SSO Login via mellon #14538

New Issue

GiteaMirror · 2025-11-02T11:15:37-06:00

GiteaMirror commented

2025-11-02 11:15:37 -06:00

Originally created by @UNICodehORN on GitHub (Jun 2, 2025).

Description

Hey,

I try to get SSO authentication in gitea working, but I am failing.
From my app.ini:

ENABLE_REVERSE_PROXY_AUTHENTICATION = true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true
ENABLE_REVERSE_PROXY_AUTHENTICATION_API = true
REVERSE_PROXY_AUTHENTICATION_USER = X-Remote-User
ENABLE_REVERSE_PROXY_EMAIL = false
ENABLE_REVERSE_PROXY_FULL_NAME = false

From my apache:


<Location />
        AuthType` "Mellon"
        MellonEnable "auth"
        Require valid-user
    MellonSPPrivateKeyFile /etc/apache2/mellon/xxx/mellon.key
    MellonSPCertFile /etc/apache2/mellon/xxx/mellon.cert
    MellonSPMetadataFile /etc/apache2/mellon/xxx/sp-metadata.xml
    MellonIdpMetadataFile /etc/apache2/mellon/xxx/idp-metadata.xml
    MellonEndpointPath "/mellon/"
    MellonUser "username"

    # Übergebe die Umgebungsvariable als HTTP Header an Gitea
    RequestHeader set X-Remote-User %{MELLON_username}e
    </Location>

<Location /mellon>
    AuthType Mellon
    MellonEnable "info"
    Require all granted
    MellonSPPrivateKeyFile /etc/apache2/mellon/xxx/mellon.key
    MellonSPCertFile /etc/apache2/mellon/xxx/mellon.cert
    MellonSPMetadataFile /etc/apache2/mellon/xxx/sp-metadata.xml
    MellonIdpMetadataFile /etc/apache2/mellon/xxx/idp-metadata.xml
</Location>

    ProxyPass / http://localhost:3000/
    ProxyPassReverse / http://localhost:3000/

What happens:

Open gitea webui
Saml SSO Login is shown
Login is performed via SSO
SAML Logs show authentication was successful
Gitea page is presented but no user is logged in

What part am I missing?

Gitea Version

1.23.8

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Ubuntu

How are you running Gitea?

apt package self-hosted as systemd service

Database

MySQL/MariaDB

Originally created by @UNICodehORN on GitHub (Jun 2, 2025). Description Hey, I try to get SSO authentication in gitea working, but I am failing. From my app.ini: ``` ENABLE_REVERSE_PROXY_AUTHENTICATION = true ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true ENABLE_REVERSE_PROXY_AUTHENTICATION_API = true REVERSE_PROXY_AUTHENTICATION_USER = X-Remote-User ENABLE_REVERSE_PROXY_EMAIL = false ENABLE_REVERSE_PROXY_FULL_NAME = false ``` From my apache: ``` <Location /> AuthType` "Mellon" MellonEnable "auth" Require valid-user MellonSPPrivateKeyFile /etc/apache2/mellon/xxx/mellon.key MellonSPCertFile /etc/apache2/mellon/xxx/mellon.cert MellonSPMetadataFile /etc/apache2/mellon/xxx/sp-metadata.xml MellonIdpMetadataFile /etc/apache2/mellon/xxx/idp-metadata.xml MellonEndpointPath "/mellon/" MellonUser "username" # Übergebe die Umgebungsvariable als HTTP Header an Gitea RequestHeader set X-Remote-User %{MELLON_username}e </Location> <Location /mellon> AuthType Mellon MellonEnable "info" Require all granted MellonSPPrivateKeyFile /etc/apache2/mellon/xxx/mellon.key MellonSPCertFile /etc/apache2/mellon/xxx/mellon.cert MellonSPMetadataFile /etc/apache2/mellon/xxx/sp-metadata.xml MellonIdpMetadataFile /etc/apache2/mellon/xxx/idp-metadata.xml </Location> ProxyPass / http://localhost:3000/ ProxyPassReverse / http://localhost:3000/ ``` What happens: 1. Open gitea webui 2. Saml SSO Login is shown 3. Login is performed via SSO 4. SAML Logs show authentication was successful 5. Gitea page is presented but no user is logged in What part am I missing? ### Gitea Version 1.23.8 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System Ubuntu ### How are you running Gitea? apt package self-hosted as systemd service ### Database MySQL/MariaDB

GiteaMirror added the topic/authentication type/bug labels 2025-11-02 11:15:37 -06:00

GiteaMirror closed this issue

2025-11-02 11:15:37 -06:00

GiteaMirror commented

2025-11-02 11:15:38 -06:00

@charles7668 commented on GitHub (Jun 6, 2025):

Your REVERSE_PROXY_AUTHENTICATION_USER = X-Remote-User setting should be placed under the [security] section in app.ini.

@charles7668 commented on GitHub (Jun 6, 2025): Your `REVERSE_PROXY_AUTHENTICATION_USER = X-Remote-User` setting should be placed under the `[security]` section in `app.ini`.

GiteaMirror commented

2025-11-02 11:15:39 -06:00

@UNICodehORN commented on GitHub (Jun 6, 2025):

Perfect that was it. Thanks!


[service]
ENABLE_REVERSE_PROXY_AUTHENTICATION = true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true
ENABLE_REVERSE_PROXY_AUTHENTICATION_API = true
ENABLE_REVERSE_PROXY_EMAIL = false
ENABLE_REVERSE_PROXY_FULL_NAME = false

[security]
REVERSE_PROXY_AUTHENTICATION_USER = X-Remote-User

@UNICodehORN commented on GitHub (Jun 6, 2025): Perfect that was it. Thanks! ``` [service] ENABLE_REVERSE_PROXY_AUTHENTICATION = true ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true ENABLE_REVERSE_PROXY_AUTHENTICATION_API = true ENABLE_REVERSE_PROXY_EMAIL = false ENABLE_REVERSE_PROXY_FULL_NAME = false [security] REVERSE_PROXY_AUTHENTICATION_USER = X-Remote-User ```

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14538