV.fetch('GOOGLE_CLIENT_ID'),
app_secret: ENV.fetch('GOOGLE_CLIENT_SECRET'),
args: {
# Add the scopes and provider-specific options required by your release.
}
},
{
name: 'github',
app_id: ENV.fetch('GITHUB_CLIENT_ID'),
app_secret: ENV.fetch('GITHUB_CLIENT_SECRET'),
args: {
# Add the scopes and provider-specific options required by your release.
}
}
]
gitlab_rails['omniauth_allow_single_sign_on'] = ['google_oauth2', 'github']
gitlab_rails['omniauth_block_auto_created_users'] = true
The object names, argument keys, and profile-synchronization options vary by strategy and GitLab release. Use the exact provider arguments from GitLab’s current integration documentation rather than copying options from an unrelated strategy. Add provider names to the relevant allowlists only after deciding whether just-in-time account creation is wanted.
Apply and verify the Omnibus change
- Back up
/etc/gitlab/gitlab.rband confirm that a recovery administrator can still use a local password. - Save the provider definitions and common OmniAuth settings.
- Run
sudo gitlab-ctl reconfigure. - Open the GitLab sign-in page and confirm that both provider buttons appear.
- Use controlled test accounts to complete each flow and verify that the browser returns to the intended GitLab host.
- Check the resulting account’s email, username, internal or external status, and approval state.
Configure providers with the GitLab Helm chart
Helm deployments express OmniAuth through the chart’s global.appConfig.omniauth values. Keep credentials in Kubernetes Secrets or the chart’s supported secret references, not in a publicly committed values file. The exact nesting for provider entries and secret keys depends on the chart version, so start from that version’s values schema and reproduce one provider object per service.
Your values should enable OmniAuth, list the provider names in the single-sign-on allowlist when automatic account creation is intended, and define the provider credentials and arguments under the chart’s supported provider structure. A typical deployment command is:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
helm upgrade gitlab gitlab/gitlab
--namespace gitlab
--values values.yamlAfter the upgrade, inspect the webservice and toolbox workloads for configuration errors, then test each button. A Helm rollback is preferable to deleting provider settings if a syntax or secret-reference error prevents the webservice from becoming ready.
Configure Docker, source, and other installations
Docker-based Omnibus deployments commonly pass the Ruby configuration through GITLAB_OMNIBUS_CONFIG. Put the same provider objects and common settings there, inject client secrets through the container’s secret mechanism, and restart or recreate the container after changing them. Source installations use the application’s supported environment and configuration files; apply the change with the deployment’s normal restart or redeploy action.
Do not assume that editing a running container is persistent. Store the configuration in the compose file, orchestrator manifest, or secret store that recreates the service, and verify that a restart preserves both provider definitions.
Choose account-creation and identity-linking behavior
Provider configuration controls more than the login button. Decide each policy deliberately because changing it later can affect who can enter the instance.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAllowing just-in-time accounts
allow_single_sign_on in Omnibus, or allowSingleSignOn in Helm values, names providers that may create an account at first login. Include only the providers you trust for automatic provisioning. If a provider is configured but omitted from this allowlist, users may see the button without being allowed to create a new GitLab account.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Blocking new accounts pending approval
block_auto_created_users (or the chart’s camel-case equivalent) lets GitLab create the identity while preventing immediate use until an administrator approves it. This is the safer default for organizations that need a review step, domain check, or license assignment before access.
Automatically linking existing accounts
auto_link_user controls whether a provider identity can be linked to an existing GitLab account when the identifying email matches. Email matching is convenient but must be limited to providers whose email claims are verified and trustworthy. A mismatch, changed email, or unverified claim can create a second account instead of linking the intended one.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsExternal status and profile synchronization
external_providers identifies providers whose users should be marked external. External status can restrict project and group behavior, so apply it only to the populations that truly require those restrictions. Profile synchronization settings determine whether GitLab updates names, usernames, or other attributes from the provider. Synchronizing a username claim can cause collisions; if you configure gitlab_username_claim, choose a stable, unique claim and test duplicate and rename cases.
Configure multiple OIDC providers
Repeated OIDC entries need more than different client IDs. GitLab’s documented pattern repeats the openid_connect strategy, sets an explicit strategy_class, and gives each identity service a unique provider name and label. Each entry also points to its own issuer or discovery endpoint and client credentials.
gitlab_rails['omniauth_providers'] = [
{
name: 'openid_connect',
strategy_class: 'OmniAuth::Strategies::OpenIDConnect',
options: {
name: 'corp_oidc',
scope: ['openid', 'profile', 'email'],
response_type: 'code',
issuer: ENV.fetch('CORP_OIDC_ISSUER'),
client_options: {
identifier: ENV.fetch('CORP_OIDC_CLIENT_ID'),
secret: ENV.fetch('CORP_OIDC_CLIENT_SECRET')
}
}
},
{
name: 'openid_connect',
strategy_class: 'OmniAuth::Strategies::OpenIDConnect',
options: {
name: 'partner_oidc',
scope: ['openid', 'profile', 'email'],
response_type: 'code',
issuer: ENV.fetch('PARTNER_OIDC_ISSUER'),
client_options: {
identifier: ENV.fetch('PARTNER_OIDC_CLIENT_ID'),
secret: ENV.fetch('PARTNER_OIDC_CLIENT_SECRET')
}
}
}
]
This illustrates the required separation, not a universal drop-in file. Check your GitLab version for the exact nesting of options, discovery settings, labels, and callback generation. The two entries must produce different callback URLs and must not share an issuer or provider name accidentally.
