Add latest changes from gitlab-org/gitlab@master

2 files changed, 318 insertions, 335 deletions

diff --git a/spec/features/admin/admin_appearance_spec.rb b/spec/features/admin/admin_appearance_spec.rb
index 71c904b3a19..2a9bff55dce 100644
--- a/spec/features/admin/admin_appearance_spec.rb
+++ b/spec/features/admin/admin_appearance_spec.rb
@@ -10,189 +10,180 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
     stub_feature_flags(edit_user_profile_vue: false)
   end
 
-  flag_values = [true, false]
-  flag_values.each do |val|
-    context "with #{val}" do
-      before do
-        stub_feature_flags(restyle_login_page: val)
-      end
+  it 'create new appearance' do
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
+    visit admin_application_settings_appearances_path
+
+    fill_in 'appearance_title', with: 'MyCompany'
+    fill_in 'appearance_description', with: 'dev server'
+    fill_in 'appearance_pwa_name', with: 'GitLab PWA'
+    fill_in 'appearance_pwa_short_name', with: 'GitLab'
+    fill_in 'appearance_pwa_description', with: 'GitLab as PWA'
+    fill_in 'appearance_new_project_guidelines', with: 'Custom project guidelines'
+    fill_in 'appearance_profile_image_guidelines', with: 'Custom profile image guidelines'
+    click_button 'Update appearance settings'
+
+    expect(page).to have_current_path admin_application_settings_appearances_path, ignore_query: true
+    expect(page).to have_content 'Appearance'
+
+    expect(page).to have_field('appearance_title', with: 'MyCompany')
+    expect(page).to have_field('appearance_description', with: 'dev server')
+    expect(page).to have_field('appearance_pwa_name', with: 'GitLab PWA')
+    expect(page).to have_field('appearance_pwa_short_name', with: 'GitLab')
+    expect(page).to have_field('appearance_pwa_description', with: 'GitLab as PWA')
+    expect(page).to have_field('appearance_new_project_guidelines', with: 'Custom project guidelines')
+    expect(page).to have_field('appearance_profile_image_guidelines', with: 'Custom profile image guidelines')
+    expect(page).to have_content 'Last edit'
+  end
 
-      it 'create new appearance' do
-        sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
-        visit admin_application_settings_appearances_path
+  it 'preview sign-in page appearance' do
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
 
-        fill_in 'appearance_title', with: 'MyCompany'
-        fill_in 'appearance_description', with: 'dev server'
-        fill_in 'appearance_pwa_name', with: 'GitLab PWA'
-        fill_in 'appearance_pwa_short_name', with: 'GitLab'
-        fill_in 'appearance_pwa_description', with: 'GitLab as PWA'
-        fill_in 'appearance_new_project_guidelines', with: 'Custom project guidelines'
-        fill_in 'appearance_profile_image_guidelines', with: 'Custom profile image guidelines'
-        click_button 'Update appearance settings'
-
-        expect(page).to have_current_path admin_application_settings_appearances_path, ignore_query: true
-        expect(page).to have_content 'Appearance'
-
-        expect(page).to have_field('appearance_title', with: 'MyCompany')
-        expect(page).to have_field('appearance_description', with: 'dev server')
-        expect(page).to have_field('appearance_pwa_name', with: 'GitLab PWA')
-        expect(page).to have_field('appearance_pwa_short_name', with: 'GitLab')
-        expect(page).to have_field('appearance_pwa_description', with: 'GitLab as PWA')
-        expect(page).to have_field('appearance_new_project_guidelines', with: 'Custom project guidelines')
-        expect(page).to have_field('appearance_profile_image_guidelines', with: 'Custom profile image guidelines')
-        expect(page).to have_content 'Last edit'
-      end
+    visit admin_application_settings_appearances_path
+    click_link "Sign-in page"
 
-      it 'preview sign-in page appearance' do
-        sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
+    expect(find('#login')).to be_disabled
+    expect(find('#password')).to be_disabled
+    expect(find('button')).to be_disabled
 
-        visit admin_application_settings_appearances_path
-        click_link "Sign-in page"
+    expect_custom_sign_in_appearance(appearance)
+  end
 
-        expect(find('#login')).to be_disabled
-        expect(find('#password')).to be_disabled
-        expect(find('button')).to be_disabled
+  it 'preview new project page appearance', :js do
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
 
-        expect_custom_sign_in_appearance(appearance)
-      end
+    visit admin_application_settings_appearances_path
+    click_link "New project page"
+
+    expect_custom_new_project_appearance(appearance)
+  end
 
-      it 'preview new project page appearance', :js do
-        sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
+  context 'Custom system header and footer' do
+    before do
+      sign_in(admin)
+      gitlab_enable_admin_mode_sign_in(admin)
+    end
 
+    context 'when system header and footer messages are empty' do
+      it 'shows custom system header and footer fields' do
         visit admin_application_settings_appearances_path
-        click_link "New project page"
 
-        expect_custom_new_project_appearance(appearance)
+        expect(page).to have_field('appearance_header_message', with: '')
+        expect(page).to have_field('appearance_footer_message', with: '')
+        expect(page).to have_field('appearance_message_background_color')
+        expect(page).to have_field('appearance_message_font_color')
       end
+    end
 
