Commit 43a92bd7 authored by Suzanne Selhorn's avatar Suzanne Selhorn

Removed note that and added guidance

We should not use the phrase 'note that'
and instead get right to the point.
parent fc60f4e3
...@@ -197,8 +197,8 @@ Some examples of the `user_filter` field syntax: ...@@ -197,8 +197,8 @@ Some examples of the `user_filter` field syntax:
LDAP attributes that GitLab uses to create an account for the LDAP user. The specified LDAP attributes that GitLab uses to create an account for the LDAP user. The specified
attribute can either be the attribute name as a string (for example, `'mail'`), or an attribute can either be the attribute name as a string (for example, `'mail'`), or an
array of attribute names to try in order (for example, `['mail', 'email']`). Note that array of attribute names to try in order (for example, `['mail', 'email']`).
the user's LDAP sign-in is the attribute specified as `uid` above. The user's LDAP sign-in is the attribute specified as `uid` above.
| Setting | Description | Required | Examples | | Setting | Description | Required | Examples |
|--------------|-------------|----------|----------| |--------------|-------------|----------|----------|
...@@ -654,7 +654,7 @@ NOTE: ...@@ -654,7 +654,7 @@ NOTE:
Administrators are not synced unless `group_base` is also Administrators are not synced unless `group_base` is also
specified alongside `admin_group`. Also, only specify the CN of the `admin_group`, specified alongside `admin_group`. Also, only specify the CN of the `admin_group`,
as opposed to the full DN. as opposed to the full DN.
Additionally, note that if an LDAP user has an `admin` role, but is not a member of the `admin_group` Additionally, if an LDAP user has an `admin` role, but is not a member of the `admin_group`
group, GitLab revokes their `admin` role when syncing. group, GitLab revokes their `admin` role when syncing.
**Omnibus configuration** **Omnibus configuration**
......
...@@ -426,7 +426,7 @@ Started syncing 'ldapmain' provider for 'my_group' group ...@@ -426,7 +426,7 @@ Started syncing 'ldapmain' provider for 'my_group' group
``` ```
The following entry shows an array of all user DNs GitLab sees in the LDAP server. The following entry shows an array of all user DNs GitLab sees in the LDAP server.
Note that these are the users for a single LDAP group, not a GitLab group. If These are the users for a single LDAP group, not a GitLab group. If
you have multiple LDAP groups linked to this GitLab group, you see multiple you have multiple LDAP groups linked to this GitLab group, you see multiple
log entries like this - one for each LDAP group. If you don't see an LDAP user log entries like this - one for each LDAP group. If you don't see an LDAP user
DN in this log entry, LDAP is not returning the user when we do the lookup. DN in this log entry, LDAP is not returning the user when we do the lookup.
...@@ -666,7 +666,7 @@ ldapsearch -D "cn=admin,dc=ldap-testing,dc=example,dc=com" \ ...@@ -666,7 +666,7 @@ ldapsearch -D "cn=admin,dc=ldap-testing,dc=example,dc=com" \
-b "dc=ldap-testing,dc=example,dc=com" -b "dc=ldap-testing,dc=example,dc=com"
``` ```
Note that the `bind_dn`, `password`, `port`, `host`, and `base` are all The `bind_dn`, `password`, `port`, `host`, and `base` are all
identical to what's configured in the `gitlab.rb`. identical to what's configured in the `gitlab.rb`.
For more information, see the [official `ldapsearch` documentation](https://linux.die.net/man/1/ldapsearch). For more information, see the [official `ldapsearch` documentation](https://linux.die.net/man/1/ldapsearch).
......
...@@ -280,7 +280,7 @@ but `LocalAccounts` works for authenticating against local, Active Directory acc ...@@ -280,7 +280,7 @@ but `LocalAccounts` works for authenticating against local, Active Directory acc
The policy name is lowercased in the URL. For example, `B2C_1A_signup_signin` The policy name is lowercased in the URL. For example, `B2C_1A_signup_signin`
policy appears as `b2c_1a_signup_sigin`. policy appears as `b2c_1a_signup_sigin`.
Note that the trailing forward slash is required. The trailing forward slash is required.
1. Verify the operation of the OIDC discovery URL and issuer URL, append `.well-known/openid-configuration` 1. Verify the operation of the OIDC discovery URL and issuer URL, append `.well-known/openid-configuration`
to the issuer URL: to the issuer URL:
...@@ -336,7 +336,7 @@ but `LocalAccounts` works for authenticating against local, Active Directory acc ...@@ -336,7 +336,7 @@ but `LocalAccounts` works for authenticating against local, Active Directory acc
- `"accessTokenAcceptedVersion": null` - `"accessTokenAcceptedVersion": null`
- `"signInAudience": "AzureADMyOrg"` - `"signInAudience": "AzureADMyOrg"`
Note that this configuration corresponds with the `Supported account types` setting used when This configuration corresponds with the `Supported account types` setting used when
creating the `IdentityExperienceFramework` app. creating the `IdentityExperienceFramework` app.
