Commit 02cc978e authored by Drew Blessing's avatar Drew Blessing

Merge branch 'ldap_block_when_missing' into 'master'

Block LDAP user when they are no longer found in the LDAP server

Currently, if a user is deleted from LDAP the `Gitlab::Ldap::Access.allowed?` method will return `false`, but the user will not be blocked. This means that the user would be able to continue using GitLab if they are already logged in, or when performing Git over SSH operations.

After this change, users will be blocked when they no longer exist in LDAP. There is still a one hour LDAP check cache time in effect, so the change is not immediate. This is noted in the documentation.

cc/ @DouweM @dzaporozhets 

See merge request !2022
parents e99ca657 bf5683f8
......@@ -23,6 +23,7 @@ v 8.3.0 (unreleased)
- Run custom Git hooks when branch is created or deleted.
- Fix bug when simultaneously accepting multiple MRs results in MRs that are of "merged" status, but not merged to the target branch
- Add languages page to graphs
- Block LDAP user when they are no longer found in the LDAP server
v 8.2.3
- Fix application settings cache not expiring after changes (Stan Hu)
......
......@@ -13,6 +13,12 @@ An LDAP user who is allowed to change their email on the LDAP server can [take o
We recommend against using GitLab LDAP integration if your LDAP users are allowed to change their 'mail', 'email' or 'userPrincipalName' attribute on the LDAP server.
If a user is deleted from the LDAP server, they will be blocked in GitLab as well.
Users will be immediately blocked from logging in. However, there is an LDAP check
cache time of one hour. The means users that are already logged in or are using Git
over SSH will still be able to access GitLab for up to one hour. Manually block
the user in the GitLab Admin area to immediately block all access.
## Configuring GitLab for LDAP integration
To enable GitLab LDAP integration you need to add your LDAP server settings in `/etc/gitlab/gitlab.rb` or `/home/git/gitlab/config/gitlab.yml`.
......
......@@ -37,13 +37,15 @@ module Gitlab
# Block user in GitLab if he/she was blocked in AD
if Gitlab::LDAP::Person.disabled_via_active_directory?(user.ldap_identity.extern_uid, adapter)
user.block unless user.blocked?
user.block
false
else
user.activate if user.blocked? && !ldap_config.block_auto_created_users
true
end
else
# Block the user if they no longer exist in LDAP/AD
user.block
false
end
rescue
......
......@@ -13,6 +13,11 @@ describe Gitlab::LDAP::Access do
end
it { is_expected.to be_falsey }
it 'should block user in GitLab' do
access.allowed?
expect(user).to be_blocked
end
end
context 'when the user is found' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment