Fixing port conflicts

app/helpers/auth_helper.rb

@@ -6,13 +6,10 @@ module AuthHelper
 
   def ldap_enabled?
     Gitlab::Auth::LDAP::Config.enabled?
-<<<<<<< HEAD
   end
 
   def kerberos_enabled?
     auth_providers.include?(:kerberos)
-=======
->>>>>>> upstream/master
   end
 
   def omniauth_enabled?

lib/gitlab/auth/ldap/access.rb

@@ -6,11 +6,7 @@ module Gitlab
   module Auth
     module LDAP
       class Access
-<<<<<<< HEAD
         attr_reader :provider, :user, :ldap_identity
-=======
-        attr_reader :provider, :user
->>>>>>> upstream/master
 
         def self.open(user, &block)
           Gitlab::Auth::LDAP::Adapter.open(user.ldap_identity.provider) do |adapter|
@@ -18,18 +14,12 @@ module Gitlab
           end
         end
 
-<<<<<<< HEAD
         def self.allowed?(user, options = {})
           self.open(user) do |access|
             # Whether user is allowed, or not, we should update
             # permissions to keep things clean
             if access.allowed?
               access.update_user
-=======
-        def self.allowed?(user)
-          self.open(user) do |access|
-            if access.allowed?
->>>>>>> upstream/master
               Users::UpdateService.new(user, user: user, last_credential_check_at: Time.now).execute
 
               true
@@ -42,12 +32,8 @@ module Gitlab
         def initialize(user, adapter = nil)
           @adapter = adapter
           @user = user
-<<<<<<< HEAD
           @ldap_identity = user.ldap_identity
           @provider = adapter&.provider || @ldap_identity&.provider
-=======
-          @provider = user.ldap_identity.provider
->>>>>>> upstream/master
         end
 
         def allowed?
@@ -58,11 +44,7 @@ module Gitlab
             end
 
             # Block user in GitLab if he/she was blocked in AD
-<<<<<<< HEAD
             if Gitlab::Auth::LDAP::Person.disabled_via_active_directory?(ldap_identity.extern_uid, adapter)
-=======
-            if Gitlab::Auth::LDAP::Person.disabled_via_active_directory?(user.ldap_identity.extern_uid, adapter)
->>>>>>> upstream/master
               block_user(user, 'is disabled in Active Directory')
               false
             else
@@ -84,7 +66,6 @@ module Gitlab
           Gitlab::Auth::LDAP::Config.new(provider)
         end
 
-<<<<<<< HEAD
         def find_ldap_user
           return unless provider
 
@@ -98,16 +79,11 @@ module Gitlab
 
         def ldap_user
           @ldap_user ||= find_ldap_user
-=======
-        def ldap_user
-          @ldap_user ||= Gitlab::Auth::LDAP::Person.find_by_dn(user.ldap_identity.extern_uid, adapter)
->>>>>>> upstream/master
         end
 
         def block_user(user, reason)
           user.ldap_block
 
-<<<<<<< HEAD
           if provider
             Gitlab::AppLogger.info(
               "LDAP account \"#{ldap_identity.extern_uid}\" #{reason}, " \
@@ -119,19 +95,12 @@ module Gitlab
               "blocking Gitlab user \"#{user.name}\" (#{user.email})"
             )
           end
-=======
-          Gitlab::AppLogger.info(
-            "LDAP account \"#{user.ldap_identity.extern_uid}\" #{reason}, " \
-            "blocking Gitlab user \"#{user.name}\" (#{user.email})"
-          )
->>>>>>> upstream/master
         end
 
         def unblock_user(user, reason)
           user.activate
 
           Gitlab::AppLogger.info(
-<<<<<<< HEAD
             "LDAP account \"#{ldap_identity.extern_uid}\" #{reason}, " \
             "unblocking Gitlab user \"#{user.name}\" (#{user.email})"
           )
@@ -241,12 +210,6 @@ module Gitlab
         def logger
           Rails.logger
         end
-=======
-            "LDAP account \"#{user.ldap_identity.extern_uid}\" #{reason}, " \
-            "unblocking Gitlab user \"#{user.name}\" (#{user.email})"
-          )
-        end
->>>>>>> upstream/master
       end
     end
   end

lib/gitlab/auth/ldap/adapter.rb

@@ -2,11 +2,8 @@ module Gitlab
   module Auth
     module LDAP
       class Adapter
-<<<<<<< HEAD
         prepend ::EE::Gitlab::Auth::LDAP::Adapter
 
