GitLab의 애플리케이션 ID와 시크릿으로 교체합니다:

$ tctl sso configure oidc --preset gitlab \
--id 


콜백 주소 변경

The callback address can be changed if calling back to a remote machine
instead of the local machine is required:
# --bind-addr sets the host and port tsh will listen on, and --callback changes
# what link is displayed to the user
$ tsh login --proxy=proxy.example.com --auth=github --bind-addr=localhost:1234 --callback https://remote.machine:1234

For this to work the hostname or CIDR of the remote machine that will be used for
the callback will need to be allowed via your auth connector's client_redirect_settings:
kind: oidc
metadata:
  name: example-connector
spec:
  client_redirect_settings:
    # a list of hostnames allowed for HTTPS client redirect URLs
    # can be a regex pattern
    allowed_https_hostnames:
      - remote.machine
      - '*.app.github.dev'
      - '^\d+-[a-zA-Z0-9]+\.foo.internal$'
    # a list of CIDRs allowed for HTTP or HTTPS client redirect URLs
    insecure_allowed_cidr_ranges:
      - '192.168.1.0/24'
      - '2001:db8::/96'



커넥터 테스트#
파일을 tctl sso test에 파이프하여 커넥터 리소스를 테스트합니다:
$ cat oidc.yaml | tctl sso test

GitLab에서 애플리케이션을 인증한 후 웹 브라우저에 Login Successful 메시지가 표시되어야 합니다. 그렇지 않으면 명령의 출력을 참고하여 진단합니다.
커넥터 만들기#
tctl 도구를 사용하여 커넥터를 만듭니다:
$ tctl create -f oidc.yaml

이제 웹 UI에 새 버튼 "Login with GitLab"이 있습니다. CLI는 이전과 동일합니다:
$ tsh --proxy= login

이 명령은 SSO 로그인 URL을 출력합니다(그리고 브라우저에서 자동으로 열려고 합니다).
팁
Teleport는 여러 OIDC/SAML 커넥터를 사용할 수 있습니다. 이 경우 커넥터 이름은 tsh login --auth=connector_name으로 전달할 수 있습니다.

중요
Teleport는 OIDC Connect에 대해 전송자 주도 플로우만 지원합니다. 즉, 아이덴티티 프로바이더에서 로그인을 시작할 수 없으며 Teleport 웹 UI 또는 CLI에서 로그인을 시작해야 합니다.

3/3단계. 인증 기본 설정 구성#

Edit your cluster authentication preferences so you can make the authentication
connector you configured in this guide the default authentication method for
your Teleport cluster.
Open the Teleport Web UI. From the left sidebar, navigate to Zero Trust
Access > Auth Connectors. Find the connector you would like to make the
default and, from its three-dot menu, select Set as default.
If you are managing your Teleport resources as configuration files, you can
choose a default authentication connector using a dynamic resource. In this
case, use tctl to edit the cluster_auth_preference value:
$ tctl edit cluster_auth_preference

Set the value of spec.type to oidc:
kind: cluster_auth_preference
metadata:
  ...
  name: cluster-auth-preference
spec:
  ...
  type: oidc
  ...
version: v2

After you save and exit the editor, tctl will update the resource:
cluster auth preference has been updated


Additional ways to edit cluster auth preferences
The cluster auth preference is available as a Teleport Terraform provider
resource. Find a list of configuration options in the Cluster Auth Preferences
Resource
Reference.
If you self-host Teleport, you can edit your Teleport Auth Service configuration
file to include the following:
# Snippet from /etc/teleport.yaml
auth_service:
  authentication:
    type: oidc


If you need to log in again before configuring your identity provider, use the
flag --auth=local.

다음 단계#

Now that you have connected Teleport to your identity provider, you can
customize the way Teleport includes IdP data in Teleport roles.
With role templates, you can include user data from your IdP directly in
Teleport roles. If you use the external template variable in the value of a
role field, Teleport passes that value from your IdP. In this example, all of
the role options you can use for allowing users to assume certain principals on
remote systems come from your IdP:
kind: role
version: v7
metadata:
  name: sso-users
spec:
  allow:
    logins: ['{{external.logins}}']
    aws_role_arns: ['{{external.aws_role_arns}}']
    azure_identities: ['{{external.azure_identities}}']
    db_names: ['{{external.db_names}}']
    db_roles: ['{{external.db_roles}}']
    db_users: ['{{external.db_users}}']
    desktop_groups: ['{{external.desktop_groups}}']
    gcp_service_accounts: ['{{external.gcp_service_accounts}}']
    host_groups: ['{{external.host_groups}}']
    host_sudoers: ['{{external.host_sudoers}}']
    kubernetes_groups: ['{{external.kubernetes_groups}}']
    kubernetes_users: ['{{external.kubernetes_users}}']
    windows_desktop_logins: ['{{external.windows_desktop_logins}}']

For more information on using the external template variable, see Role
Templates.
For an explanation of the fields listed above, see the Role
Reference.
If you need to transform your IdP user data before you include it in Teleport
roles, you can do so using Login Rules. Login Rules allow you to include
external traits within Teleport roles even if your IdP provides user data in a
different format than the one expected by Teleport. Read more about Login
Rules.

문제 해결#
Note
이 섹션의 내용은 원문 문서를 참조하세요. (oidc-login-troubleshooting.mdx)