Merge branch 'fix_ldap_security_external_login_10_3_redux' into 'security-10-3-ee'

Fix LDAP external user/group bug on first sign in

See merge request gitlab/gitlab-ee!569

changelogs/unreleased-ee/fix_ldap_external_on_login.yml

+---
+title: Fix LDAP external user/group bug on first sign in
+merge_request:
+author:
+type: security

ee/lib/ee/gitlab/ldap/user.rb

@@ -17,6 +17,8 @@ module EE
         # Intended to be called during #initialize, and #save should be called
         # after initialize.
         def set_external_with_external_groups
+          return if ldap_config.external_groups.empty?
+
           gl_user.external = in_any_external_group?
         end
 

spec/ee/spec/lib/ee/gitlab/ldap/user_spec.rb

@@ -100,6 +100,14 @@ describe Gitlab::LDAP::User do
       it "sets the user's external flag to false" do
         expect(gl_user.external).to be_falsey
       end
+
+      context 'when the user_default_external application setting is true' do
+        it 'does not set the external flag to false' do
+          stub_application_setting(user_default_external: true)
+
+          expect(gl_user.external).to be_truthy
+        end
+      end
     end
   end
 end