OWASP Threat Modeling: gitlab

---
layout: page
title: Configure GitLab access
nav_order: 4
path: /configure/gitlab
group: Configure
---

## Configure GitLab access

[Threat Dragon](https://owasp.org/www-project-threat-dragon/) can be run as a web application and
if GitLab repository access is required then some configuration is needed
for the necessary environment variables.
The GitLab specific environment variables are listed at the [end of this page](#gitlab-environment-variables),
other variables are described in
the [installation instructions]({{ '/configure/configure.html#environment-variables-reference' | relative_url }}).

## GitLab repository access

Most of steps are the same as the [GitHub configuration]({{ '/configure/github.html' | relative_url }})
but there are some parts that are different:

1. Web App GitLab Access
2. Environment variables

### 1. Web App GitLab Access

It is recommended to follow the [gitlab official guide](https://docs.gitlab.com/integration/oauth_provider/)
to set up the OAuth Application.

The recommended configuration is similar to below:

- Redirect URI: `{BaseURL of your Threat Dragon Instance}/api/oauth/return`
- Scopes: Check `read_user read_repository write_repository profile read_api api`

Other options like `Trusted` are according to personal preference.

From the OAuth Application you will get `Application ID` and `Application Secret`,
which are used for the environment variables below.

### 2. Environment variables

The Application ID obtained from the GitLab OAuth Application is used for `GITLAB_CLIENT_ID`,
and the Application Secret used for `GITLAB_CLIENT_SECRET`.

The `GITLAB_REDIRECT_URI` environment variable follows
the pattern ``{BaseURL of your Threat Dragon Instance}/api/oauth/return``,
for example `<URL of Threat Dragon app>/api/oauth/return`

The `GITLAB_SCOPE` is set to the scope of permissions allowed for the Threat Dragon application,
for example `api` provides maximum scope and `read_user read_repository write_repository profile read_api`
provides a more restricted set of permissions.

The `GITLAB_HOST` is set to the base URL of the GitLab instance.
If you're using the official GitLab instance do not set this variable or set it to `https://gitlab.com/`.

An example set of environment variables to support GitLab access :

```text
GITLAB_CLIENT_ID=[PII_REDACTED][PII_REDACTED]aabbccddeeff
GITLAB_CLIENT_SECRET=gloas-deadbeef[PII_REDACTED]abcdefdeadbeef
GITLAB_SCOPE=read_user read_repository write_repository profile read_api api
GITLAB_REDIRECT_URI=http://threat-dragon-instance/api/oauth/return
GITLAB_HOST=http://gitlab-instance
```

Clearly the secrets shown here are _not to be used_ for a real application,
they are merely for illustrative purposes.

![GitLab button]({{ '/assets/images/gitlab-button.png' | relative_url }}){: .float-right }

If Threat Dragon is successfully configured for GitLab access then the 'Login with GitLab' button is made visible.

Refer to the [the GitHub configuration]({{ '/configure/github.html' | relative_url }}) guide for
a similar example of setting up Github step by step.

### GitLab environment variables

| GitLab specifics | Description | Default |
| --- | --- | --- |
| `GITLAB_CLIENT_ID` | The 'Application ID' provided by the GitLab OAuth app used for authentication | |
| `GITLAB_CLIENT_SECRET` | The 'Application Secret' generated by the GitLab OAuth authentication app | |
| `GITLAB_SCOPE` | The scope provided to the GitLab OAuth app | `read_user read_repository` |
| `GITLAB_HOST` | The URL of GitLab server, for example `https://gitlab.com/` | |
| `GITLAB_REDIRECT_URI` | The redirect provided to the GitLab OAuth app | |
| `GITLAB_REPO_ROOT_DIRECTORY` | Optional path where saved models are stored in a GitLab repo | |

### Example production GitLab environment

Important: this example file contains test values, do not use these values for anything other than short-term tests.

```sh
ENCRYPTION_JWT_REFRESH_SIGNING_KEY=[PII_REDACTED][PII_REDACTED]aabbccddeeff
ENCRYPTION_JWT_SIGNING_KEY=deadbeef[PII_REDACTED]6778899aabbcc
ENCRYPTION_KEYS='[{"isPrimary": true, "id": 0, "value": "[PII_REDACTED]abcdef[PII_REDACTED]abcdef"}]'
GITLAB_CLIENT_ID=[PII_REDACTED][PII_REDACTED]aabbccddeeff
GITLAB_CLIENT_SECRET=gloas-deadbeef[PII_REDACTED]abcdefdeadbeef
GITLAB_SCOPE=read_user read_repository write_repository profile read_api api
GITLAB_HOST=https://secure-gitlab-instance
NODE_ENV=production
PROTOCOL=https
SERVER_API_PROTOCOL=https
```

Note the use of HTTPS in production deployments in this _minimal_ environment.

----

Threat Dragon: _making threat modeling less threatening_