Merge branch 'ee_adapter_mixin' into 'master'

Move most of the EE-specific LDAP code to EE-specific classes/modules

This will prevent or reduce merge errors. This doesn't include *all* of the EE-specific LDAP code, but it's the low-hanging fruit. I will get the less-straightforward stuff in a subsequent merge request to avoid making this one unbearably large. 

## Why is this necessary?

I'm starting work on some of the priority LDAP features/fixes. I was about to start stuffing additional EE-specific methods into `Gitlab::LDAP::Adapter` and it felt like this could be a CE-EE merge danger zone. This seemed like a potentially quick fix to that worry so I thought I'd take a moment to see if it was sane. 

@DouweM and I talked briefly about this. It seems to be the way we want to go in the future anyway so this gets the ball rolling. 

If this goes through and everyone is happy, I'll also create a subsequent merge request to add some development docs about organizing EE code. 

FYI @vsizov @jacobvosmaer-gitlab 

See merge request !511

CHANGELOG-EE

@@ -3,6 +3,7 @@ Please view this file on the master branch, on stable branches it's out of date.
 v 8.10.0 (unreleased)
   - Rename Git Hooks to Push Rules
   - Fix EE keys fingerprint add index migration if came from CE
+  - Isolate EE LDAP library code in EE module (Part 1) !511
 
 v 8.9.5
   - Fix of quoted text in lock tooltip. !518

app/workers/ldap_group_sync_worker.rb

@@ -5,7 +5,7 @@ class LdapGroupSyncWorker
 
   def perform
     logger.info 'Started LDAP group sync'
-    Gitlab::LDAP::GroupSync.execute
+    EE::Gitlab::LDAP::GroupSync.execute
     logger.info 'Finished LDAP group sync'
   end
 end

lib/ee/gitlab/ldap/access_levels.rb

+module EE
+  module Gitlab
+    module LDAP
+      # Create a hash map of member DNs to access levels. The highest
+      # access level is retained in cases where `set` is called multiple times
+      # for the same DN.
+      class AccessLevels < Hash
+        def set(dns, to:)
+          dns.each do |dn|
+            current = self[dn]
+
+            # Keep the higher of the access values.
+            self[dn] = to if current.nil? || to > current
+          end
+        end
+      end
+    end
+  end
+end

lib/ee/gitlab/ldap/adapter.rb

+# LDAP connection adapter EE mixin
+#
+# This module is intended to encapsulate EE-specific adapter methods
+# and be included in the `Gitlab::LDAP::Adapter` class.
+module EE
+  module Gitlab
+    module LDAP
+      module Adapter
+        # Get LDAP groups from ou=Groups
+        #
+        # cn - filter groups by name
+        #
+        # Ex.
+        #   groups("dev*") # return all groups start with 'dev'
+        #
+        def groups(cn = "*", size = nil)
+          options = {
+            base: config.group_base,
+            filter: Net::LDAP::Filter.eq("cn", cn)
+          }
+
+          options.merge!(size: size) if size
+
+          ldap_search(options).map do |entry|
+            Group.new(entry, self)
+          end
+        end
+
+        def group(*args)
+          groups(*args).first
+        end
+
+        def dn_matches_filter?(dn, filter)
+          ldap_search(
+            base: dn,
+            filter: filter,
+            scope: Net::LDAP::SearchScope_BaseObject,
+            attributes: %w{dn}
+          ).any?
+        end
+      end
+    end
+  end
+end

lib/ee/gitlab/ldap/group.rb

+module EE
+  module Gitlab
+    module LDAP
+      class Group
+        attr_accessor :adapter
+
+        def self.find_by_cn(cn, adapter)
+          cn = Net::LDAP::Filter.escape(cn)
+          adapter.group(cn)
+        end
+
+        def initialize(entry, adapter=nil)
+          Rails.logger.debug { "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}" }
+          @entry = entry
+          @adapter = adapter
+        end
+
+        def active_directory?
+          adapter.config.active_directory
+        end
+
+        def cn
+          entry.cn.first
+        end
+
+        def name
+          cn
+        end
+
+        def path
+          name.parameterize
+        end
+
+        def memberuid?
+          entry.respond_to? :memberuid
+        end
+
+        def member_uids
+          entry.memberuid
+        end
+
+        def member_dns
+          dns = []
+
+          # There's an edge-case with AD where sometimes a recursive search
+          # doesn't return all users at the top-level. Concat recursive results
+          # with regular results to be safe. See gitlab-ee#484
+          if active_directory?
+            dns = adapter.dns_for_filter(active_directory_recursive_memberof_filter)
+          end
+
+          if (entry.respond_to? :member) && (entry.respond_to? :submember)
+            dns.concat(entry.member + entry.submember)
+          elsif entry.respond_to? :member
+            dns.concat(entry.member)
+          elsif entry.respond_to? :uniquemember
+            dns.concat(entry.uniquemember)
+          elsif entry.respond_to? :memberof
+            dns.concat(entry.memberof)
+          else
+            Rails.logger.warn("Could not find member DNs for LDAP group #{entry.inspect}")
+          end
+          dns.uniq
+        end
+
+        private
+
+        # We use the ActiveDirectory LDAP_MATCHING_RULE_IN_CHAIN matching rule; see
+        # http://msdn.microsoft.com/en-us/library/aa746475%28VS.85%29.aspx#code-snippet-5
+        def active_directory_recursive_memberof_filter
+          Net::LDAP::Filter.ex("memberOf:1.2.840.113556.1.4.1941", entry.dn)
+        end
+
+        def entry
+          @entry
+        end
+      end
+    end
+  end
+end

