From 1768e3eccb91689405e411a3ebcb2622e16dcdd8 Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Mon, 20 Oct 2014 16:18:45 +0200 Subject: [PATCH 1/5] Update the documentation for the LDAP user filter --- doc/integration/ldap.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/doc/integration/ldap.md b/doc/integration/ldap.md index ee472ac3e3b..a89c2d38779 100644 --- a/doc/integration/ldap.md +++ b/doc/integration/ldap.md @@ -26,13 +26,20 @@ The filter must comply with [RFC 4515](http://tools.ietf.org/search/rfc4515). ```ruby # For omnibus-gitlab gitlab_rails['ldap_user_filter'] = '(employeeType=developer)' +gitlab_rails['ldap_servers'] = YAML.load <<-EOS +main: + # snip... + user_filter: '(employeeType=developer)' +EOS ``` ```yaml # For installations from source production: ldap: - user_filter: '(employeeType=developer)' + servers: + main: + user_filter: '(employeeType=developer)' ``` Tip: if you want to limit access to the nested members of an Active Directory group you can use the following syntax: From 0b78bd7a42a341bb227fb544b5b12abf8e152a41 Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Mon, 20 Oct 2014 16:22:36 +0200 Subject: [PATCH 2/5] Keep the legacy LDAP syntax in the documentation --- doc/integration/ldap.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/doc/integration/ldap.md b/doc/integration/ldap.md index a89c2d38779..869850d29d7 100644 --- a/doc/integration/ldap.md +++ b/doc/integration/ldap.md @@ -24,22 +24,31 @@ If you want to limit all GitLab access to a subset of the LDAP users on your LDA The filter must comply with [RFC 4515](http://tools.ietf.org/search/rfc4515). ```ruby -# For omnibus-gitlab -gitlab_rails['ldap_user_filter'] = '(employeeType=developer)' +# For omnibus packages; new LDAP server syntax gitlab_rails['ldap_servers'] = YAML.load <<-EOS main: # snip... user_filter: '(employeeType=developer)' EOS + +# omnibus package; legacy syntax +gitlab_rails['ldap_user_filter'] = '(employeeType=developer)' ``` ```yaml -# For installations from source +# For installations from source; new LDAP server syntax production: ldap: servers: main: + # snip... user_filter: '(employeeType=developer)' + +# installations from source; legacy syntax +production: + ldap: + # snip... + user_filter: '(employeeType=developer)' ``` Tip: if you want to limit access to the nested members of an Active Directory group you can use the following syntax: From 46cdb931d8a48febd459cf932b6e7c7b626ec452 Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Mon, 20 Oct 2014 16:41:28 +0200 Subject: [PATCH 3/5] Remove legacy LDAP configuration examples --- doc/integration/ldap.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/doc/integration/ldap.md b/doc/integration/ldap.md index 869850d29d7..df72b17ab1a 100644 --- a/doc/integration/ldap.md +++ b/doc/integration/ldap.md @@ -30,9 +30,6 @@ main: # snip... user_filter: '(employeeType=developer)' EOS - -# omnibus package; legacy syntax -gitlab_rails['ldap_user_filter'] = '(employeeType=developer)' ``` ```yaml @@ -43,12 +40,6 @@ production: main: # snip... user_filter: '(employeeType=developer)' - -# installations from source; legacy syntax -production: - ldap: - # snip... - user_filter: '(employeeType=developer)' ``` Tip: if you want to limit access to the nested members of an Active Directory group you can use the following syntax: From b1b6761e05de0b675e31fb227939fff36618a282 Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Mon, 20 Oct 2014 16:41:37 +0200 Subject: [PATCH 4/5] Add LDAP configuration documentation --- doc/integration/ldap.md | 89 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) diff --git a/doc/integration/ldap.md b/doc/integration/ldap.md index df72b17ab1a..56b0d826adb 100644 --- a/doc/integration/ldap.md +++ b/doc/integration/ldap.md @@ -6,6 +6,95 @@ The first time a user signs in with LDAP credentials, GitLab will create a new G GitLab user attributes such as nickname and email will be copied from the LDAP user entry. +## Configuring GitLab for LDAP integration + +To enable GitLab LDAP integration you need to add your LDAP server settings in `/etc/gitlab/gitlab.rb` or `/home/git/gitlab/config/gitlab.yml`. +In GitLab Enterprise Edition