Category Direction - Authorization and Authentication

1. You are here:
2. GitLab Direction
3. Product Stage Direction - Manage
4. Category Direction - Authorization and Authentication

• Introduction and how you can help
• Overview
  • Target audience and experience
• Where we are Headed
  • What's Next and Why
• Maturity Plan
  • Top Vision Item(s)

Introduction and how you can help

Thanks for visiting the direction page for Authentication and Authorization in GitLab. This vision and direction is a work in progress and sharing your feedback directly on issues and epics on GitLab.com is the best way to contribute.

Overview

Authentication and authorization are critical, foundational elements to keeping resources secure but accessible. This is of particular importance for large enterprises or companies operating in regulated environments; for an authentication strategy to function, it must be secure and scalable. Onboarding/offboarding new employees should be automatable and not allow unauthorized users to access sensitive information.

Furthermore, security strategies have evolved from one of assumed trust within a trusted network. Historically, most organizations assume that authenticated users coming from a trusted source are allowed to access resources - those outside, if not on a VPN, cannot. However, security perimeters have become increasingly porous and an assumed trust model begins to break down with more services shifting to cloud and more employees BYODing or working remotely.

While GitLab's supported strategies meet most expectations (especially outside of the enterprise), our strategy is to aggressively invest in further improvements to authentication and authorization, with a particular focus on SAML.

Target audience and experience

The primary audience for future effort are administrators in medium to large enterprises. These are privileged, sophisticated users in companies managing employee identities with a single source of truth; this may be a series of LDAP servers or an IdAAS service like Okta. Automation matters - we should minimize the amount of manual work needed to onboard/offboard an employee and be able to assign permissions automatically - but the must-have is security, especially in sensitive environments operating under regulatory scrutiny. We need to strike a balance between being overly permissive (e.g. unintentionally allowing access to an offboarded employee) and overly restrictive (e.g. getting in the way of a developer's workflow and annoying them with reauthentication requests).

Where we are Headed

We're currently focused on broader and deeper support for identity management and authentication strategies. Our objective is to allow users to quickly join GitLab with the right level of access, and building support for large organizations to quickly onboard and offboard users is essential.

For large organizations, we also need to make sure that users are armed with the right level of access. GitLab's role-based access control has served small teams well - and fits with a permissions model where anyone can contribute - but makes it challenging for large, security-minded organizations to build the level of granular controls and variation they need.

What's Next and Why

To align with our goal of GitLab-hosted first, we are working on GitLab.com reliability for the next 2 months.

• Improving performance will be our top priority in the near term. The rapid growth of GitLab.com has uncovered performance issues in our group authorization and project authorization calculations.
• Security continues to be an area of focus. We will have dedicated capacity with our security rota process. By dedicating capacity each milestone we can separate the planning of security issues from the main milestone goals, with the aim of introducing a more optimal process.

Although reliability will continue to occupy a dedicated portion of our engineering capacity each month, we know that soon we will again have capacity to work on new features. Here are a few of the things we have planned:

• On authentication, Access is prioritizing expanding existing capabilities that make setup and user management at scale easier.
  • Enforce group SAML in the API for GitLab.com.
  • Add support for "nickname" and "username" SAML assertions.
  • Service Accounts will support authentication methods where the actor is not a user at the group and project level. This will eliminate to occupy a licensed seat in order to create an integration. Initial support will be for Deploy Tokens and Project Access Tokens.
  • Allow administrators to verify their domain, which adds credibility to project pages.
• On authorization, we're prioritizing improvements that provide much-needed flexibility to allow administrators to define their access levels, assign to groups and define hierarchies.
  • We have begun exploring the problem and possible solutions for fine grained permissions starting with a design effort.

Access uses a single epic to highlight issues we're prioritizing or refining. If you're not confident an important Access issue is on our roadmap, please feel free to highlight by commenting in the relevant issue and @ mentioning hsutor, Access Product Manager.

Maturity Plan

This category is currently Complete. The next step in our maturity plan is achieving a Lovable state.

• You can read more about GitLab's maturity framework here, including an approximate timeline.
• Note that a Complete state does not mean a category is "finished" and is no longer a priority. Even categories that are considered Lovable require continued investment.

While authentication and authorization in GitLab has a sufficient feature set to be competitive, we see significant opportunity to elevate our capabilities - especially for the enterprise. You can see the current scope of work to achieve this state in the corresponding Lovable maturity epic.

Top Vision Item(s)

Our top vision item is to build a capability for Fine-Grained role definition.

Other items on the list:

• Introduce service accounts
• Support enterprise SaaS admins in securing their project and group ecosystem by enabling domain verification and the ability to claim users that fall under the domain.