Configure multiple SAML providers
SAML instances follow the same principle but make the provider name part of the callback path. Use distinct names such as saml and saml_2, assign distinct button labels, and use the matching name consistently in each provider’s arguments and allowlist.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If just-in-time creation is required, add both names to the single-sign-on allowlist. A callback generated for saml_2 cannot be registered under the saml application. Keep each identity provider’s entity ID, certificate, endpoint, and attribute mapping separate, and test certificate rotation before the old certificate expires.
Test every flow before production rollout
- Open a private browser session and select the first provider.
- Authenticate with a controlled account whose email and username claims are known.
- Confirm the callback reaches the same GitLab host and does not stop at an authorization or state error.
- Check whether GitLab created a new account, linked an existing account, marked it external, or placed it in pending approval.
- Sign out, repeat with the second provider, and compare the resulting identity mapping.
- From an existing account, use Profile → Access → Password and authentication to link the provider and verify that the new identity appears.
- As an administrator, open Admin → Settings → General → Sign-in restrictions and confirm that each configured provider can be selectively enabled or disabled.
- Test a denied or unapproved account, a duplicate email, a missing email claim, and a user whose provider username changes.
Diagnose failed buttons and callbacks
The button is missing
- Confirm OmniAuth is enabled and the provider object parsed successfully.
- Check that the provider name is in the deployment’s enabled list and that the latest reconfigure, Helm upgrade, or container restart completed.
- Review webservice logs for a malformed provider argument or missing secret.
The provider rejects the redirect URI
- Compare the registered URI character-for-character with GitLab’s generated callback, including scheme, host, path, capitalization, and trailing slash.
- For GitHub, ensure the path contains
/users/auth/github/callback; a host-only URI is not sufficient. - For repeated OIDC or SAML entries, confirm that the callback contains the unique provider name intended for that application.
- Ensure the public GitLab URL is the one users actually reach through a reverse proxy or load balancer.
Authentication succeeds but GitLab creates the wrong account
- Inspect the email and username claims returned by the provider.
- Review
auto_link_user, verified-email behavior, and the configuredgitlab_username_claim. - Look for collisions caused by a non-unique username claim or a changed email address.
- Do not manually edit identities until you have recorded the affected user and provider mapping.
Users are stranded after an application change
GitLab stores the external identity as an extern_uid. Replacing an OAuth/OIDC application, changing the provider name, or altering the subject claim can make the new login appear unrelated to existing accounts. Plan a coordinated migration using the Users API or Rails console, preserve a recovery administrator, and validate a sample of mappings before removing the old application.
Migration and operational safeguards
- Keep at least one tested local administrator login before changing OmniAuth settings.
- Back up the GitLab configuration and document every provider name, callback, issuer, and claim mapping.
- Rotate secrets through the deployment secret mechanism and restrict read access to configuration files.
- Stage changes with test accounts before enabling automatic creation for the whole organization.
- When replacing an application, export or record the current
extern_uidrelationships and schedule identity updates rather than relying on email matching. - Disable a provider only after users have linked an alternative sign-in method.
How to compare provider choices
OAuth 2.0, OIDC, and SAML can all provide external sign-in, but they differ in what GitLab must validate and what the identity service returns.
| Decision area | Questions to answer |
|---|---|
| Protocol | Does the service expose OAuth 2.0, OIDC discovery, or SAML metadata, and does GitLab support that strategy in your release? |
| Application registration | Can you create a dedicated application with a fixed redirect URI and rotate its secret? |
| Claims and scopes | Is there a verified email, stable subject, and unique username claim? |
| Assurance and MFA | Does the provider enforce the MFA or authentication assurance your policy requires? |
| Provisioning | Should first login create an account, create a pending account, or be limited to pre-existing users? |
| Operations | Can administrators disable one provider without taking down the others, and can you monitor its callback failures? |
| Migration | What happens to stored extern_uid values if the application, issuer, subject, or provider name changes? |
Recommended rollout sequence
- Inventory providers and select the exact GitLab strategy names.
- Register one application per provider and capture complete callback URLs.
- Create protected secrets and write one provider object per service.
- Set allowlists, approval blocking, external status, and profile synchronization deliberately.
- Apply the change with
gitlab-ctl reconfigure, Helm upgrade, or the supported container restart. - Test each button, callback, claim, account state, and administrator control.
- Document provider-to-user mappings and only then invite broader user groups.
The Bottom Line
Multiple OAuth providers work reliably in self-hosted GitLab when every provider has its own registered application, exact callback, unique name where strategies repeat, and deliberate account-provisioning policy. Configure the deployment-specific OmniAuth settings, test with controlled accounts, and protect the extern_uid mappings before changing or replacing an identity application.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