-=======
->>>>>>> upstream/master
         attr_reader :provider, :ldap
 
         def self.open(provider, &block)

lib/gitlab/auth/ldap/config.rb

@@ -3,11 +3,8 @@ module Gitlab
   module Auth
     module LDAP
       class Config
-<<<<<<< HEAD
         include ::EE::Gitlab::Auth::LDAP::Config
 
-=======
->>>>>>> upstream/master
         NET_LDAP_ENCRYPTION_METHOD = {
           simple_tls: :simple_tls,
           start_tls:  :start_tls,
@@ -16,11 +13,8 @@ module Gitlab
 
         attr_accessor :provider, :options
 
-<<<<<<< HEAD
         InvalidProvider = Class.new(StandardError)
 
-=======
->>>>>>> upstream/master
         def self.enabled?
           Gitlab.config.ldap.enabled
         end
@@ -32,11 +26,7 @@ module Gitlab
         def self.available_servers
           return [] unless enabled?
 
-<<<<<<< HEAD
           ::License.feature_available?(:multiple_ldap_servers) ? servers : Array.wrap(servers.first)
-=======
-          Array.wrap(servers.first)
->>>>>>> upstream/master
         end
 
         def self.providers
@@ -48,11 +38,7 @@ module Gitlab
         end
 
         def self.invalid_provider(provider)
-<<<<<<< HEAD
           raise InvalidProvider.new("Unknown provider (#{provider}). Available providers: #{providers}")
-=======
-          raise "Unknown provider (#{provider}). Available providers: #{providers}"
->>>>>>> upstream/master
         end
 
         def initialize(provider)
@@ -102,24 +88,17 @@ module Gitlab
         end
 
         def base
-<<<<<<< HEAD
           @base ||= Person.normalize_dn(options['base'])
-=======
-          options['base']
->>>>>>> upstream/master
         end
 
         def uid
           options['uid']
         end
 
-<<<<<<< HEAD
         def label
           options['label']
         end
 
-=======
->>>>>>> upstream/master
         def sync_ssh_keys?
           sync_ssh_keys.present?
         end
@@ -161,13 +140,10 @@ module Gitlab
           options['timeout'].to_i
         end
 
-<<<<<<< HEAD
         def external_groups
           options['external_groups']
         end
 
-=======
->>>>>>> upstream/master
         def has_auth?
           options['password'] || options['bind_dn']
         end

lib/gitlab/auth/ldap/person.rb

-<<<<<<< HEAD
 # Contains methods common to both GitLab CE and EE.
 # All EE methods should be in `EE::Gitlab::Auth::LDAP::Person` only.
-=======
->>>>>>> upstream/master
 module Gitlab
   module Auth
     module LDAP
       class Person
-<<<<<<< HEAD
         prepend ::EE::Gitlab::Auth::LDAP::Person
 
-=======
->>>>>>> upstream/master
         # Active Directory-specific LDAP filter that checks if bit 2 of the
         # userAccountControl attribute is set.
         # Source: http://ctogonewild.com/2009/09/03/bitmask-searches-in-ldap/

lib/gitlab/auth/ldap/user.rb

@@ -8,11 +8,8 @@ module Gitlab
   module Auth
     module LDAP
       class User < Gitlab::Auth::OAuth::User
-<<<<<<< HEAD
         prepend ::EE::Gitlab::Auth::LDAP::User
 
-=======
->>>>>>> upstream/master
         class << self
           def find_by_uid_and_provider(uid, provider)
             identity = ::Identity.with_extern_uid(provider, uid).take

lib/gitlab/auth/o_auth/auth_hash.rb

@@ -4,11 +4,8 @@ module Gitlab
   module Auth
     module OAuth
       class AuthHash
-<<<<<<< HEAD
         prepend ::EE::Gitlab::Auth::OAuth::AuthHash
 
-=======
->>>>>>> upstream/master
         attr_reader :auth_hash
         def initialize(auth_hash)
           @auth_hash = auth_hash

lib/gitlab/auth/o_auth/user.rb

@@ -7,11 +7,8 @@ module Gitlab
   module Auth
     module OAuth
       class User
-<<<<<<< HEAD
         prepend ::EE::Gitlab::Auth::OAuth::User
 
-=======
->>>>>>> upstream/master
         SignupDisabledError = Class.new(StandardError)
         SigninDisabledForProviderError = Class.new(StandardError)
 

lib/gitlab/auth/saml/config.rb

@@ -14,7 +14,6 @@ module Gitlab
           def external_groups
             options[:external_groups]
           end
-<<<<<<< HEAD
 
           def required_groups
             Array(options[:required_groups])
@@ -23,8 +22,6 @@ module Gitlab
           def admin_groups
             options[:admin_groups]
           end
-=======
->>>>>>> upstream/master
         end
       end
     end

lib/gitlab/auth/saml/user.rb

@@ -18,7 +18,6 @@ module Gitlab
           user ||= find_or_build_ldap_user if auto_link_ldap_user?
           user ||= build_new_user if signup_enabled?
 