lib/ee/gitlab/ldap/group_sync.rb

+require 'net/ldap/dn'
+
+module EE
+  module Gitlab
+    module LDAP
+      class GroupSync
+        attr_reader :provider
+
+        # Open a connection so we can run all queries through it.
+        # It's more efficient than the default of opening/closing per LDAP query.
+        def self.open(provider, &block)
+          ::Gitlab::LDAP::Adapter.open(provider) do |adapter|
+            block.call(self.new(provider, adapter))
+          end
+        end
+
+        def self.execute
+          # Shuffle providers to prevent a scenario where sync fails after a time
+          # and only the first provider or two get synced. This shuffles the order
+          # so subsequent syncs should eventually get to all providers. Obviously
+          # we should avoid failure, but this is an additional safeguard.
+          ::Gitlab::LDAP::Config.providers.shuffle.each do |provider|
+            self.open(provider) do |group_sync|
+              group_sync.update_permissions
+            end
+          end
+
+          true
+        end
+
+        def initialize(provider, adapter = nil)
+          @adapter = adapter
+          @provider = provider
+        end
+
+        def update_permissions
+          if group_base.present?
+            logger.debug { "Performing LDAP group sync for '#{provider}' provider" }
+            sync_groups
+            logger.debug { "Finished LDAP group sync for '#{provider}' provider" }
+          else
+            logger.debug { "No `group_base` configured for '#{provider}' provider. Skipping" }
+          end
+
+          if admin_group.present?
+            logger.debug { "Syncing admin users for '#{provider}' provider" }
+            sync_admin_users
+            logger.debug { "Finished syncing admin users for '#{provider}' provider" }
+          else
+            logger.debug { "No `admin_group` configured for '#{provider}' provider. Skipping" }
+          end
+
+          if external_groups.empty?
+            logger.debug { "No `external_groups` configured for '#{provider}' provider. Skipping" }
+          else
+            logger.debug { "Syncing external users for '#{provider}' provider" }
+            sync_external_users
+            logger.debug { "Finished syncing external users for '#{provider}' provider" }
+          end
+
+          nil
+        end
+
+        # Iterate of all GitLab groups with LDAP links. Build an access hash
+        # representing a user's highest access level among the LDAP links within
+        # the same GitLab group.
+        def sync_groups
+          # Order results by last_ldap_sync_at ASC so groups with older last
+          # sync time are handled first
+          groups_where_group_links_with_provider_ordered.each do |group|
+            lease = ::Gitlab::ExclusiveLease.new(
+              "ldap_group_sync:#{provider}:#{group.id}",
+              timeout: 3600
+            )
+            next unless lease.try_obtain
+
+            logger.debug { "Syncing '#{group.name}' group" }
+
+            access_levels = AccessLevels.new
+            # Only iterate over group links for the current provider
+            group.ldap_group_links.with_provider(provider).each do |group_link|
+              if member_dns = dns_for_group_cn(group_link.cn)
+                access_levels.set(member_dns, to: group_link.group_access)
+                logger.debug do
+                  "Resolved '#{group.name}' group member access: #{access_levels.to_hash}"
+                end
+              end
+            end
+
+            update_existing_group_membership(group, access_levels)
+            add_new_members(group, access_levels)
+
+            group.update(last_ldap_sync_at: Time.now)
+
+            logger.debug { "Finished syncing '#{group.name}' group" }
+          end
+        end
+
+        # Update global administrators based on the specified admin group CN
+        def sync_admin_users
+          admin_group_member_dns = dns_for_group_cn(admin_group)
+          current_admin_users = ::User.admins.with_provider(provider)
+          verified_admin_users = []
+
+          # Verify existing admin users and add new ones.
+          admin_group_member_dns.each do |member_dn|
+            user = ::Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
+
+            if user.present?
+              user.admin = true
+              user.save
+              verified_admin_users << user
+            else
+              logger.debug do
+                <<-MSG.strip_heredoc.tr("\n", ' ')
+                  #{self.class.name}: User with DN `#{member_dn}` should have admin
+                  access but there is no user in GitLab with that identity.
+                  Membership will be updated once the user signs in for the first time.
+                MSG
+              end
+            end
+          end
+
+          # Revoke the unverified admins.
+          current_admin_users.each do |user|
+            unless verified_admin_users.include?(user)
+              user.admin = false
+              user.save
+            end
+          end
+        end
+
+        # Update external users based on the specified external groups CN
+        def sync_external_users
+          current_external_users = ::User.external.with_provider(provider)
+          verified_external_users = []
+
+          external_groups.each do |group|
+            group_dns = dns_for_group_cn(group)
+
+            group_dns.each do |member_dn|
+              user = ::Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
+
+              if user.present?
+                user.external = true
+                user.save
+                verified_external_users << user
+              else
+                logger.debug do
+                  <<-MSG.strip_heredoc.tr("\n", ' ')
+                    #{self.class.name}: User with DN `#{member_dn}` should be marked as
+                    external but there is no user in GitLab with that identity.
+                    Membership will be updated once the user signs in for the first time.
+                  MSG
+                end
+              end
+            end
+          end
+
+          update_external_permissions(current_external_users, verified_external_users)
+        end
+
+        private
+
+        # Cache LDAP group member DNs so we don't query LDAP groups more than once.
+        def dns_for_group_cn(group_cn)
+          @dns_for_group_cn ||= Hash.new { |h, k| h[k] = ldap_group_member_dns(k) }
+          @dns_for_group_cn[group_cn]
+        end
+
+        # Cache user DN so we don't generate excess queries to map UID to DN
+        def dn_for_uid(uid)
+          @dn_for_uid ||= Hash.new { |h, k| h[k] = member_uid_to_dn(k) }
+          @dn_for_uid[uid]
+        end
+
+        def adapter
+          @adapter ||= ::Gitlab::LDAP::Adapter.new(provider)
+        end
+
+        def config
+          @config ||= ::Gitlab::LDAP::Config.new(provider)
+        end
+
+        def group_base
+          config.group_base
+        end
+
+        def admin_group
+          config.admin_group
+        end
+
+        def external_groups
+          config.external_groups
+        end
+
+        def ldap_group_member_dns(ldap_group_cn)
+          ldap_group = Group.find_by_cn(ldap_group_cn, adapter)
+          unless ldap_group.present?
+            logger.warn { "Cannot find LDAP group with CN '#{ldap_group_cn}'. Skipping" }
+            return []
+          end
+
+          member_dns = ldap_group.member_dns
+          if member_dns.empty?
+            # Group must be empty
+            return [] unless ldap_group.memberuid?
+
+            members = ldap_group.member_uids
+            member_dns = members.map { |uid| dn_for_uid(uid) }
+          end
+          ensure_full_dns!(member_dns)
+
+          logger.debug { "Members in '#{ldap_group.name}' LDAP group: #{member_dns}" }
+
+          # Various lookups in this method could return `nil` values.
+          # Compact the array to remove those entries
+          member_dns.compact
+        end
+
+        # At least one customer reported that their LDAP `member` values contain
+        # only `uid=username` and not the full DN. This method allows us to
+        # account for that. See gitlab-ee#442
+        def ensure_full_dns!(dns)
+          dns.map! do |dn|
+            begin
+              parsed_dn = Net::LDAP::DN.new(dn).to_a
+            rescue RuntimeError => e
+              # Net::LDAP raises a generic RuntimeError. Bad library! Bad!
+              logger.error { "Found malformed DN: '#{dn}'. Skipping. #{e.message}" }
+              next
+            end
+
+            # If there is more than one key/value set we must have a full DN,
+            # or at least the probability is higher.
+            if parsed_dn.count > 2
+              dn
+            elsif parsed_dn[0] == 'uid'
+              dn_for_uid(parsed_dn[1])
+            else
+              logger.warn { "Found potentially malformed/incomplete DN: '#{dn}'" }
+              dn
+            end
+          end
+
+          # Remove `nil` values generated by the rescue above.
+          dns.compact!
+        end
+
+        def member_uid_to_dn(uid)
+          identity = Identity.find_by(provider: provider, secondary_extern_uid: uid)
+
+          if identity.present?
+            # Use the DN on record in GitLab when it's available
+            identity.extern_uid
+          else
+            ldap_user = ::Gitlab::LDAP::Person.find_by_uid(uid, adapter)
+
+            # Can't find a matching user for group entry
+            return nil unless ldap_user.present?
+
+            # Update user identity so we don't have to go through this again
+            update_identity(ldap_user.dn, uid)
+
+            ldap_user.dn
+          end
+        end
+
+        def update_identity(dn, uid)
+          identity =
+            Identity.find_by(provider: provider, extern_uid: dn)
+
+          # User may not exist in GitLab yet. Skip.
+          return unless identity.present?
+
+          identity.secondary_extern_uid = uid
+          identity.save
+        end
+
+        def update_existing_group_membership(group, access_levels)
+          logger.debug { "Updating existing membership for '#{group.name}' group" }
+
+          select_and_preload_group_members(group).each do |member|
+            user = member.user
+            identity = user.identities.select(:id, :extern_uid)
+                         .with_provider(provider).first
+            member_dn = identity.extern_uid
+
+            # Skip if this is not an LDAP user with a valid `extern_uid`.
+            next unless member_dn.present?
+
+            # Prevent shifting group membership, in case where user is a member
+            # of two LDAP groups from different providers linked to the same
+            # GitLab group. This is not ideal, but preserves existing behavior.
+            if user.ldap_identity.id != identity.id
+              access_levels.delete(member_dn)
+              next
+            end
+
+            desired_access = access_levels[member_dn]
+
+            # Don't do anything if the user already has the desired access level
+            if member.access_level == desired_access
+              access_levels.delete(member_dn)
+              next
+            end
+
+            # Check and update the access level. If `desired_access` is `nil`
+            # we need to delete the user from the group.
+            if desired_access.present?
+              add_or_update_user_membership(user, group, desired_access)
+
+              # Delete this entry from the hash now that we've acted on it
+              access_levels.delete(member_dn)
+            elsif group.last_owner?(user)
+              warn_cannot_remove_last_owner(user, group)
+            else
+              group.users.delete(user)
+            end
+          end
+        end
+
+        def update_external_permissions(users, verified)
+          # Restore normal access to users no longer found in the external groups
+          users.each do |user|
+            unless verified.include?(user)
+              user.external = false
+              user.save
+            end
+          end
+        end
+
+        def add_new_members(group, access_levels)
+          logger.debug { "Adding new members to '#{group.name}' group" }
+
+          access_levels.each do |member_dn, access_level|
+            user = ::Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
+
+            if user.present?
+              add_or_update_user_membership(user, group, access_level)
+            else
+              logger.debug do
+                <<-MSG.strip_heredoc.tr("\n", ' ')
+                  #{self.class.name}: User with DN `#{member_dn}` should have access
+                  to '#{group.name}' group but there is no user in GitLab with that
+                  identity. Membership will be updated once the user signs in for
+                  the first time.
+                MSG
+              end
+            end
+          end
+        end
+
+        def add_or_update_user_membership(user, group, access)
+          # Prevent the last owner of a group from being demoted
+          if access < ::Gitlab::Access::OWNER && group.last_owner?(user)
+            warn_cannot_remove_last_owner(user, group)
+          else
+            # If you pass the user object, instead of just user ID,
+            # it saves an extra user database query.
+            group.add_users([user], access, skip_notification: true)
+          end
+        end
+
+        def warn_cannot_remove_last_owner(user, group)
+          logger.warn do
+            <<-MSG.strip_heredoc.tr("\n", ' ')
+              #{self.class.name}: LDAP group sync cannot remove #{user.name}
+              (#{user.id}) from group #{group.name} (#{group.id}) as this is
+              the group's last owner
+            MSG
+          end
+        end
+
+        def select_and_preload_group_members(group)
+          group.members.select_access_level_and_user
+            .with_identity_provider(provider).preload(:user)
+        end
+
+        def groups_where_group_links_with_provider_ordered
+          ::Group.where_group_links_with_provider(provider)
+            .preload(:ldap_group_links)
+            .reorder('last_ldap_sync_at ASC, namespaces.id ASC')
+            .distinct
+        end
+
+        def logger
+          Rails.logger
+        end
+      end
+    end
+  end
+end

