All LDAP users are blocked on login

I cannot figure out what is wrong with my ldap setup, I did a packed capture and the LDAP bind was successful, and the LDAP user is created properly, but it always blocks the account. Manually unblocking the account doesn’t help, the next LDAP authentication blocks it again.

I’ve tried ldaps and regular ldap, also anonoymous bind, but none of it makes any difference.

I’ve tried removing the ldap identity for the user as some other people have suggested and it didn’t help. I have also manually unblocked the user via rake, but that didn’t help either.

Is there some missing step, where I have to add users to a group or something, before LDAP auth works properly?

root@gitlab-ce-3-wt9fb:/# gitlab-rake gitlab:env:info

System information
System:
Current User:   git
Using RVM:      no
Ruby Version:   2.3.6p384
Gem Version:    2.6.13
Bundler Version:1.13.7
Rake Version:   12.3.0
Redis Version:  3.2.11
Git Version:    2.14.3
Sidekiq Version:5.0.5
Go Version:     unknown

GitLab information
Version:        10.5.6
Revision:       4b41d48
Directory:      /opt/gitlab/embedded/service/gitlab-rails
DB Adapter:     postgresql
URL:            http://gitlab.192.168.99.100.nip.io
HTTP Clone URL: http://gitlab.192.168.99.100.nip.io/some-group/some-project.git
SSH Clone URL:  git@gitlab.192.168.99.100.nip.io:some-group/some-project.git
Using LDAP:     yes
Using Omniauth: no

GitLab Shell
Version:        6.0.3
Repository storage paths:
- default:      /gitlab-data/git-data/repositories
Hooks:          /opt/gitlab/embedded/service/gitlab-shell/hooks
Git:            /opt/gitlab/embedded/bin/git

root@gitlab-ce-3-wt9fb:/# gitlab-rake gitlab:check --trace
** Invoke gitlab:check (first_time)
** Invoke gitlab:gitlab_shell:check (first_time)
** Invoke gitlab_environment (first_time)
** Invoke environment (first_time)
** Execute environment
** Execute gitlab_environment
** Execute gitlab:gitlab_shell:check
Checking GitLab Shell ...

GitLab Shell version >= 6.0.3 ? ... OK (6.0.3)
Repo base directory exists?
default... yes
Repo storage directories are symlinks?
default... no
Repo paths owned by git:root, or git:git?
default... yes
Repo paths access is drwxrws---?
default... yes
hooks directories in repos are links: ... can't check, you have no projects
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Check GitLab API access: OK
Redis available via internal API: OK

Access to /gitlab-data/ssh/authorized_keys: OK
gitlab-shell self-check successful

Checking GitLab Shell ... Finished

** Invoke gitlab:sidekiq:check (first_time)
** Invoke gitlab_environment
** Execute gitlab:sidekiq:check
Checking Sidekiq ...

Running? ... yes
Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

** Invoke gitlab:incoming_email:check (first_time)
** Invoke gitlab_environment
** Execute gitlab:incoming_email:check
Reply by email is disabled in config/gitlab.yml
** Invoke gitlab:ldap:check (first_time)
** Invoke gitlab_environment
** Execute gitlab:ldap:check
Checking LDAP ...

Server: ldapmain
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)

Checking LDAP ... Finished

** Invoke gitlab:app:check (first_time)
** Invoke gitlab_environment
** Execute gitlab:app:check
Checking GitLab ...

Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet)
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ... can't check, you have no projects
Redis version >= 2.8.0? ... yes
Ruby version >= 2.3.5 ? ... yes (2.3.6)
Git version >= 2.9.5 ? ... yes (2.14.3)
Git user has default SSH configuration? ... yes
Active users: ... 1

Checking GitLab ... Finished

** Execute gitlab:check

ldap config

gitlab_rails['ldap_enabled'] = true

gitlab_rails['ldap_servers'] = YAML.load <<-'EOS' # remember to close this block with 'EOS' below
   main: # 'main' is the GitLab 'provider ID' of this LDAP server
     label: 'LDAP'
     host: '192.168.99.1'
     port: 1636
     uid: 'uid'
     method: 'ssl' # "tls" or "ssl" or "plain"
     bind_dn: 'uid=username,ou=people,dc=company,dc=com,dc=au'
     password: 'password1'
     active_directory: false
     allow_username_or_email_login: true
     block_auto_created_users: false
     base: 'dc=company,dc=com,dc=au'
     verify_certificates: false
     user_filter: ''
     attributes:
       username: ['uid', 'userid', 'sAMAccountName']
       email:    ['mail', 'email', 'userPrincipalName']
       name:       'cn'
       first_name: 'givenName'
       last_name:  'sn'
     group_base: 'ou=groups,dc=company,dc=com,dc=au'
     admin_group: 'company administrators'
EOS

Any pointers?

I just figured it out.

I think the optional attributes are the problem:

attributes:
  username: [‘uid’, ‘userid’, ‘sAMAccountName’]
  email: [‘mail’, ‘email’, ‘userPrincipalName’]

I changed it to:

attributes:
  username: ‘uid’
  email: ‘mail’

And it started working.

Maybe all those attributes have to exist for it not to fail?

1 Like