-<<<<<<< HEAD
           if user_in_required_group?
             unblock_user(user, "in required group") if user.persisted? && user.blocked?
           elsif user.persisted?
@@ -30,12 +29,6 @@ module Gitlab
           if user
             user.external = !(auth_hash.groups & Gitlab::Auth::Saml::Config.external_groups).empty? if external_users_enabled?
             user.admin = !(auth_hash.groups & Gitlab::Auth::Saml::Config.admin_groups).empty? if admin_groups_enabled?
-=======
-          if external_users_enabled? && user
-            # Check if there is overlap between the user's groups and the external groups
-            # setting then set user as external or internal.
-            user.external = !(auth_hash.groups & Gitlab::Auth::Saml::Config.external_groups).empty?
->>>>>>> upstream/master
           end
 
           user
@@ -49,7 +42,6 @@ module Gitlab
 
         protected
 
-<<<<<<< HEAD
         def block_user(user, reason)
           user.ldap_block
           log_user_changes(user, "#{reason}, blocking")
@@ -72,8 +64,6 @@ module Gitlab
           required_groups.empty? || !(auth_hash.groups & required_groups).empty?
         end
 
-=======
->>>>>>> upstream/master
         def auto_link_saml_user?
           Gitlab.config.omniauth.auto_link_saml_user
         end
@@ -85,13 +75,10 @@ module Gitlab
         def auth_hash=(auth_hash)
           @auth_hash = Gitlab::Auth::Saml::AuthHash.new(auth_hash)
         end
-<<<<<<< HEAD
 
         def admin_groups_enabled?
           !Gitlab::Auth::Saml::Config.admin_groups.nil?
         end
-=======
->>>>>>> upstream/master
       end
     end
   end

spec/lib/gitlab/auth/ldap/access_spec.rb

 require 'spec_helper'
 
 describe Gitlab::Auth::LDAP::Access do
+  include LdapHelpers
+
   let(:access) { described_class.new user }
   let(:user) { create(:omniauth_user) }
 
   describe '.allowed?' do
     it 'updates the users `last_credential_check_at' do
+      allow(access).to receive(:update_user)
       expect(access).to receive(:allowed?) { true }
       expect(described_class).to receive(:open).and_yield(access)
 
@@ -14,6 +17,21 @@ describe Gitlab::Auth::LDAP::Access do
     end
   end
 
+  describe '#find_ldap_user' do
+    it 'finds a user by dn first' do
+      expect(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(:ldap_user)
+
+      access.find_ldap_user
+    end
+
+    it 'finds a user by email if the email came from LDAP' do
+      expect(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(nil)
+      expect(Gitlab::Auth::LDAP::Person).to receive(:find_by_email)
+
+      access.find_ldap_user
+    end
+  end
+
   describe '#allowed?' do
     subject { access.allowed? }
 
@@ -29,6 +47,12 @@ describe Gitlab::Auth::LDAP::Access do
 
         access.allowed?
       end
+
+      context 'when looking for a user by email' do
+        let(:user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
+
+        it { is_expected.to be_falsey }
+      end
     end
 
     context 'when the user is found' do
@@ -50,7 +74,7 @@ describe Gitlab::Auth::LDAP::Access do
         end
       end
 