lib/gitlab/ldap/access_levels.rb

-module Gitlab
-  module LDAP
-    # Create a hash map of member DNs to access levels. The highest
-    # access level is retained in cases where `set` is called multiple times
-    # for the same DN.
-    class AccessLevels < Hash
-      def set(dns, to:)
-        dns.each do |dn|
-          current = self[dn]
-
-          # Keep the higher of the access values.
-          self[dn] = to if current.nil? || to > current
-        end
-      end
-    end
-  end
-end

lib/gitlab/ldap/adapter.rb

+# LDAP connection adapter
+#
+# Contains methods common to both GitLab CE and EE.
+# All EE methods should be in `EE::Gitlab::LDAP::Adapter` only.
 module Gitlab
   module LDAP
     class Adapter
+      include EE::Gitlab::LDAP::Adapter
+
       attr_reader :provider, :ldap
 
       def self.open(provider, &block)
@@ -22,30 +28,6 @@ module Gitlab
         Gitlab::LDAP::Config.new(provider)
       end
 
-      # Get LDAP groups from ou=Groups
-      #
-      # cn - filter groups by name
-      #
-      # Ex.
-      #   groups("dev*") # return all groups start with 'dev'
-      #
-      def groups(cn = "*", size = nil)
-        options = {
-          base: config.group_base,
-          filter: Net::LDAP::Filter.eq("cn", cn)
-        }
-
-        options.merge!(size: size) if size
-
-        ldap_search(options).map do |entry|
-          Gitlab::LDAP::Group.new(entry, self)
-        end
-      end
-
-      def group(*args)
-        groups(*args).first
-      end
-
       def users(field, value, limit = nil)
         if field.to_sym == :dn
           options = {
@@ -86,13 +68,6 @@ module Gitlab
         users(*args).first
       end
 
-      def dn_matches_filter?(dn, filter)
-        ldap_search(base: dn,
-                    filter: filter,
-                    scope: Net::LDAP::SearchScope_BaseObject,
-                    attributes: %w{dn}).any?
-      end
-
       def dns_for_filter(filter)
         ldap_search(
           base: config.base,