#### Keycloak #### Keycloak
......
...@@ -82,7 +82,7 @@ which case the URL would look like: `plain_url: "http://cdn.libravatar.org/avata ...@@ -82,7 +82,7 @@ which case the URL would look like: `plain_url: "http://cdn.libravatar.org/avata
## Usage examples for Microsoft Office 365 ## Usage examples for Microsoft Office 365
If your users are Office 365 users, the `GetPersonaPhoto` service can be used. If your users are Office 365 users, the `GetPersonaPhoto` service can be used.
Note that this service requires a login, so this use case is most useful in a This service requires a login, so this use case is most useful in a
corporate installation where all users have access to Office 365. corporate installation where all users have access to Office 365.
```ruby ```ruby
......
...@@ -86,7 +86,7 @@ options: ...@@ -86,7 +86,7 @@ options:
users. However, in this case only GitLab uses the NFS share so it users. However, in this case only GitLab uses the NFS share so it
is safe. GitLab recommends the `no_root_squash` setting because we need to is safe. GitLab recommends the `no_root_squash` setting because we need to
manage file permissions automatically. Without the setting you may receive manage file permissions automatically. Without the setting you may receive
errors when the Omnibus package tries to alter permissions. Note that GitLab errors when the Omnibus package tries to alter permissions. GitLab
and other bundled components do **not** run as `root` but as non-privileged and other bundled components do **not** run as `root` but as non-privileged
users. The recommendation for `no_root_squash` is to allow the Omnibus package users. The recommendation for `no_root_squash` is to allow the Omnibus package
to set ownership and permissions on files, as needed. In some cases where the to set ownership and permissions on files, as needed. In some cases where the
......
...@@ -241,7 +241,7 @@ The connection settings match those provided by [fog-aws](https://github.com/fog ...@@ -241,7 +241,7 @@ The connection settings match those provided by [fog-aws](https://github.com/fog
#### Oracle Cloud S3 connection settings #### Oracle Cloud S3 connection settings
Note that Oracle Cloud S3 must be sure to use the following settings: Oracle Cloud S3 must be sure to use the following settings:
| Setting | Value | | Setting | Value |
|---------------------------------|---------| |---------------------------------|---------|
...@@ -365,7 +365,7 @@ settings are populated from the previous settings. ...@@ -365,7 +365,7 @@ settings are populated from the previous settings.
azure_storage_access_key = "<AZURE STORAGE ACCESS KEY>" azure_storage_access_key = "<AZURE STORAGE ACCESS KEY>"
``` ```
If you are using a custom Azure storage domain, note that If you are using a custom Azure storage domain,
`azure_storage_domain` does **not** have to be set in the Workhorse `azure_storage_domain` does **not** have to be set in the Workhorse
configuration. This information is exchanged in an API call between configuration. This information is exchanged in an API call between
GitLab Rails and Workhorse. GitLab Rails and Workhorse.
...@@ -690,7 +690,7 @@ When configured either with an instance profile or with the consolidated ...@@ -690,7 +690,7 @@ When configured either with an instance profile or with the consolidated
object configuration, GitLab Workhorse properly uploads files to S3 object configuration, GitLab Workhorse properly uploads files to S3
buckets that have [SSE-S3 or SSE-KMS encryption enabled by buckets that have [SSE-S3 or SSE-KMS encryption enabled by
default](https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html). default](https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html).
Note that customer master keys (CMKs) and SSE-C encryption are [not Customer master keys (CMKs) and SSE-C encryption are [not
supported since this requires sending the encryption keys in every request](https://gitlab.com/gitlab-org/gitlab/-/issues/226006). supported since this requires sending the encryption keys in every request](https://gitlab.com/gitlab-org/gitlab/-/issues/226006).
##### Server-side encryption headers ##### Server-side encryption headers
......
...@@ -76,7 +76,7 @@ the database is read-only: ...@@ -76,7 +76,7 @@ the database is read-only:
-h /var/opt/gitlab/postgresql gitlabhq_production -h /var/opt/gitlab/postgresql gitlabhq_production
``` ```
1. Create the `gitlab_read_only` user. Note that the password is set to `mypassword`, 1. Create the `gitlab_read_only` user. The password is set to `mypassword`,
change that to your liking: change that to your liking:
```sql ```sql
......
...@@ -216,6 +216,13 @@ Lowercase. If you use **MR** as the acronym, spell it out on first use. ...@@ -216,6 +216,13 @@ Lowercase. If you use **MR** as the acronym, spell it out on first use.
Lowercase. Lowercase.
## note that
Do not use.
- Avoid: Note that you can change the settings.
- Use instead: You can change the settings.
## Owner ## Owner
When writing about the Owner role: When writing about the Owner role:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment