4d64a32c88
LDAP Sync blocked user edgecases Allow GitLab admins to block otherwise valid GitLab LDAP users (https://gitlab.com/gitlab-org/gitlab-ce/issues/3462) Based on the discussion on the original issue, we are going to differentiate "normal" block operations to the ldap automatic ones in order to make some decisions when its one or the other. Expected behavior: - [x] "ldap_blocked" users respond to both `blocked?` and `ldap_blocked?` - [x] "ldap_blocked" users can't be unblocked by the Admin UI - [x] "ldap_blocked" users can't be unblocked by the API - [x] Block operations that are originated from LDAP synchronization will flag user as "ldap_blocked" - [x] Only "ldap_blocked" users will be automatically unblocked by LDAP synchronization - [x] When LDAP identity is removed, we should convert `ldap_blocked` into `blocked` Mockup for the Admin UI with both "ldap_blocked" and normal "blocked" users:  There will be another MR for the EE version. See merge request !2242
68 lines
1.6 KiB
Ruby
68 lines
1.6 KiB
Ruby
# LDAP authorization model
|
|
#
|
|
# * Check if we are allowed access (not blocked)
|
|
#
|
|
module Gitlab
|
|
module LDAP
|
|
class Access
|
|
attr_reader :provider, :user
|
|
|
|
def self.open(user, &block)
|
|
Gitlab::LDAP::Adapter.open(user.ldap_identity.provider) do |adapter|
|
|
block.call(self.new(user, adapter))
|
|
end
|
|
end
|
|
|
|
def self.allowed?(user)
|
|
self.open(user) do |access|
|
|
if access.allowed?
|
|
user.last_credential_check_at = Time.now
|
|
user.save
|
|
true
|
|
else
|
|
false
|
|
end
|
|
end
|
|
end
|
|
|
|
def initialize(user, adapter=nil)
|
|
@adapter = adapter
|
|
@user = user
|
|
@provider = user.ldap_identity.provider
|
|
end
|
|
|
|
def allowed?
|
|
if ldap_user
|
|
return true unless ldap_config.active_directory
|
|
|
|
# Block user in GitLab if he/she was blocked in AD
|
|
if Gitlab::LDAP::Person.disabled_via_active_directory?(user.ldap_identity.extern_uid, adapter)
|
|
user.ldap_block
|
|
false
|
|
else
|
|
user.activate if user.ldap_blocked?
|
|
true
|
|
end
|
|
else
|
|
# Block the user if they no longer exist in LDAP/AD
|
|
user.ldap_block
|
|
false
|
|
end
|
|
rescue
|
|
false
|
|
end
|
|
|
|
def adapter
|
|
@adapter ||= Gitlab::LDAP::Adapter.new(provider)
|
|
end
|
|
|
|
def ldap_config
|
|
Gitlab::LDAP::Config.new(provider)
|
|
end
|
|
|
|
def ldap_user
|
|
@ldap_user ||= Gitlab::LDAP::Person.find_by_dn(user.ldap_identity.extern_uid, adapter)
|
|
end
|
|
end
|
|
end
|
|
end
|