lib/gitlab/ldap/group.rb

-module Gitlab
-  module LDAP
-    class Group
-      attr_accessor :adapter
-
-      def self.find_by_cn(cn, adapter)
-        cn = Net::LDAP::Filter.escape(cn)
-        adapter.group(cn)
-      end
-
-      def initialize(entry, adapter=nil)
-        Rails.logger.debug { "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}" }
-        @entry = entry
-        @adapter = adapter
-      end
-
-      def active_directory?
-        adapter.config.active_directory
-      end
-
-      def cn
-        entry.cn.first
-      end
-
-      def name
-        cn
-      end
-
-      def path
-        name.parameterize
-      end
-
-      def memberuid?
-        entry.respond_to? :memberuid
-      end
-
-      def member_uids
-        entry.memberuid
-      end
-
-      def member_dns
-        dns = []
-
-        # There's an edge-case with AD where sometimes a recursive search
-        # doesn't return all users at the top-level. Concat recursive results
-        # with regular results to be safe. See gitlab-ee#484
-        if active_directory?
-          dns = adapter.dns_for_filter(active_directory_recursive_memberof_filter)
-        end
-
-        if (entry.respond_to? :member) && (entry.respond_to? :submember)
-          dns.concat(entry.member + entry.submember)
-        elsif entry.respond_to? :member
-          dns.concat(entry.member)
-        elsif entry.respond_to? :uniquemember
-          dns.concat(entry.uniquemember)
-        elsif entry.respond_to? :memberof
-          dns.concat(entry.memberof)
-        else
-          Rails.logger.warn("Could not find member DNs for LDAP group #{entry.inspect}")
-        end
-        dns.uniq
-      end
-
-      private
-
-      # We use the ActiveDirectory LDAP_MATCHING_RULE_IN_CHAIN matching rule; see
-      # http://msdn.microsoft.com/en-us/library/aa746475%28VS.85%29.aspx#code-snippet-5
-      def active_directory_recursive_memberof_filter
-        Net::LDAP::Filter.ex("memberOf:1.2.840.113556.1.4.1941", entry.dn)
-      end
-
-      def entry
-        @entry
-      end
-    end
-  end
-end

lib/gitlab/ldap/group_sync.rb

-require 'net/ldap/dn'
-
-module Gitlab
-  module LDAP
-    class GroupSync
-      attr_reader :provider
-
-      # Open a connection so we can run all queries through it.
-      # It's more efficient than the default of opening/closing per LDAP query.
-      def self.open(provider, &block)
-        Gitlab::LDAP::Adapter.open(provider) do |adapter|
-          block.call(self.new(provider, adapter))
-        end
-      end
-
-      def self.execute
-        # Shuffle providers to prevent a scenario where sync fails after a time
-        # and only the first provider or two get synced. This shuffles the order
-        # so subsequent syncs should eventually get to all providers. Obviously
-        # we should avoid failure, but this is an additional safeguard.
-        Gitlab::LDAP::Config.providers.shuffle.each do |provider|
-          self.open(provider) do |group_sync|
-            group_sync.update_permissions
-          end
-        end
-
-        true
-      end
-
-      def initialize(provider, adapter = nil)
-        @adapter = adapter
-        @provider = provider
-      end
-
-      def update_permissions
-        if group_base.present?
-          logger.debug { "Performing LDAP group sync for '#{provider}' provider" }
-          sync_groups
-          logger.debug { "Finished LDAP group sync for '#{provider}' provider" }
-        else
-          logger.debug { "No `group_base` configured for '#{provider}' provider. Skipping" }
-        end
-
-        if admin_group.present?
-          logger.debug { "Syncing admin users for '#{provider}' provider" }
-          sync_admin_users
-          logger.debug { "Finished syncing admin users for '#{provider}' provider" }
-        else
-          logger.debug { "No `admin_group` configured for '#{provider}' provider. Skipping" }
-        end
-
-        if external_groups.empty?
-          logger.debug { "No `external_groups` configured for '#{provider}' provider. Skipping" }
-        else
-          logger.debug { "Syncing external users for '#{provider}' provider" }
-          sync_external_users
-          logger.debug { "Finished syncing external users for '#{provider}' provider" }
-        end
-
-        nil
-      end
-
-      # Iterate of all GitLab groups with LDAP links. Build an access hash
-      # representing a user's highest access level among the LDAP links within
-      # the same GitLab group.
-      def sync_groups
-        # Order results by last_ldap_sync_at ASC so groups with older last
-        # sync time are handled first
-        groups_where_group_links_with_provider_ordered.each do |group|
-          lease = Gitlab::ExclusiveLease.new(
-            "ldap_group_sync:#{provider}:#{group.id}",
-            timeout: 3600
-          )
-          next unless lease.try_obtain
-
-          logger.debug { "Syncing '#{group.name}' group" }
-
-          access_levels = Gitlab::LDAP::AccessLevels.new
-          # Only iterate over group links for the current provider
-          group.ldap_group_links.with_provider(provider).each do |group_link|
-            if member_dns = dns_for_group_cn(group_link.cn)
-              access_levels.set(member_dns, to: group_link.group_access)
-              logger.debug do
-                "Resolved '#{group.name}' group member access: #{access_levels.to_hash}"
-              end
-            end
-          end
-
-          update_existing_group_membership(group, access_levels)
-          add_new_members(group, access_levels)
-
-          group.update(last_ldap_sync_at: Time.now)
-
-          logger.debug { "Finished syncing '#{group.name}' group" }
-        end
-      end
-
-      # Update global administrators based on the specified admin group CN
-      def sync_admin_users
-        admin_group_member_dns = dns_for_group_cn(admin_group)
-        current_admin_users = ::User.admins.with_provider(provider)
-        verified_admin_users = []
-
-        # Verify existing admin users and add new ones.
-        admin_group_member_dns.each do |member_dn|
-          user = Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
-
-          if user.present?
-            user.admin = true
-            user.save
-            verified_admin_users << user
-          else
-            logger.debug do
-              <<-MSG.strip_heredoc.tr("\n", ' ')
-                #{self.class.name}: User with DN `#{member_dn}` should have admin
-                access but there is no user in GitLab with that identity.
-                Membership will be updated once the user signs in for the first time.
-              MSG
-            end
-          end
-        end
-
-        # Revoke the unverified admins.
-        current_admin_users.each do |user|
-          unless verified_admin_users.include?(user)
-            user.admin = false
-            user.save
-          end
-        end
-      end
-
-      # Update external users based on the specified external groups CN
-      def sync_external_users
-        current_external_users = ::User.external.with_provider(provider)
-        verified_external_users = []
-
-        external_groups.each do |group|
-          group_dns = dns_for_group_cn(group)
-
-          group_dns.each do |member_dn|
-            user = Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
-
-            if user.present?
-              user.external = true
-              user.save
-              verified_external_users << user
-            else
-              logger.debug do
-                <<-MSG.strip_heredoc.tr("\n", ' ')
-                  #{self.class.name}: User with DN `#{member_dn}` should be marked as
-                  external but there is no user in GitLab with that identity.
-                  Membership will be updated once the user signs in for the first time.
-                MSG
-              end
-            end
-          end
-        end
-
-        update_external_permissions(current_external_users, verified_external_users)
-      end
-
-      private
-
-      # Cache LDAP group member DNs so we don't query LDAP groups more than once.
-      def dns_for_group_cn(group_cn)
-        @dns_for_group_cn ||= Hash.new { |h, k| h[k] = ldap_group_member_dns(k) }
-        @dns_for_group_cn[group_cn]
-      end
-
-      # Cache user DN so we don't generate excess queries to map UID to DN
-      def dn_for_uid(uid)
-        @dn_for_uid ||= Hash.new { |h, k| h[k] = member_uid_to_dn(k) }
-        @dn_for_uid[uid]
-      end
-
-      def adapter
-        @adapter ||= Gitlab::LDAP::Adapter.new(provider)
-      end
-
-      def config
-        @config ||= Gitlab::LDAP::Config.new(provider)
-      end
-
-      def group_base
-        config.group_base
-      end
-
-      def admin_group
-        config.admin_group
-      end
-
-      def external_groups
-        config.external_groups
-      end
-
-      def ldap_group_member_dns(ldap_group_cn)
-        ldap_group = Gitlab::LDAP::Group.find_by_cn(ldap_group_cn, adapter)
-        unless ldap_group.present?
-          logger.warn { "Cannot find LDAP group with CN '#{ldap_group_cn}'. Skipping" }
-          return []
-        end
-
-        member_dns = ldap_group.member_dns
-        if member_dns.empty?
-          # Group must be empty
-          return [] unless ldap_group.memberuid?
-
-          members = ldap_group.member_uids
-          member_dns = members.map { |uid| dn_for_uid(uid) }
-        end
-        ensure_full_dns!(member_dns)
-
-        logger.debug { "Members in '#{ldap_group.name}' LDAP group: #{member_dns}" }
-
-        # Various lookups in this method could return `nil` values.
-        # Compact the array to remove those entries
-        member_dns.compact
-      end
-
-      # At least one customer reported that their LDAP `member` values contain
-      # only `uid=username` and not the full DN. This method allows us to
-      # account for that. See gitlab-ee#442
-      def ensure_full_dns!(dns)
-        dns.map! do |dn|
-          begin
-            parsed_dn = Net::LDAP::DN.new(dn).to_a
-          rescue RuntimeError => e
-            # Net::LDAP raises a generic RuntimeError. Bad library! Bad!
-            logger.error { "Found malformed DN: '#{dn}'. Skipping. #{e.message}" }
-            next
-          end
-
-          # If there is more than one key/value set we must have a full DN,
-          # or at least the probability is higher.
-          if parsed_dn.count > 2
-            dn
-          elsif parsed_dn[0] == 'uid'
-            dn_for_uid(parsed_dn[1])
-          else
-            logger.warn { "Found potentially malformed/incomplete DN: '#{dn}'" }
-            dn
-          end
-        end
-
-        # Remove `nil` values generated by the rescue above.
-        dns.compact!
-      end
-
-      def member_uid_to_dn(uid)
-        identity = Identity.find_by(provider: provider, secondary_extern_uid: uid)
-
-        if identity.present?
-          # Use the DN on record in GitLab when it's available
-          identity.extern_uid
-        else
-          ldap_user = Gitlab::LDAP::Person.find_by_uid(uid, adapter)
-
-          # Can't find a matching user for group entry
-          return nil unless ldap_user.present?
-
-          # Update user identity so we don't have to go through this again
-          update_identity(ldap_user.dn, uid)
-
-          ldap_user.dn
-        end
-      end
-
-      def update_identity(dn, uid)
-        identity =
-          Identity.find_by(provider: provider, extern_uid: dn)
-
-        # User may not exist in GitLab yet. Skip.
-        return unless identity.present?
-
-        identity.secondary_extern_uid = uid
-        identity.save
-      end
-
-      def update_existing_group_membership(group, access_levels)
-        logger.debug { "Updating existing membership for '#{group.name}' group" }
-
-        select_and_preload_group_members(group).each do |member|
-          user = member.user
-          identity = user.identities.select(:id, :extern_uid)
-                       .with_provider(provider).first
-          member_dn = identity.extern_uid
-
-          # Skip if this is not an LDAP user with a valid `extern_uid`.
-          next unless member_dn.present?
-
-          # Prevent shifting group membership, in case where user is a member
-          # of two LDAP groups from different providers linked to the same
-          # GitLab group. This is not ideal, but preserves existing behavior.
-          if user.ldap_identity.id != identity.id
-            access_levels.delete(member_dn)
-            next
-          end
-
-          desired_access = access_levels[member_dn]
-
-          # Don't do anything if the user already has the desired access level
-          if member.access_level == desired_access
-            access_levels.delete(member_dn)
-            next
-          end
-
-          # Check and update the access level. If `desired_access` is `nil`
-          # we need to delete the user from the group.
-          if desired_access.present?
-            add_or_update_user_membership(user, group, desired_access)
-
-            # Delete this entry from the hash now that we've acted on it
-            access_levels.delete(member_dn)
-          elsif group.last_owner?(user)
-            warn_cannot_remove_last_owner(user, group)
-          else
-            group.users.delete(user)
-          end
-        end
-      end
-
-      def update_external_permissions(users, verified)
-        # Restore normal access to users no longer found in the external groups
-        users.each do |user|
-          unless verified.include?(user)
-            user.external = false
-            user.save
-          end
-        end
-      end
-
-      def add_new_members(group, access_levels)
-        logger.debug { "Adding new members to '#{group.name}' group" }
-
-        access_levels.each do |member_dn, access_level|
-          user = Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
-
-          if user.present?
-            add_or_update_user_membership(user, group, access_level)
-          else
-            logger.debug do
-              <<-MSG.strip_heredoc.tr("\n", ' ')
-                #{self.class.name}: User with DN `#{member_dn}` should have access
-                to '#{group.name}' group but there is no user in GitLab with that
-                identity. Membership will be updated once the user signs in for
-                the first time.
-              MSG
-            end
-          end
-        end
-      end
-
-      def add_or_update_user_membership(user, group, access)
-        # Prevent the last owner of a group from being demoted
-        if access < Gitlab::Access::OWNER && group.last_owner?(user)
-          warn_cannot_remove_last_owner(user, group)
-        else
-          # If you pass the user object, instead of just user ID,
-          # it saves an extra user database query.
-          group.add_users([user], access, skip_notification: true)
-        end
-      end
-
-      def warn_cannot_remove_last_owner(user, group)
-        logger.warn do
-          <<-MSG.strip_heredoc.tr("\n", ' ')
-            #{self.class.name}: LDAP group sync cannot remove #{user.name}
-            (#{user.id}) from group #{group.name} (#{group.id}) as this is
-            the group's last owner
-          MSG
-        end
-      end
-
-      def select_and_preload_group_members(group)
-        group.members.select_access_level_and_user
-          .with_identity_provider(provider).preload(:user)
-      end
-
-      def groups_where_group_links_with_provider_ordered
-        ::Group.where_group_links_with_provider(provider)
-          .preload(:ldap_group_links)
-          .reorder('last_ldap_sync_at ASC, namespaces.id ASC')
-          .distinct
-      end
-
-      def logger
-        Rails.logger
-      end
-    end
-  end
-end

