Add GitLab CI/CD support to Connect-PnPOnline -FederatedIdentity

[fabianhutzli]

Type

• Bug Fix
• New Feature
• Sample

Summary

Extends Connect-PnPOnline -FederatedIdentity to support GitLab CI/CD pipelines, alongside the existing GitHub Actions and Azure DevOps support. This lets users authenticate to SharePoint/Microsoft Graph from a GitLab pipeline using GitLab's OIDC id_tokens feature and a federated credential trust on the Entra ID app registration, without needing to store a client secret or certificate in GitLab.

Modified cmdlets

• Connect-PnPOnline — no parameter changes. The existing -FederatedIdentity switch parameter set now also recognizes a GitLab CI/CD context. As with GitHub Actions, -ClientId and -Tenant must be supplied explicitly (GitLab has no equivalent of Azure DevOps' service-connection auto-lookup).

Implementation notes

• TokenHandler.GetFederatedIdentityTokenAsync gains a third detection branch, alongside the existing GitHub Actions (ACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKEN) and Azure DevOps (SYSTEM_OIDCREQUESTURI) branches. GitLab CI is detected via the GITLAB_CI environment variable combined with the presence of GITLAB_OIDC_TOKEN.
• Unlike GitHub Actions and Azure DevOps, no HTTP round-trip is required to obtain GitLab's own OIDC token: GitLab's id_tokens pipeline feature mints the JWT directly into the configured job variable at job start. The pipeline must define it under that exact name:

  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: api://AzureADTokenExchange

• Documentation included
• Developed with AI assistance
• Tested in GitLab CI

[gautamdsheth]

Thanks @fabianhutzli , awesome stuff . It has been merged , much appreciated !!