-      context 'and has no disabled flag in active diretory' do
+      context 'and has no disabled flag in active directory' do
         before do
           allow(Gitlab::Auth::LDAP::Person).to receive(:disabled_via_active_directory?).and_return(false)
         end
@@ -163,4 +187,231 @@ describe Gitlab::Auth::LDAP::Access do
       )
     end
   end
+
+  describe '#update_user' do
+    subject { access.update_user }
+    let(:entry) do
+      Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com")
+    end
+    before do
+      allow(access).to(
+        receive_messages(
+          ldap_user: Gitlab::Auth::LDAP::Person.new(entry, user.ldap_identity.provider)
+        )
+      )
+    end
+
+    it 'updates email address' do
+      expect(access).to receive(:update_email).once
+
+      subject
+    end
+
+    it 'updates the group memberships' do
+      expect(access).to receive(:update_memberships).once
+
+      subject
+    end
+
+    it 'syncs ssh keys if enabled by configuration' do
+      allow(access).to receive_messages(group_base: '', sync_ssh_keys?: true)
+      expect(access).to receive(:update_ssh_keys).once
+
+      subject
+    end
+
+    it 'update_kerberos_identity' do
+      allow(access).to receive_messages(import_kerberos_identities?: true)
+      expect(access).to receive(:update_kerberos_identity).once
+
+      subject
+    end
+
+    it 'updates the ldap identity' do
+      expect(access).to receive(:update_identity)
+
+      subject
+    end
+  end
+
+  describe '#update_kerberos_identity' do
+    let(:entry) do
+      Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com")
+    end
+
+    before do
+      allow(access).to receive_messages(ldap_user: Gitlab::Auth::LDAP::Person.new(entry, user.ldap_identity.provider))
+    end
+
+    it "adds a Kerberos identity if it is in Active Directory but not in GitLab" do
+      allow_any_instance_of(EE::Gitlab::Auth::LDAP::Person).to receive_messages(kerberos_principal: "mylogin@FOO.COM")
+
+      expect { access.update_kerberos_identity }.to change(user.identities.where(provider: :kerberos), :count).from(0).to(1)
+      expect(user.identities.where(provider: "kerberos").last.extern_uid).to eq("mylogin@FOO.COM")
+    end
+
+    it "updates existing Kerberos identity in GitLab if Active Directory has a different one" do
+      allow_any_instance_of(EE::Gitlab::Auth::LDAP::Person).to receive_messages(kerberos_principal: "otherlogin@BAR.COM")
+      user.identities.build(provider: "kerberos", extern_uid: "mylogin@FOO.COM").save
+
+      expect { access.update_kerberos_identity }.not_to change(user.identities.where(provider: "kerberos"), :count)
+      expect(user.identities.where(provider: "kerberos").last.extern_uid).to eq("otherlogin@BAR.COM")
+    end
+
+    it "does not remove Kerberos identities from GitLab if they are none in the LDAP provider" do
+      allow_any_instance_of(EE::Gitlab::Auth::LDAP::Person).to receive_messages(kerberos_principal: nil)
+      user.identities.build(provider: "kerberos", extern_uid: "otherlogin@BAR.COM").save
+
+      expect { access.update_kerberos_identity }.not_to change(user.identities.where(provider: "kerberos"), :count)
+      expect(user.identities.where(provider: "kerberos").last.extern_uid).to eq("otherlogin@BAR.COM")
+    end
+
+    it "does not modify identities in GitLab if they are no kerberos principal in the LDAP provider" do
+      allow_any_instance_of(EE::Gitlab::Auth::LDAP::Person).to receive_messages(kerberos_principal: nil)
+
+      expect { access.update_kerberos_identity }.not_to change(user.identities, :count)
+    end
+  end
+
+  describe '#update_ssh_keys' do
+    let(:ssh_key) { "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrSQHff6a1rMqBdHFt+FwIbytMZ+hJKN3KLkTtOWtSvNIriGhnTdn4rs+tjD/w+z+revytyWnMDM9dS7J8vQi006B16+hc9Xf82crqRoPRDnBytgAFFQY1G/55ql2zdfsC5yvpDOFzuwIJq5dNGsojS82t6HNmmKPq130fzsenFnj5v1pl3OJvk513oduUyKiZBGTroWTn7H/eOPtu7s9MD7pAdEjqYKFLeaKmyidiLmLqQlCRj3Tl2U9oyFg4PYNc0bL5FZJ/Z6t0Ds3i/a2RanQiKxrvgu3GSnUKMx7WIX373baL4jeM7cprRGiOY/1NcS+1cAjfJ8oaxQF/1dYj" }
+    let(:ssh_key_attribute_name) { 'altSecurityIdentities' }
+    let(:entry) do
+      Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com\n#{ssh_key_attribute_name}: SSHKey:#{ssh_key}\n#{ssh_key_attribute_name}: KerberosKey:bogus")
+    end
+
+    before do
+      allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(sync_ssh_keys: ssh_key_attribute_name)
+      allow(access).to receive_messages(sync_ssh_keys?: true)
+    end
+
+    it "adds a SSH key if it is in LDAP but not in gitlab" do
+      allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
+
+      expect { access.update_ssh_keys }.to change(user.keys, :count).from(0).to(1)
+    end
+
+    it "adds a SSH key and give it a proper name" do
+      allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
+
+      access.update_ssh_keys