spec/lib/gitlab/ldap/access_levels_spec.rb → spec/lib/ee/gitlab/ldap/access_levels_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::AccessLevels, lib: true do
+describe EE::Gitlab::LDAP::AccessLevels, lib: true do
   describe '#set' do
-    let(:access_levels) { Gitlab::LDAP::AccessLevels.new }
+    let(:access_levels) { described_class.new }
     let(:dns) do
       %w(
       uid=johndoe,ou=users,dc=example,dc=com

spec/lib/ee/gitlab/ldap/adapter_spec.rb

+require 'spec_helper'
+
+# Test things specific to the EE mixin, but run the actual tests
+# against the main adapter class to ensure it's properly included
+describe Gitlab::LDAP::Adapter, lib: true do
+  subject { Gitlab::LDAP::Adapter.new 'ldapmain' }
+
+  it { is_expected.to include_module(EE::Gitlab::LDAP::Adapter) }
+end

spec/lib/gitlab/ldap/group_spec.rb → spec/lib/ee/gitlab/ldap/group_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::Group, lib: true do
+describe EE::Gitlab::LDAP::Group, lib: true do
   describe '#member_dns' do
     def ldif
       Net::LDAP::Entry.from_single_ldif_string(

spec/lib/gitlab/ldap/group_sync_spec.rb → spec/lib/ee/gitlab/ldap/group_sync_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::GroupSync, lib: true do
-  let(:group_sync) { Gitlab::LDAP::GroupSync.new('ldapmain') }
+describe EE::Gitlab::LDAP::GroupSync, lib: true do
+  let(:group_sync) { described_class.new('ldapmain') }
   let(:config) { double(:config, active_directory: false) }
   let(:adapter) { double(:adapter, config: config) }
   subject { group_sync }
 
   before do
-    allow_any_instance_of(Gitlab::ExclusiveLease)
+    allow_any_instance_of(::Gitlab::ExclusiveLease)
       .to receive(:try_obtain).and_return(true)
   end
 
@@ -59,7 +59,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
 
     context 'with all functionality against one LDAP group type' do
       before do
-        allow_any_instance_of(Gitlab::LDAP::Group)
+        allow_any_instance_of(EE::Gitlab::LDAP::Group)
           .to receive(:adapter).and_return(adapter)
 
         user1.identities.create(
@@ -71,19 +71,19 @@ describe Gitlab::LDAP::GroupSync, lib: true do
           extern_uid: "uid=#{user2.username},ou=users,dc=example,dc=com"
         )
 
-        allow(Gitlab::LDAP::Group)
+        allow(EE::Gitlab::LDAP::Group)
           .to receive(:find_by_cn)
-            .with('ldap_group1', kind_of(Gitlab::LDAP::Adapter))
-            .and_return(Gitlab::LDAP::Group.new(ldap_group1))
+            .with('ldap_group1', kind_of(::Gitlab::LDAP::Adapter))
+            .and_return(EE::Gitlab::LDAP::Group.new(ldap_group1))
 
         group1.ldap_group_links.create(
           cn: 'ldap_group1',
-          group_access: Gitlab::Access::DEVELOPER,
+          group_access: ::Gitlab::Access::DEVELOPER,
           provider: 'ldapmain'
         )
         group2.ldap_group_links.create(
           cn: 'ldap_group1',
-          group_access: Gitlab::Access::OWNER,
+          group_access: ::Gitlab::Access::OWNER,
           provider: 'ldapmain'
         )
       end
@@ -92,9 +92,9 @@ describe Gitlab::LDAP::GroupSync, lib: true do
         before do
           # Pre-populate the group with some users
           group1.add_users([user1.id],
-                           Gitlab::Access::MASTER, skip_notification: true)
+                           ::Gitlab::Access::MASTER, skip_notification: true)
           group2.add_users([user2.id],
-                           Gitlab::Access::DEVELOPER, skip_notification: true)
+                           ::Gitlab::Access::DEVELOPER, skip_notification: true)
         end
 
         it 'adds new members' do
@@ -108,7 +108,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
             .to change {
               group1.members.where(
                 user_id: user1.id,
-                access_level: Gitlab::Access::DEVELOPER
+                access_level: ::Gitlab::Access::DEVELOPER
               ).any?
             }.from(false).to(true)
         end
@@ -118,7 +118,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
             .to change {
               group2.members.where(
                 user_id: user2.id,
-                access_level: Gitlab::Access::OWNER
+                access_level: ::Gitlab::Access::OWNER
               ).any?
             }.from(false).to(true)
         end
@@ -136,9 +136,9 @@ describe Gitlab::LDAP::GroupSync, lib: true do
             .create(provider: group_sync.provider,
                     extern_uid: "uid=johndoe,ou=users,dc=example,dc=com" )
           group1.add_users([user_without_group.id],
-                           Gitlab::Access::MASTER, skip_notification: true)
+                           ::Gitlab::Access::MASTER, skip_notification: true)
           group2.add_users([user_without_group.id],
-                           Gitlab::Access::OWNER, skip_notification: true)
+                           ::Gitlab::Access::OWNER, skip_notification: true)
         end
 
         it 'removes the user from the group' do
@@ -157,27 +157,26 @@ describe Gitlab::LDAP::GroupSync, lib: true do
         before do
           group1.ldap_group_links.create(
             cn: 'ldap_group1',
-            group_access: Gitlab::Access::DEVELOPER,
+            group_access: ::Gitlab::Access::DEVELOPER,
             provider: 'ldapmain'
           )
 
           group1.add_users([user1.id, user2.id],
-            Gitlab::Access::OWNER, skip_notification: true)
+            ::Gitlab::Access::OWNER, skip_notification: true)
         end
 
-        # Check two users in a loop to uncover any stale group owner data
         it 'downgrades one user but not the other' do
           group_sync.sync_groups
 
           expect(group1.members.pluck(:access_level).sort)
-            .to eq([Gitlab::Access::DEVELOPER, Gitlab::Access::OWNER])
+            .to eq([::Gitlab::Access::DEVELOPER, ::Gitlab::Access::OWNER])
         end
 
         context 'when user is a member of two groups from different providers' do
           let(:config) { double(:config, active_directory: false, provider: 'ldapsecondary') }
           let(:adapter) { double(:adapter, config: config) }
           let(:secondary_group_sync) do
-            Gitlab::LDAP::GroupSync.new('ldapsecondary', adapter)
+            described_class.new('ldapsecondary', adapter)
           end
           let(:ldap_secondary_group1) do
             Net::LDAP::Entry.from_single_ldif_string(<<-EOS.strip_heredoc)
@@ -194,14 +193,14 @@ describe Gitlab::LDAP::GroupSync, lib: true do
           let(:user_w_multiple_ids) { create(:user) }
 
