@@ -151,15 +151,25 @@ The group management in keycloak is using a tree. If you create a group named ad
151151
152152### GitLab Auth Provider
153153
154−Whether you are using GitLab.com or self-hosting GitLab, follow [these steps to add an application](https://docs.gitlab.com/ce/integration/oauth_provider.html). Make sure to enable at least the `openid`, `profile` and `email` scopes.
154+Whether you are using GitLab.com or self-hosting GitLab, follow [these steps to add an application](https://docs.gitlab.com/ce/integration/oauth_provider.html). Make sure to enable at least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.
155155
156+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow [these steps](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/docs/configuration/configuration.md#configuration)
157+
158+```
159+ --provider="gitlab"
160+ --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
161+ --client-id=GITLAB_CLIENT_ID
162+ --client-secret=GITLAB_CLIENT_SECRET
163+ --cookie-secret=COOKIE_SECRET
164+```
165+
156166Restricting by group membership is possible with the following option:
157167
158− -gitlab-group="": restrict logins to members of any of these groups (slug), separated by a comma
168+ --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma
159169
160170If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
161171
162− -oidc-issuer-url="<your gitlab url>"
172+ --oidc-issuer-url="<your gitlab url>"
163173
164174### LinkedIn Auth Provider
165175