+      expect(user.keys.last.title).to match(/LDAP/)
+      expect(user.keys.last.title).to match(/#{access.ldap_config.sync_ssh_keys}/)
+    end
+
+    it "does not add a SSH key if it is invalid" do
+      entry = Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com\n#{ssh_key_attribute_name}: I am not a valid key")
+      allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
+
+      expect { access.update_ssh_keys }.not_to change(user.keys, :count)
+    end
+
+    context 'user has at least one LDAPKey' do
+      before do
+        user.keys.ldap.create key: ssh_key, title: 'to be removed'
+      end
+
+      it "removes a SSH key if it is no longer in LDAP" do
+        entry = Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com\n#{ssh_key_attribute_name}:\n")
+        allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
+
+        expect { access.update_ssh_keys }.to change(user.keys, :count).from(1).to(0)
+      end
+
+      it "removes a SSH key if the ldap attribute was removed" do
+        entry = Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com")
+        allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
+
+        expect { access.update_ssh_keys }.to change(user.keys, :count).from(1).to(0)
+      end
+    end
+  end
+
+  describe '#update_user_email' do
+    let(:entry) { Net::LDAP::Entry.new }
+
+    before do
+      allow(access).to receive_messages(ldap_user: Gitlab::Auth::LDAP::Person.new(entry, user.ldap_identity.provider))
+    end
+
+    it "does not update email if email attribute is not set" do
+      expect { access.update_email }.not_to change(user, :email)
+    end
+
+    it "does not update the email if the user has the same email in GitLab and in LDAP" do
+      entry['mail'] = [user.email]
+      expect { access.update_email }.not_to change(user, :email)
+    end
+
+    it "does not update the email if the user has the same email GitLab and in LDAP, but with upper case in LDAP" do
+      entry['mail'] = [user.email.upcase]
+      expect { access.update_email }.not_to change(user, :email)
+    end
+
+    it "updates the email if the user email is different" do
+      entry['mail'] = ["new_email@example.com"]
+      expect { access.update_email }.to change(user, :email)
+    end
+  end
+
+  describe '#update_memberships' do
+    let(:provider) { user.ldap_identity.provider }
+    let(:entry) { ldap_user_entry(user.ldap_identity.extern_uid) }
+
+    let(:person_with_memberof) do
+      entry['memberof'] = ['CN=Group1,CN=Users,DC=The dc,DC=com',
+                           'CN=Group2,CN=Builtin,DC=The dc,DC=com']
+      Gitlab::Auth::LDAP::Person.new(entry, provider)
+    end
+
+    it 'triggers a sync for all groups found in `memberof`' do
+      group_link_1 = create(:ldap_group_link, cn: 'Group1', provider: provider)
+      group_link_2 = create(:ldap_group_link, cn: 'Group2', provider: provider)
+      group_ids = [group_link_1, group_link_2].map(&:group_id)
+
+      allow(access).to receive(:ldap_user).and_return(person_with_memberof)
+
+      expect(LdapGroupSyncWorker).to receive(:perform_async)
+        .with(a_collection_containing_exactly(*group_ids), provider)
+
+      access.update_memberships
+    end
+
+    it "doesn't continue when there is no `memberOf` param" do
+      allow(access).to receive(:ldap_user)
+                         .and_return(Gitlab::Auth::LDAP::Person.new(entry, provider))
+
+      expect(LdapGroupLink).not_to receive(:where)
+      expect(LdapGroupSyncWorker).not_to receive(:perform_async)
+
+      access.update_memberships
+    end
+
+    it "doesn't trigger a sync when there are no links for the provider" do
+      _another_provider = create(:ldap_group_link,
+                                 cn: 'Group1',
+                                 provider: 'not-this-ldap')
+
+      allow(access).to receive(:ldap_user).and_return(person_with_memberof)
+
+      expect(LdapGroupSyncWorker).not_to receive(:perform_async)
+
+      access.update_memberships
+    end
+  end
+
+  describe '#update_identity' do
+    it 'updates the external UID if it changed in the entry' do
+      entry = ldap_user_entry('another uid')
+      provider = user.ldap_identity.provider
+      person = Gitlab::Auth::LDAP::Person.new(entry, provider)
+
+      allow(access).to receive(:ldap_user).and_return(person)
+
+      access.update_identity
+
+      expect(user.ldap_identity.reload.extern_uid)
+        .to eq('uid=another uid,ou=users,dc=example,dc=com')
+    end
+  end
 end

spec/lib/gitlab/auth/ldap/user_spec.rb

@@ -26,7 +26,6 @@ describe Gitlab::Auth::LDAP::User do
   let(:auth_hash_upper_case) do
     OmniAuth::AuthHash.new(uid: 'uid=John Smith,ou=People,dc=example,dc=com', provider: 'ldapmain', info: info_upper_case)
   end
-  let!(:fake_proxy) { fake_ldap_sync_proxy('ldapmain') }
 
   describe '#changed?' do
     it "marks existing ldap user as changed" do