# Use GitLab as OIDC provider

**URL:** <https://forum.ansible.com/t/use-gitlab-as-oidc-provider/38282>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [July 31, 2023, 2:45pm UTC](https://forum.ansible.com/t/use-gitlab-as-oidc-provider/38282 "2023-07-31T14:45:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahmed](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@ahmed](https://forum.ansible.com/u/ahmed)\
**Post date:** [July 31, 2023, 2:45pm UTC](https://forum.ansible.com/t/use-gitlab-as-oidc-provider/38282/1 "2023-07-31T14:45:10Z")

</div>

Hey Everyone,

I’m trying to use GitLab as an OIDC provider with AWX 22.1.0. I have followed these steps:

- Add application in GitLab with :
  - scopes : **openid**
  - Redirect URI : **[https://awx-host/sso/complete/oidc/](https://awx-host/sso/complete/oidc/)**

- Configure Generic OIDC:
  - “SOCIAL\_AUTH\_OIDC\_KEY”: “application ID from GitLab”
  - “SOCIAL\_AUTH\_OIDC\_SECRET”: “Secret from GitLab”
  - “SOCIAL\_AUTH\_OIDC\_OIDC\_ENDPOINT”: “[https://gitlab-instance/.well-known/openid-configuration](https://gitlab-instance/.well-known/openid-configuration)”,
  - “SOCIAL\_AUTH\_OIDC\_VERIFY\_SSL”: false  
When I try to connect via GUI, I get this error:

2023-07-31 13:55:44,798 ERROR [35f2be137b45484d8003e87108ed5049] social Expecting value: line 1 column 1 (char 0).

Is missing something in my configuration or does AWX not support OIDC authentication with GitLab? ?

Thanks,

---

<div class="post-metadata">

**Author:** ![ahmed](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@ahmed](https://forum.ansible.com/u/ahmed)\
**Post date:** [August 1, 2023, 7:35am UTC](https://forum.ansible.com/t/use-gitlab-as-oidc-provider/38282/2 "2023-08-01T07:35:42Z")

</div>

I have changed the **SOCIAL\_AUTH\_OIDC\_OIDC\_ENDPOINT to** [https://gitlab-instance](https://gitlab-instance/.well-known/openid-configuration) and now I get a new error as in this issue [13226](https://github.com/ansible/awx/issues/13226):

ERROR [b4edee95256c4f68be89f78efbac41dd] social Direct assignment to the forward side of a many-to-many set is prohibited. Use groups.set() instead.

My purpose is to use OIDC for authentication and not for authorization.

Please help, much appreciated !

---

<div class="post-metadata">

**Author:** ![ahmed](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@ahmed](https://forum.ansible.com/u/ahmed)\
**Post date:** [August 1, 2023, 1:38pm UTC](https://forum.ansible.com/t/use-gitlab-as-oidc-provider/38282/3 "2023-08-01T13:38:30Z")

</div>

The error disappears by upgrading the version of **social-auth-core[openidconnect]** to **4.4.0.**

Now how can I use this backend to authenticate to AWX API from a GitLab pipeline by using CI\_JOB\_JWT variable ?

---

<div class="post-metadata">

**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\
**Post date:** [August 2, 2023, 6:52pm UTC](https://forum.ansible.com/t/use-gitlab-as-oidc-provider/38282/4 "2023-08-02T18:52:07Z")

</div>

Do you mind opening a PR or issue in AWX and describe the problem and how bumping to 4.4.0 solved it?

as for you second question, maybe create a new thread since it is about something else.

AWX Team