Gitlab and GCM with SSO

[clarkje]

I have an existing gitlab.com organization using a mix of PAT and SSH for developer access.

SSO with Entra as the IdP is already enabled and enforced for access to the web UI. I'd like to eliminate all long-lived tokens by migrating people to GCM and OAUTH2, but I need to do that in a gradual, low-risk way.

I'm stuck in this catch-22, and I'm wondering if I'm missing something:

• We're using an enterprise account on gitlab.com, not self-hosted gitlab
• Directing users to gitlab.com/myorg/ presents users with the SSO authentication flow
• When users are directed to gitlab.com/user/sign_in (the browser flow for built-in Gitlab support) they don't get an SSO option, it's effectively a dead-end
• I can probably evoke the correct redirect from Gitlab by forcing SSO on for all users, but that's not palatable

If I could override GitLabOauth2Client.OAuth2ServerEndpoints.authEndpoint from the local config, I think I'd be sweet. I'm primarily just wondering if I'm missing something.