you can have multiple LDAP servers connected to one GitLab server. + +Please note that before version 7.4, GitLab used a different syntax for configuring LDAP integration. +The old LDAP integration syntax still works in GitLab 7.4. +If your `gitlab.rb` or `gitlab.yml` file contains LDAP settings in both the old syntax and the new syntax, only the __old__ syntax will be used by GitLab. + +```ruby +# For omnibus packages +gitlab_rails['ldap_enabled'] = true +gitlab_rails['ldap_servers'] = YAML.load <<-EOS # remember to close this block with 'EOS' below +main: # 'main' is the GitLab 'provider ID' of this LDAP server + ## label + # + # A human-friendly name for your LDAP server. It is OK to change the label later, + # for instance if you find out it is too large to fit on the web page. + # + # Example: 'Paris' or 'Acme, Ltd.' + label: 'LDAP' + + host: '_your_ldap_server' + port: 636 + uid: 'sAMAccountName' + method: 'ssl' # "tls" or "ssl" or "plain" + bind_dn: '_the_full_dn_of_the_user_you_will_bind_with' + password: '_the_password_of_the_bind_user' + + # This setting specifies if LDAP server is Active Directory LDAP server. + # For non AD servers it skips the AD specific queries. + # If your LDAP server is not AD, set this to false. + active_directory: true + + # If allow_username_or_email_login is enabled, GitLab will ignore everything + # after the first '@' in the LDAP username submitted by the user on login. + # + # Example: + # - the user enters 'jane.doe@example.com' and 'p@ssw0rd' as LDAP credentials; + # - GitLab queries the LDAP server with 'jane.doe' and 'p@ssw0rd'. + # + # If you are using "uid: 'userPrincipalName'" on ActiveDirectory you need to + # disable this setting, because the userPrincipalName contains an '@'. + allow_username_or_email_login: false + + # Base where we can search for users + # + # Ex. ou=People,dc=gitlab,dc=example + # + base: '' + + # Filter LDAP users + # + # Format: RFC 4515 http://tools.ietf.org/search/rfc4515 + # Ex. (employeeType=developer) + # + # Note: GitLab does not support omniauth-ldap's custom filter syntax. + # + user_filter: '' + +# GitLab EE only: add more LDAP servers +# Choose an ID made of a-z and 0-9 . This ID will be stored in the database +# so that GitLab can remember which LDAP server a user belongs to. +# uswest2: +# label: +# host: +# .... +EOS +``` + +If you are using a GitLab installation from source you can find the LDAP settings in `/home/git/gitlab/config/gitlab.yml`: + +``` +production: + # snip... + ldap: + enabled: false + servers: + main: # 'main' is the GitLab 'provider ID' of this LDAP server + ## label + # + # A human-friendly name for your LDAP server. It is OK to change the label later, + # for instance if you find out it is too large to fit on the web page. + # + # Example: 'Paris' or 'Acme, Ltd.' + label: 'LDAP' + # snip... +``` + ## Enabling LDAP sign-in for existing GitLab users When a user signs in to GitLab with LDAP for the first time, and their LDAP email address is the primary email address of an existing GitLab user, then the LDAP DN will be associated with the existing user. From e6631c87860c182ce9c838da6b4ad8d570061dfb Mon Sep 17 00:00:00 2001 From: Sytse Sijbrandij Date: Tue, 21 Oct 2014 13:21:58 +0200 Subject: [PATCH 5/5] Merge request for blog post on gitlab.com next time. --- doc/release/monthly.md | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/release/monthly.md b/doc/release/monthly.md index c46a3ed9c93..a9253339e5a 100644 --- a/doc/release/monthly.md +++ b/doc/release/monthly.md @@ -191,6 +191,7 @@ It is important to do this as soon as possible, so we can catch any errors befor - Ask Dmitriy to add screenshots to the WIP MR. - Decide with team who will be the MVP user. - Add a note if there are security fixes: This release fixes an important security issue and we advise everyone to upgrade as soon as possible. +- Create a merge request on [GitLab.com](https://gitlab.com/gitlab-com/www-gitlab-com/tree/master) - Assign to one reviewer who will fix spelling issues by editing the branch (can use the online editor) - After the reviewer is finished the whole team will be mentioned to give their suggestions via line comments