# GitLab Integration and JWT Headers
**URL:** https://discuss.pomerium.com/t/gitlab-integration-and-jwt-headers/40
**Category:** Integrations
**Tags:** oss
**Created:** [December 3, 2021, 4:22pm UTC](https://discuss.pomerium.com/t/gitlab-integration-and-jwt-headers/40 "2021-12-03T16:22:39Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@alex](https://discuss.pomerium.com/u/alex)
#### Post date: [December 3, 2021, 4:22pm UTC](https://discuss.pomerium.com/t/gitlab-integration-and-jwt-headers/40/1 "2021-12-03T16:22:39Z")
> [@](#):
>
> [**View in #general on Slack**](https://slack.com/archives/CK6SVMPU0/p1638286200036800)
>
>  **@Cory\_Rankin:** has anyone setup self-hosted gitlab with SSO and pomerium? trying to decide my easiest strategy
>
>  **@Alex:** @Cory\_Rankin it’s on my radar to make an integration guide for that in the coming weeks. I’d be happy to share my WIP with you (once I have something to share), and/or get input from your setup (if you go for it first) to use in the guide.
>
>  **@Cory\_Rankin:** oh awesome. I’ve only messed around a little bit and done some gitlab reading.
>
> I would rather do that than oauth with my idp
>
>  **@Alex:** @Cory\_Rankin, wait, are you trying to:
> • use self-hosted GitLab as an IdP,
> • secure self-hosted GitLab with Pomerium,
> • both?
> Because I can tell you that doing both is a non-starter - the IdP needs to be accessible _before_ you authenticate to Pomerium in order to work.
>
>  **@Cory\_Rankin:** secure self-hosted Gitlab with Pomerium. I was saying my alternative was oauth to gitlab using my existing idp. I have Pomerium in front of gitlab already but dual auth
>
>  **@Alex:** Gotcha
>
>  **@Cory\_Rankin:** it seemed like using gitlab jwt auth with pomerium could work unless I was misunderstanding
>
>  **@Alex:** I think so too, are we both looking at the same [doc](https://docs.gitlab.com/ee/administration/auth/jwt.html)?
>
>  **@Cory\_Rankin:** Yes, I should’ve linked. That’s what I was reading over and trying to decide on
>
>  **@Alex:** That looks pretty standard, except I’m not yet clear on what it means by “register your application” and how the app secret applies.
> I’ll know more when I dig into it, hopefully by EOW
>
>  **@Cory\_Rankin:** that is where I was uncertain
> the gitlab doc references this [omniauth-jwt](https://github.com/mbleigh/omniauth-jwt#:~:text=The%20first%20parameter%20is%20the%20shared%20secret) repo but that didn’t ring any bells for me
>
>  **@Alex:** Hey @Cory\_Rankin - I’ve been working on this and have succeeded in protecting gitlab-ee behind Pomerium. Now I’m working on this JWT auth, and man… I’m still trying to figure out what they hell it means by “register your application” or how that secret key is generated…
>
>  **@Cory\_Rankin:** I’m with you, perhaps it is for something like this and not user auth?
> [https://docs.gitlab.com/ee/ci/examples/authenticating-with-hashicorp-vault/](https://docs.gitlab.com/ee/ci/examples/authenticating-with-hashicorp-vault/)
>
> > Authenticating and reading secrets with HashiCorp Vault | GitLab
>
> oh! I think I found our answer here:
> [https://github.com/mbleigh/omniauth-jwt/issues/7](https://github.com/mbleigh/omniauth-jwt/issues/7)
>
>  **@Alex:** Yea… unfortunately that issue was solved by a PR in a fork of the tool, not in the source tool. Additionally it looks like the system using the tool needs to also be adjusted, as seen in this PR implementing that change for Discourse (which was also reverted 😢) [https://github.com/discourse/discourse-jwt/pull/3](https://github.com/discourse/discourse-jwt/pull/3)
> If you don’t mind, I’m gonna convert this into a forum thread over on Discuss. Making this conversation more publicly accessible should help get the involvement of a GitLab SME who may hold the answer in their brain.
>
>  **@Cory\_Rankin:** Ha, yes I noticed that. Sounds good thanks
---
### Author:  [@alex](https://discuss.pomerium.com/u/alex)
#### Post date: [December 3, 2021, 4:34pm UTC](https://discuss.pomerium.com/t/gitlab-integration-and-jwt-headers/40/2 "2021-12-03T16:34:32Z")
I’m working on the integration guide on the assumption that we’ll find a solution to the outstanding issue of configuring GitLab to accept the JWT provided in the header.
You can see the source in the [pull request](https://github.com/pomerium/pomerium/pull/2800), or preview the guide [here](https://deploy-preview-2800--pomerium-docs.netlify.app/guides/gitlab.html) (this link will stop working once the guide is merged to the live site).
I’ve reached out to the GitLab community for help on their [forum](https://forum.gitlab.com/t/configure-gitlab-to-accept-jwt-from-header/62316/2), and on the [PR](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/17774#8012ef217da335eb598f2d5eb59af7f794f029c1) that added the JWT auth option.
I’m worried I might come off as spammish, but it seems like a wide net is required to pull in someone who knows how this tooling works.
---
### Author:  [@alex](https://discuss.pomerium.com/u/alex)
#### Post date: [December 7, 2021, 5:40pm UTC](https://discuss.pomerium.com/t/gitlab-integration-and-jwt-headers/40/3 "2021-12-07T17:40:15Z")
So the unfortunate answer to this thread is that GitLab, as far as I can tell, cannot be configured to accept a JWT from a header.
I’ve finished the draft for the GitLab integration guide, and in it I documented the next best thing, configuring GitLab to use the same IdP so it can share the session cookie.
If GitLab (hopefully) ever updates their auth method in a sane manner I will update this thread.