Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Boxiang Sun
gitlab-ce
Commits
dd3e7ff0
Commit
dd3e7ff0
authored
7 years ago
by
Michael Kozono
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Default LDAP config verify_certificates to true
parent
cbaa015c
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
13 additions
and
18 deletions
+13
-18
config/gitlab.yml.example
config/gitlab.yml.example
+2
-3
config/initializers/1_settings.rb
config/initializers/1_settings.rb
+5
-12
doc/administration/auth/ldap.md
doc/administration/auth/ldap.md
+6
-3
No files found.
config/gitlab.yml.example
View file @
dd3e7ff0
...
...
@@ -273,9 +273,8 @@ production: &base
encryption: 'plain'
# Enables SSL certificate verification if encryption method is
# "start_tls" or "simple_tls". (Defaults to false for backward-
# compatibility)
verify_certificates: false
# "start_tls" or "simple_tls". Defaults to true.
verify_certificates: true
# Specifies the path to a file containing a PEM-format CA certificate,
# e.g. if you need to use an internal CA.
...
...
This diff is collapsed.
Click to expand it.
config/initializers/1_settings.rb
View file @
dd3e7ff0
...
...
@@ -155,18 +155,11 @@ if Settings.ldap['enabled'] || Rails.env.test?
server
[
'encryption'
]
=
'simple_tls'
if
server
[
'encryption'
]
==
'ssl'
server
[
'encryption'
]
=
'start_tls'
if
server
[
'encryption'
]
==
'tls'
# Certificates are not verified for backwards compatibility.
# This default should be flipped to true in 9.5.
if
server
[
'verify_certificates'
].
nil?
server
[
'verify_certificates'
]
=
false
message
=
<<-
MSG
.
strip_heredoc
LDAP SSL certificate verification is disabled for backwards-compatibility.
Please add the "verify_certificates" option to gitlab.yml for each LDAP
server. Certificate verification will be enabled by default in GitLab 9.5.
MSG
Rails
.
logger
.
warn
(
message
)
end
# Certificate verification was added in 9.4.2, and defaulted to false for
# backwards-compatibility.
#
# Since GitLab 10.0, verify_certificates defaults to true for security.
server
[
'verify_certificates'
]
=
true
if
server
[
'verify_certificates'
].
nil?
Settings
.
ldap
[
'servers'
][
key
]
=
server
end
...
...
This diff is collapsed.
Click to expand it.
doc/administration/auth/ldap.md
View file @
dd3e7ff0
...
...
@@ -87,9 +87,12 @@ main: # 'main' is the GitLab 'provider ID' of this LDAP server
encryption: 'plain'
# Enables SSL certificate verification if encryption method is
# "start_tls" or "simple_tls". (Defaults to false for backward-
# compatibility)
verify_certificates: false
# "start_tls" or "simple_tls". Defaults to true since GitLab 10.0 for
# security. This may break installations upon upgrade to 10.0, that did
# not know their LDAP SSL certificates were not setup properly. For
# example, when using self-signed certificates, the ca_file path may
# need to be specified.
verify_certificates: true
# Specifies the path to a file containing a PEM-format CA certificate,
# e.g. if you need to use an internal CA.
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment