diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2020-01-24 03:08:51 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2020-01-24 03:08:51 +0300 |
commit | 1ce6af4aad0107b6d604f89a3c0b530476a10165 (patch) | |
tree | 4956b0d395cd9232bca14f83daca3cd8616cc842 /doc/user | |
parent | 24256212ea84e6fb6509f6fb317a2d2bac3d0d06 (diff) |
Add latest changes from gitlab-org/gitlab@master
Diffstat (limited to 'doc/user')
-rw-r--r-- | doc/user/admin_area/activating_deactivating_users.md | 4 | ||||
-rw-r--r-- | doc/user/admin_area/blocking_unblocking_users.md | 4 | ||||
-rw-r--r-- | doc/user/group/saml_sso/index.md | 37 | ||||
-rw-r--r-- | doc/user/group/saml_sso/scim_setup.md | 22 | ||||
-rw-r--r-- | doc/user/permissions.md | 2 | ||||
-rw-r--r-- | doc/user/project/settings/import_export.md | 10 |
6 files changed, 72 insertions, 7 deletions
diff --git a/doc/user/admin_area/activating_deactivating_users.md b/doc/user/admin_area/activating_deactivating_users.md index 78a07f4a04e..5836129b222 100644 --- a/doc/user/admin_area/activating_deactivating_users.md +++ b/doc/user/admin_area/activating_deactivating_users.md @@ -38,7 +38,7 @@ Please note that for the deactivation option to be visible to an admin, the user - Must be currently active. - Should not have any activity in the last 180 days. -Users can also be deactivated using the [GitLab API](../../api/users.html#deactivate-user). +Users can also be deactivated using the [GitLab API](../../api/users.md#deactivate-user). NOTE: **Note:** A deactivated user does not consume a [seat](../../subscriptions/index.md#managing-subscriptions). @@ -56,7 +56,7 @@ To do this: 1. Select a user. 1. Under the **Account** tab, click **Activate user**. -Users can also be activated using the [GitLab API](../../api/users.html#activate-user). +Users can also be activated using the [GitLab API](../../api/users.md#activate-user). NOTE: **Note:** Activating a user will change the user's state to active and it consumes a diff --git a/doc/user/admin_area/blocking_unblocking_users.md b/doc/user/admin_area/blocking_unblocking_users.md index 8868170169e..cb86e28ff1e 100644 --- a/doc/user/admin_area/blocking_unblocking_users.md +++ b/doc/user/admin_area/blocking_unblocking_users.md @@ -27,7 +27,7 @@ A blocked user: Personal projects, and group and user history of the blocked user will be left intact. -Users can also be blocked using the [GitLab API](../../api/users.html#block-user). +Users can also be blocked using the [GitLab API](../../api/users.md#block-user). NOTE: **Note:** A blocked user does not consume a [seat](../../subscriptions/index.md#managing-subscriptions). @@ -41,7 +41,7 @@ A blocked user can be unblocked from the Admin Area. To do this: 1. Select a user. 1. Under the **Account** tab, click **Unblock user**. -Users can also be unblocked using the [GitLab API](../../api/users.html#unblock-user). +Users can also be unblocked using the [GitLab API](../../api/users.md#unblock-user). NOTE: **Note:** Unblocking a user will change the user's state to active and it consumes a diff --git a/doc/user/group/saml_sso/index.md b/doc/user/group/saml_sso/index.md index 5fe2d0da5c8..e0028e7124d 100644 --- a/doc/user/group/saml_sso/index.md +++ b/doc/user/group/saml_sso/index.md @@ -6,7 +6,9 @@ type: reference, howto > Introduced in [GitLab.com Silver](https://about.gitlab.com/pricing/) 11.0. -SAML on GitLab.com allows users to be automatically added to a group, and then allows those users to sign into GitLab.com. Users should already have an account on the GitLab instance, or can create one when logging in for the first time. +SAML on GitLab.com allows users to be added to a group. Those users can then sign in to GitLab.com. If such users don't already have an account on the GitLab instance, they can create one when signing in for the first time. + +If you follow our guidance to automate user provisioning using [SCIM](scim_setup.md) or [group managed accounts](#group-managed-accounts), you do not need to create such accounts manually. User synchronization for GitLab.com is partially supported using [SCIM](scim_setup.md). @@ -91,7 +93,7 @@ assertions to be able to create a user. | First Name | `first_name`, `firstname`, `firstName` | | Last Name | `last_name`, `lastname`, `lastName` | -## Metadata configuration +### Metadata configuration GitLab provides metadata XML that can be used to configure your Identity Provider. @@ -111,6 +113,37 @@ Once you've set up your identity provider to work with GitLab, you'll need to co ![Group SAML Settings for GitLab.com](img/group_saml_settings.png) +## User access and management + +Once Group SSO is configured and enabled, users can access the GitLab.com group through the identity provider's dashboard. If [SCIM](scim_setup.md) is configured, please see the [user access and linking setup section on the SCIM page](scim_setup.md#user-access-and-linking-setup). + +When a user tries to sign in with Group SSO, they'll need an account that's configured with one of the following: + +- [SCIM](scim_setup.md). +- [Group-managed accounts](#group-managed-accounts). +- A GitLab.com account. + +1. Click on the GitLab app in the identity provider's dashboard, or visit the Group's GitLab SSO URL. +1. Sign in to GitLab.com. The next time you connect on the same browser, you won't have to sign in again provided the active session has not expired. +1. Click on the **Authorize** button. + +On subsequent visits, users can access the group through the identify provider's dashboard or by visiting links directly. With the **enforce SSO** option turned on, users will be redirected to log in through the identity provider as required. + +### Role + +Upon first sign in, a new user is added to the parent group with the Guest role. Existing members with an appropriate role will have to elevate users to a higher role where relevant. + +If a user is already a member of the group, linking the SAML identity does not change their role. + +### Blocking access + +To rescind access to the group: + +1. Remove the user from the identity provider or users list for the specific app. +1. Remove the user from the GitLab.com group. + +Even when **enforce SSO** is active, we recommend removing the user from the group. Otherwise, the user can sign in through the identity provider if they do not have an active session. + ## Providers NOTE: **Note:** GitLab is unable to provide support for IdPs that are not listed here. diff --git a/doc/user/group/saml_sso/scim_setup.md b/doc/user/group/saml_sso/scim_setup.md index a117364a355..2c8848b79df 100644 --- a/doc/user/group/saml_sso/scim_setup.md +++ b/doc/user/group/saml_sso/scim_setup.md @@ -117,6 +117,28 @@ bottom of the **Provisioning** screen, together with a link to the audit logs. CAUTION: **Warning:** Once synchronized, changing the field mapped to `id` and `externalId` will likely cause provisioning errors, duplicate users, and prevent existing users from accessing the GitLab group. +## User access and linking setup + +As long as [Group SAML](index.md) has been configured, prior to turning on sync, existing GitLab.com users can link to their accounts in one of the following ways, before synchronization is active: + +- By updating their *primary* email address in their GitLab.com user account to match their identity provider's user profile email address. +- By following these steps: + + 1. Sign in to GitLab.com if needed. + 1. Click on the GitLab app in the identity provider's dashboard or visit the **GitLab single sign on URL**. + 1. Click on the **Authorize** button. + +New users and existing users on subsequent visits can access the group through the identify provider's dashboard or by visiting links directly. + +For role information, please see the [Group SAML page](index.md#user-access-and-management) + +### Blocking access + +To rescind access to the group, we recommend removing the user from the identity +provider or users list for the specific app. + +Upon the next sync, the user will be deprovisioned, which means that the user will be removed from the group. The user account will not be deleted unless using [group managed accounts](index.md#group-managed-accounts). + ## Troubleshooting This section contains possible solutions for problems you might encounter. diff --git a/doc/user/permissions.md b/doc/user/permissions.md index 57873494a48..9a32f0adfaa 100644 --- a/doc/user/permissions.md +++ b/doc/user/permissions.md @@ -425,7 +425,7 @@ for details about the pipelines security model. ## LDAP users permissions Since GitLab 8.15, LDAP user permissions can now be manually overridden by an admin user. -Read through the documentation on [LDAP users permissions](../administration/auth/how_to_configure_ldap_gitlab_ee/index.html) to learn more. +Read through the documentation on [LDAP users permissions](../administration/auth/how_to_configure_ldap_gitlab_ee/index.md) to learn more. ## Project aliases diff --git a/doc/user/project/settings/import_export.md b/doc/user/project/settings/import_export.md index f5cfa256f5d..2c90a17f37e 100644 --- a/doc/user/project/settings/import_export.md +++ b/doc/user/project/settings/import_export.md @@ -123,3 +123,13 @@ NOTE: **Note:** If use of the `Internal` visibility level [is restricted](../../../public_access/public_access.md#restricting-the-use-of-public-or-internal-projects), all imported projects are given the visibility of `Private`. + +## Rate limits + +To help avoid abuse, users are rate limited to: + +| Request Type | Limit | +| ---------------- | --------------------------- | +| Export | 1 project per 5 minutes | +| Download export | 10 projects per 10 minutes | +| Import | 30 projects per 10 minutes | |