- Password authentication enabled
- Admin Mode
- Enable or disable Admin Mode
- Two-factor authentication
- Email notification for unknown sign-ins
- Sign-in information
You can use Sign-in restrictions to customize authentication restrictions for web interfaces as well as Git over HTTP(S).
To access sign-in restriction settings:
- Navigate to the Admin Area > Settings > General.
- Expand the Sign-in restrictions section.
You can restrict the password authentication for web interface and Git over HTTP(S):
- Web interface: When this feature is disabled, an external authentication provider must be used.
- Git over HTTP(S): When this feature is disabled, a Personal Access Token must be used to authenticate.
When this feature is enabled, instance administrators are limited as regular users. During that period, they do not have access to all projects, groups, or the Admin Area menu.
To access potentially dangerous resources, an administrator can activate Admin Mode by:
- Selecting the Enable Admin Mode button
- Trying to access any part of the UI that requires an administrator role, specifically those which call
The main use case allows administrators to perform their regular tasks as a regular user, based on their memberships, without having to set up a second account for security reasons.
When Admin Mode status is disabled, administrative users cannot access resources unless
they’ve been explicitly granted access. For example, when Admin Mode is disabled, they
404 error if they try to open a private group or project, unless
they are members of that group or project.
2FA should be enabled for administrators and is supported for the Admin Mode flow, as are OmniAuth providers and LDAP auth. The Admin Mode status is stored in the active user session and remains active until it is explicitly disabled (it will be disabled automatically after a timeout otherwise).
The following access methods are not protected by Admin Mode:
- Git client access (SSH using public keys or HTTPS using Personal Access Tokens).
- API access using a Personal Access Token.
In other words, administrators who are otherwise limited by Admin Mode can still use Git clients, and access RESTful API endpoints as administrators, without additional authentication steps.
We may address these limitations in the future. For more information see the following epic: Admin mode for GitLab Administrators.
If necessary, you can disable Admin Mode as an administrator by using one of these two methods:
curl --request PUT --header "PRIVATE-TOKEN:$ADMIN_TOKEN" "<gitlab-url>/api/v4/application/settings?admin_mode=false"
Admin Mode is under development and not ready for production use. It is deployed behind a feature flag that is disabled by default. GitLab administrators with access to the GitLab Rails console can enable it.
To enable it:
To disable it:
When this feature is enabled, all users must use the two-factor authentication.
After the two-factor authentication is configured as mandatory, users are allowed to skip forced configuration of two-factor authentication for the configurable grace period in hours.
Introduced in GitLab 13.2.
When enabled, GitLab notifies users of sign-ins from unknown IP addresses or devices. For more information, see Email notification for unknown sign-ins.
All users that are not logged in are redirected to the page represented by the configured Home page URL if value is not empty.
All users are redirected to the page represented by the configured After sign out path after sign out if value is not empty.
In the Sign-in restrictions section, scroll to the Sign-in text field. You can add a custom message for your users in Markdown format.
For example, if you include the following information in the noted text box:
# Custom sign-in text To access this text box, navigate to Admin Area > Settings > General, and expand the "Sign-in restrictions" section.
Your users see the Custom sign-in text when they navigate to the sign-in screen for your GitLab instance: