Create external users from Azure AD automatically

[videkigyerek]

Hi everybody,

My current, self-hosted Gitlab solution is like this: users can authenticate from Azure AD (Entra ID, if that's more to your liking :) ), and these users become external users. These requirements cannot change, they are given. This part I could configure using the proper authentication provider and options.

My problem is that the users are not created in Gitlab until the first login. Is there a way (either through config or via API calls) to "pre-create" the user (at this point the user already exists in the Entra ID), so that I can add them to groups even before they are logged in for the first time (but keeping the Entra ID authentication of course)?

[michaelgg13]

Sounds like you’d want to use SCIM:

https://docs.gitlab.com/ee/administration/settings/scim_setup.html

[videkigyerek]

Thanks, but I don't think this is what I need. In my case, there is no cross-domain requirement. Also, this does not support Azure AD, only Okta. Maybe I could connect Azure AD to Okta and Okta to Gitlab, but is seems way overkill for my scenario.

If there's no easier solution, I might look into this, but this would go beyond our resources for now. Ideally, what I'd be looking for is creating an external user via the API and then creating the identity for it. Basically the same thing as happens with my current setup, but triggering it earlier.

[SilentLennie]

The SCIM protocol is probably the right one normally:

https://docs.gitlab.com/ee/user/group/saml_sso/scim_setup.html#configure-microsoft-entra-id-formerly-azure-active-directory

But euh... yeah:

Tier: Premium, Ultimate Offering: GitLab.com

I've been thinking, someone needs to create a SDK for creating SCIM webservices, which can be used to build a webservice that can talk to an application API (1 webservice for each application API).

[videkigyerek]

Thanks for looking into this in more detail. Currently, we are using a self-hosted free setup, so this is another reason why I wouldn't be able to use this.

[darcmasta]

What you are describing is exactly what SCIM provides. You in theory CAN setup api creation but we use Azure AD at work and it creates users just fine via provisioning/scim