           before do
-            allow(Gitlab::LDAP::Group)
+            allow(EE::Gitlab::LDAP::Group)
               .to receive(:find_by_cn)
                 .with('ldap_group1', any_args)
-                .and_return(Gitlab::LDAP::Group.new(ldap_group1))
-            allow(Gitlab::LDAP::Group)
+                .and_return(EE::Gitlab::LDAP::Group.new(ldap_group1))
+            allow(EE::Gitlab::LDAP::Group)
               .to receive(:find_by_cn)
                 .with('ldap_secondary_group1', any_args)
-                .and_return(Gitlab::LDAP::Group.new(ldap_secondary_group1))
+                .and_return(EE::Gitlab::LDAP::Group.new(ldap_secondary_group1))
             user_w_multiple_ids.identities.create(
               [
                 {
@@ -216,16 +215,16 @@ describe Gitlab::LDAP::GroupSync, lib: true do
             )
             group1.ldap_group_links.create(
               cn: 'ldap_group1',
-              group_access: Gitlab::Access::DEVELOPER,
+              group_access: ::Gitlab::Access::DEVELOPER,
               provider: 'ldapprimary'
             )
             group1.ldap_group_links.create(
               cn: 'ldap_secondary_group1',
-              group_access: Gitlab::Access::OWNER,
+              group_access: ::Gitlab::Access::OWNER,
               provider: 'ldapsecondary'
             )
             group1.add_users([user_w_multiple_ids.id],
-                             Gitlab::Access::DEVELOPER, skip_notification: true)
+                             ::Gitlab::Access::DEVELOPER, skip_notification: true)
           end
 
           it 'does not change user permissions for secondary group link' do
@@ -233,7 +232,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
               .not_to change {
                 group1.members.where(
                   user_id: user_w_multiple_ids.id,
-                  access_level: Gitlab::Access::OWNER
+                  access_level: ::Gitlab::Access::OWNER
                 ).any?
               }
           end
@@ -252,7 +251,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
               objectclass: groupOfNames
             EOS
 
-          allow_any_instance_of(Gitlab::LDAP::Group)
+          allow_any_instance_of(EE::Gitlab::LDAP::Group)
             .to receive(:adapter).and_return(adapter)
 
           user1.identities.create(
@@ -264,36 +263,36 @@ describe Gitlab::LDAP::GroupSync, lib: true do
             extern_uid: "uid=#{user2.username},ou=users,dc=example,dc=com"
           )
 
-          allow(Gitlab::LDAP::Group)
+          allow(EE::Gitlab::LDAP::Group)
             .to receive(:find_by_cn)
-              .with('ldap_group1', kind_of(Gitlab::LDAP::Adapter))
-              .and_return(Gitlab::LDAP::Group.new(ldap_group1))
-          allow(Gitlab::LDAP::Group)
+              .with('ldap_group1', kind_of(::Gitlab::LDAP::Adapter))
+              .and_return(EE::Gitlab::LDAP::Group.new(ldap_group1))
+          allow(EE::Gitlab::LDAP::Group)
             .to receive(:find_by_cn)
-              .with('ldap_group2', kind_of(Gitlab::LDAP::Adapter))
-              .and_return(Gitlab::LDAP::Group.new(ldap_group2))
+              .with('ldap_group2', kind_of(::Gitlab::LDAP::Adapter))
+              .and_return(EE::Gitlab::LDAP::Group.new(ldap_group2))
 
           group1.members.destroy_all
           group1.ldap_group_links.destroy_all
           group1.ldap_group_links.create(
             cn: 'ldap_group1',
-            group_access: Gitlab::Access::DEVELOPER,
+            group_access: ::Gitlab::Access::DEVELOPER,
             provider: 'ldapmain'
           )
           group2.members.destroy_all
           group2.ldap_group_links.destroy_all
           group2.ldap_group_links.create(
             cn: 'ldap_group2',
-            group_access: Gitlab::Access::MASTER,
+            group_access: ::Gitlab::Access::MASTER,
             provider: 'ldapmain'
           )
 
           group_sync.sync_groups
 
           expect(group1.members.pluck(:user_id).sort).to eq([user1.id, user2.id].sort)
-          expect(group1.members.pluck(:access_level).uniq).to eq([Gitlab::Access::DEVELOPER])
+          expect(group1.members.pluck(:access_level).uniq).to eq([::Gitlab::Access::DEVELOPER])
           expect(group2.members.pluck(:user_id)).to eq([user2.id])
-          expect(group2.members.pluck(:access_level).uniq).to eq([Gitlab::Access::MASTER])
+          expect(group2.members.pluck(:access_level).uniq).to eq([::Gitlab::Access::MASTER])
         end
       end
     end
@@ -303,9 +302,9 @@ describe Gitlab::LDAP::GroupSync, lib: true do
       let(:secondary_extern_uid) { nil }
 
       before do
-        allow_any_instance_of(Gitlab::LDAP::Group)
+        allow_any_instance_of(EE::Gitlab::LDAP::Group)
           .to receive(:adapter).and_return(adapter)
-        allow(Gitlab::LDAP::Group)
+        allow(EE::Gitlab::LDAP::Group)
           .to receive(:find_by_cn)
             .with(ldap_group.cn, any_args)
             .and_return(ldap_group)
@@ -316,7 +315,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
         )
         group1.ldap_group_links.create(
           cn: ldap_group.cn,
-          group_access: Gitlab::Access::DEVELOPER,
+          group_access: ::Gitlab::Access::DEVELOPER,
           provider: 'ldapmain'
         )
       end
@@ -324,7 +323,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
       # GroupOfNames - OpenLDAP
       context 'with groupOfNames style LDAP group' do
         let(:ldap_group) do
-          Gitlab::LDAP::Group.new(
+          EE::Gitlab::LDAP::Group.new(
             Net::LDAP::Entry.from_single_ldif_string(<<-EOS.strip_heredoc)
                 dn: cn=ldap_group1,ou=groups,dc=example,dc=com
                 cn: ldap_group1
@@ -346,7 +345,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
       # posixGroup - Apple Open Directory
       context 'with posixGroup style LDAP group' do
         let(:ldap_group) do
-          Gitlab::LDAP::Group.new(
+          EE::Gitlab::LDAP::Group.new(
             Net::LDAP::Entry.from_single_ldif_string(<<-EOS.strip_heredoc)
                 dn: cn=ldap_group1,ou=groups,dc=example,dc=com
                 cn: ldap_group1
@@ -358,7 +357,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
           )
         end
         let(:ldap_user) do
-          Gitlab::LDAP::Person.new(
+          ::Gitlab::LDAP::Person.new(
             Net::LDAP::Entry.from_single_ldif_string(
               "dn: uid=#{user1.username},ou=users,dc=example,dc=com"
             ),
@@ -367,7 +366,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
         end
 
         before do
-          allow(Gitlab::LDAP::Person)
+          allow(::Gitlab::LDAP::Person)
             .to receive(:find_by_uid)
               .with(user1.username, any_args)
               .and_return(ldap_user)
@@ -379,8 +378,8 @@ describe Gitlab::LDAP::GroupSync, lib: true do
               .from(false).to(true)
         end
 
