RHDH: How to configure GitLab as an identity provider for Red Hat Developer Hub

4 min readAug 18, 2025

The purpose of this article is to provide a quick guide that shows how to set up a private GitLab instance as an identity provider for Red Hat Developer Hub (RHDH) in testing and development environments. The blog does not seek to provide a production grade solution, but rather show how to create a quick integration with a GitLab identity provider for testing purposes.

Prerequisites

OpenShift 4.18
A private GitLab instance
Red Hat Developer Hub operator 1.6.3 (installed in the rhdh-operator namespace)

Procedure

This section provides the instructions that need to be followed in order to create the integration.

GitLab

In order to integrate GitLab with RHDH you must create -

A token that will be used by RHDH to access GitLab’s API. Create a personal access token with an api scope -

An Application that will be used by RHDH to authenticate users against GitLab. Make sure to add a callback URL and define scopes as described in the next image -

Several Users and groups that will be synced into RHDH.

Red Hat Developer Hub

This section shows which resources have to be configured in OpenShift in order to allow the GitLab — RHDH integration. All resources are created in the rhdh-operator namespace for this example.

Create the next backstage-dynamic-plugins ConfigMap in order to enable the GitLab plugins —

kind: ConfigMap
apiVersion: v1
metadata:
  name: backstage-dynamic-plugins
  namespace: rhdh-operator
data:
  dynamic-plugins.yaml: |
    includes:
    - dynamic-plugins.default.yaml
    plugins:
    - disabled: false
      package: ./dynamic-plugins/dist/immobiliarelabs-backstage-plugin-gitlab-backend-dynamic
    - disabled: false
      package: ./dynamic-plugins/dist/immobiliarelabs-backstage-plugin-gitlab
    - disabled: false
      package: ./dynamic-plugins/dist/backstage-plugin-catalog-backend-module-gitlab-dynamic
    - disabled: false
      package: ./dynamic-plugins/dist/backstage-plugin-scaffolder-backend-module-gitlab-dynamic
    - disabled: false
      package: ./dynamic-plugins/dist/backstage-plugin-catalog-backend-module-gitlab-org-dynamic

Set the next environment variables in the backstage-envs-developer-hub Secret -

The environment variables description -

GITLAB_CLIENT — The GitLab client created for the GitLab application.
GITLAB_HOST — The GitLab hostname (without an https:// prefix).
GITLAB_SECRET — The GitLab client secret created for the GitLab application.
GITLAB_TOKEN — The personal access token that will be used by RHDH to access GitLab’s API.
RHDH_HOSTNAME — The RHDH hostname. It can be obtained by accessing the route created for RHDH in the operator’s namespace (without an https:// prefix).

Next, apply the rhdh-custom-appconfig Configmap in order to set the configuration for RHDH —

kind: ConfigMap
apiVersion: v1
metadata:
  name: rhdh-custom-appconfig
  namespace: rhdh-operator
data:
  app-config.yaml: |
    app:
      baseUrl: https://${RHDH_HOSTNAME}
    signInPage: gitlab
    catalog:
      providers:
        gitlab:
          gitlabProvider:
            host: ${GITLAB_HOST}
            orgEnabled: true
            rules:
              - allow: [Group, User]
            schedule:
              frequency: { seconds: 60 }
              timeout: { seconds: 60 }
    auth:
      environment: production
      providers:
        gitlab:
          production:
            clientId: ${GITLAB_CLIENT}
            clientSecret: ${GITLAB_SECRET}
            audience: https://${GITLAB_HOST}
            callbackUrl: https://${RHDH_HOSTNAME}/api/auth/gitlab/handler/frame
            signIn:
              resolvers:
                - resolver: usernameMatchingUserEntityName
    integrations:
      gitlab:
      - apiBaseUrl: https://${GITLAB_HOST}/api/v4
        baseUrl: https://${GITLAB_HOST}
        host: ${GITLAB_HOST}
        token: ${GITLAB_TOKEN}
    backend:
      baseUrl: https://${RHDH_HOSTNAME}
      cors:
        origin: https://${RHDH_HOSTNAME}

Configure the RHDH instance to use the created above ConfigMaps —

apiVersion: rhdh.redhat.com/v1alpha3
kind: Backstage
metadata:
  labels:
    app.kubernetes.io/name: backstage
  name: developer-hub
  namespace: rhdh-operator
spec:
  application:
    appConfig:
      configMaps:
        - name: rhdh-custom-appconfig
      mountPath: /opt/app-root/src
    dynamicPluginsConfigMapName: backstage-dynamic-plugins
    extraFiles:
      mountPath: /opt/app-root/src
    replicas: 1
    route:
      enabled: true
  database:
    enableLocalDb: true

After applying the configuration, make sure that users from GitLab are synchronized successfully into RHDH. The next log should appear in the Backstage pod -

{"class":"GitlabOrgDiscoveryEntityProvider","level":"\u001b[32minfo\u001b[39m","message":"Scanned 6 users and processed 6 users","plugin":"catalog","service":"backstage","span_id":"610cdb5c7a6a64de","target":"GitlabOrgDiscoveryEntityProvider:gitlabProvider","taskId":"GitlabOrgDiscoveryEntityProvider:gitlabProvider:refresh","taskInstanceId":"5fbff334-c46f-4fd5-9e1a-e233287bea3f","timestamp":"2025-08-18 09:53:24","trace_flags":"01","trace_id":"4de216ad5a8572da6d244af4ee8a6db2"}
{"class":"GitlabOrgDiscoveryEntityProvider","level":"\u001b[32minfo\u001b[39m","message":"Scanned 5 groups and processed 5 groups","plugin":"catalog","service":"backstage","span_id":"610cdb5c7a6a64de","target":"GitlabOrgDiscoveryEntityProvider:gitlabProvider","taskId":"GitlabOrgDiscoveryEntityProvider:gitlabProvider:refresh","taskInstanceId":"5fbff334-c46f-4fd5-9e1a-e233287bea3f","timestamp":"2025-08-18 09:53:24","trace_flags":"01","trace_id":"4de216ad5a8572da6d244af4ee8a6db2"}

The Result

After everything is configured, navigate to the RHDH instance and follow the authentication instructions -

User page in RHDH (see synced group membership at Ownership Entities)

Conclusion

In this blog you configured GitLab as an identity provider for RHDH. The platform can now be used to test your components, plugins and templates! Please follow the official documentation for additional configurations and integrations for RHDH.