Gitlab Server - how to remove or not expose the url .well-known/openid-configuration?

Question

I have a gitlab server hosted on-prem, using the CE version. Recently, our security team requested us to not to expose the url /.well-known/openid-configuration. My question is how do I block this url or how should I configure gitlab so that this url is not exposed?

Answer 1

GitLab uses NGINX and provides a way to add custom settings in /etc/gitlab/gitlab.rb.

Maybe, adding something like this:

nginx['custom_gitlab_server_config'] = "location ^~ /.well-known/openid-configuration {\n deny all;\n}\n"

Then, reconfigure gitlab:

sudo gitlab-ctl reconfigure

See https://docs.gitlab.com/omnibus/settings/nginx.html#inserting-custom-nginx-settings-into-the-gitlab-server-block