-        it 'expects Gitlab::LDAP::Person to be called' do
-          expect(Gitlab::LDAP::Person).to receive(:find_by_uid)
+        it 'expects ::Gitlab::LDAP::Person to be called' do
+          expect(::Gitlab::LDAP::Person).to receive(:find_by_uid)
 
           group_sync.sync_groups
         end
@@ -398,8 +397,8 @@ describe Gitlab::LDAP::GroupSync, lib: true do
         context 'when the uid is stored in the database' do
           let(:secondary_extern_uid) { user1.username }
 
-          it 'expects Gitlab::LDAP::Person will not be called' do
-            expect(Gitlab::LDAP::Person)
+          it 'expects ::Gitlab::LDAP::Person will not be called' do
+            expect(::Gitlab::LDAP::Person)
               .not_to receive(:find_by_uid)
                 .with(user1.username, any_args)
 
@@ -414,7 +413,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
             # Group 1 link was created above. Create another here.
             group2.ldap_group_links.create(
               cn: ldap_group.cn,
-              group_access: Gitlab::Access::DEVELOPER,
+              group_access: ::Gitlab::Access::DEVELOPER,
               provider: 'ldapmain'
             )
           end
@@ -429,8 +428,8 @@ describe Gitlab::LDAP::GroupSync, lib: true do
             group_sync.sync_groups
           end
 
-          it 'expects Gitlab::LDAP::Person will not be called' do
-            expect(Gitlab::LDAP::Person)
+          it 'expects ::Gitlab::LDAP::Person will not be called' do
+            expect(::Gitlab::LDAP::Person)
               .not_to receive(:find_by_uid)
                 .with(user1.username, any_args)
 
@@ -441,7 +440,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
 
       context 'with groupOfUniqueNames style LDAP group' do
         let(:ldap_group) do
-          Gitlab::LDAP::Group.new(
+          EE::Gitlab::LDAP::Group.new(
             Net::LDAP::Entry.from_single_ldif_string(<<-EOS.strip_heredoc)
                 dn: cn=ldap_group1,ou=groups,dc=example,dc=com
                 cn: ldap_group1
@@ -462,7 +461,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
 
       context 'with an empty LDAP group' do
         let(:ldap_group) do
-          Gitlab::LDAP::Group.new(
+          EE::Gitlab::LDAP::Group.new(
             Net::LDAP::Entry.from_single_ldif_string(<<-EOS.strip_heredoc)
                 dn: cn=ldap_group1,ou=groups,dc=example,dc=com
                 cn: ldap_group1
@@ -482,7 +481,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
       # See gitlab-ee#442 and comment in GroupSync#ensure_full_dns!
       context 'with uid=username member format' do
         let(:ldap_group) do
-          Gitlab::LDAP::Group.new(
+          EE::Gitlab::LDAP::Group.new(
             Net::LDAP::Entry.from_single_ldif_string(<<-EOS.strip_heredoc)
                 dn: cn=ldap_group1,ou=groups,dc=example,dc=com
                 cn: ldap_group1
@@ -494,7 +493,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
           )
         end
         let(:ldap_user) do
-          Gitlab::LDAP::Person.new(
+          ::Gitlab::LDAP::Person.new(
             Net::LDAP::Entry.from_single_ldif_string(
               "dn: uid=#{user1.username},ou=users,dc=example,dc=com"
             ),
@@ -503,7 +502,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
         end
 
         before do
-          allow(Gitlab::LDAP::Person)
+          allow(::Gitlab::LDAP::Person)
             .to receive(:find_by_uid)
               .with(user1.username, any_args)
               .and_return(ldap_user)
@@ -515,8 +514,8 @@ describe Gitlab::LDAP::GroupSync, lib: true do
               .from(false).to(true)
         end
 
-        it 'expects Gitlab::LDAP::Person to be called' do
-          expect(Gitlab::LDAP::Person).to receive(:find_by_uid)
+        it 'expects ::Gitlab::LDAP::Person to be called' do
+          expect(::Gitlab::LDAP::Person).to receive(:find_by_uid)
 
           group_sync.sync_groups
         end
@@ -534,7 +533,7 @@ describe Gitlab::LDAP::GroupSync, lib: true do
 
       context 'with invalid DNs in the LDAP group' do
         let(:ldap_group) do
-          Gitlab::LDAP::Group.new(
+          EE::Gitlab::LDAP::Group.new(
             Net::LDAP::Entry.from_single_ldif_string(<<-EOS.strip_heredoc)
                 dn: cn=ldap_group1,ou=groups,dc=example,dc=com
                 cn: ldap_group1
@@ -587,14 +586,14 @@ describe Gitlab::LDAP::GroupSync, lib: true do
       user1.update_attribute(:admin, true)
       user3.update_attribute(:admin, true)
 
-      allow_any_instance_of(Gitlab::LDAP::Group)
+      allow_any_instance_of(EE::Gitlab::LDAP::Group)
         .to receive(:adapter).and_return(adapter)
-      allow(Gitlab::LDAP::Group)
+      allow(EE::Gitlab::LDAP::Group)
         .to receive(:find_by_cn).with(admin_group.cn, any_args)
-      allow(Gitlab::LDAP::Group)
+      allow(EE::Gitlab::LDAP::Group)
         .to receive(:find_by_cn)
-          .with('admin_group', kind_of(Gitlab::LDAP::Adapter))
-          .and_return(Gitlab::LDAP::Group.new(admin_group))
+          .with('admin_group', kind_of(::Gitlab::LDAP::Adapter))
+          .and_return(EE::Gitlab::LDAP::Group.new(admin_group))
 
       user1.identities.create(
         provider: 'ldapmain',
@@ -658,16 +657,16 @@ describe Gitlab::LDAP::GroupSync, lib: true do
       user3.update_attribute(:external, true)
       user4.update_attribute(:external, true)
 
-      allow_any_instance_of(Gitlab::LDAP::Group)
+      allow_any_instance_of(EE::Gitlab::LDAP::Group)
         .to receive(:adapter).and_return(adapter)
-      allow(Gitlab::LDAP::Group)
+      allow(EE::Gitlab::LDAP::Group)
         .to receive(:find_by_cn)
-              .with('external_group1', kind_of(Gitlab::LDAP::Adapter))
-              .and_return(Gitlab::LDAP::Group.new(external_group1))
-      allow(Gitlab::LDAP::Group)
+              .with('external_group1', kind_of(::Gitlab::LDAP::Adapter))
+              .and_return(EE::Gitlab::LDAP::Group.new(external_group1))
+      allow(EE::Gitlab::LDAP::Group)
         .to receive(:find_by_cn)
-              .with('external_group2', kind_of(Gitlab::LDAP::Adapter))
-              .and_return(Gitlab::LDAP::Group.new(external_group2))
+              .with('external_group2', kind_of(::Gitlab::LDAP::Adapter))
+              .and_return(EE::Gitlab::LDAP::Group.new(external_group2))
 
       user1.identities.create(
         provider: 'ldapmain',