-      context 'Custom system header and footer' do
-        before do
-          sign_in(admin)
-          gitlab_enable_admin_mode_sign_in(admin)
-        end
-
-        context 'when system header and footer messages are empty' do
-          it 'shows custom system header and footer fields' do
-            visit admin_application_settings_appearances_path
-
-            expect(page).to have_field('appearance_header_message', with: '')
-            expect(page).to have_field('appearance_footer_message', with: '')
-            expect(page).to have_field('appearance_message_background_color')
-            expect(page).to have_field('appearance_message_font_color')
-          end
-        end
-
-        context 'when system header and footer messages are not empty' do
-          before do
-            appearance.update!(header_message: 'Foo', footer_message: 'Bar')
-          end
-
-          it 'shows custom system header and footer fields' do
-            visit admin_application_settings_appearances_path
-
-            expect(page).to have_field('appearance_header_message', with: appearance.header_message)
-            expect(page).to have_field('appearance_footer_message', with: appearance.footer_message)
-            expect(page).to have_field('appearance_message_background_color')
-            expect(page).to have_field('appearance_message_font_color')
-          end
-        end
+    context 'when system header and footer messages are not empty' do
+      before do
+        appearance.update!(header_message: 'Foo', footer_message: 'Bar')
       end
 
-      it 'custom sign-in page' do
-        visit new_user_session_path
+      it 'shows custom system header and footer fields' do
+        visit admin_application_settings_appearances_path
 
-        expect_custom_sign_in_appearance(appearance)
+        expect(page).to have_field('appearance_header_message', with: appearance.header_message)
+        expect(page).to have_field('appearance_footer_message', with: appearance.footer_message)
+        expect(page).to have_field('appearance_message_background_color')
+        expect(page).to have_field('appearance_message_font_color')
       end
+    end
+  end
 
-      it 'custom new project page', :js do
-        sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
-        visit new_project_path
-        click_link 'Create blank project'
+  it 'custom sign-in page' do
+    visit new_user_session_path
 
-        expect_custom_new_project_appearance(appearance)
-      end
+    expect_custom_sign_in_appearance(appearance)
+  end
 
-      context 'Profile page with custom profile image guidelines' do
-        before do
-          sign_in(admin)
-          gitlab_enable_admin_mode_sign_in(admin)
-          visit admin_application_settings_appearances_path
-          fill_in 'appearance_profile_image_guidelines', with: 'Custom profile image guidelines, please :smile:!'
-          click_button 'Update appearance settings'
-        end
-
-        it 'renders guidelines when set' do
-          sign_in create(:user)
-          visit profile_path
-
-          expect(page).to have_content 'Custom profile image guidelines, please 😄!'
-        end
-      end
+  it 'custom new project page', :js do
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
+    visit new_project_path
+    click_link 'Create blank project'
 
-      it 'appearance logo' do
-        sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
-        visit admin_application_settings_appearances_path
+    expect_custom_new_project_appearance(appearance)
+  end
 
-        attach_file(:appearance_logo, logo_fixture)
-        click_button 'Update appearance settings'
-        expect(page).to have_css(logo_selector)
+  context 'Profile page with custom profile image guidelines' do
+    before do
+      sign_in(admin)
+      gitlab_enable_admin_mode_sign_in(admin)
+      visit admin_application_settings_appearances_path
+      fill_in 'appearance_profile_image_guidelines', with: 'Custom profile image guidelines, please :smile:!'
+      click_button 'Update appearance settings'
+    end
 
-        click_link 'Remove logo'
-        expect(page).not_to have_css(logo_selector)
-      end
+    it 'renders guidelines when set' do
+      sign_in create(:user)
+      visit profile_path
 
-      it 'appearance pwa icon' do
-        sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
-        visit admin_application_settings_appearances_path
+      expect(page).to have_content 'Custom profile image guidelines, please 😄!'
+    end
+  end
 
-        attach_file(:appearance_pwa_icon, logo_fixture)
-        click_button 'Update appearance settings'
-        expect(page).to have_css(pwa_icon_selector)
+  it 'appearance logo' do
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
+    visit admin_application_settings_appearances_path
 
-        click_link 'Remove icon'
-        expect(page).not_to have_css(pwa_icon_selector)
-      end
+    attach_file(:appearance_logo, logo_fixture)
+    click_button 'Update appearance settings'
+    expect(page).to have_css(logo_selector)
 
-      it 'header logos' do
-        sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
-        visit admin_application_settings_appearances_path
+    click_link 'Remove logo'
+    expect(page).not_to have_css(logo_selector)
+  end
 
-        attach_file(:appearance_header_logo, logo_fixture)
-        click_button 'Update appearance settings'
-        expect(page).to have_css(header_logo_selector)
+  it 'appearance pwa icon' do
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
+    visit admin_application_settings_appearances_path
 
-        click_link 'Remove header logo'
-        expect(page).not_to have_css(header_logo_selector)
-      end
+    attach_file(:appearance_pwa_icon, logo_fixture)
+    click_button 'Update appearance settings'
+    expect(page).to have_css(pwa_icon_selector)
 
-      it 'Favicon' do
-        sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
-        visit admin_application_settings_appearances_path
+    click_link 'Remove icon'
+    expect(page).not_to have_css(pwa_icon_selector)
+  end
 
-        attach_file(:appearance_favicon, logo_fixture)
-        click_button 'Update appearance settings'
+  it 'header logos' do
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
+    visit admin_application_settings_appearances_path
 
-        expect(page).to have_css('.appearance-light-logo-preview')
+    attach_file(:appearance_header_logo, logo_fixture)
+    click_button 'Update appearance settings'
+    expect(page).to have_css(header_logo_selector)
 
-        click_link 'Remove favicon'
+    click_link 'Remove header logo'
+    expect(page).not_to have_css(header_logo_selector)
+  end
 
-        expect(page).not_to have_css('.appearance-light-logo-preview')
+  it 'Favicon' do
+    sign_in(admin)
+    gitlab_enable_admin_mode_sign_in(admin)
+    visit admin_application_settings_appearances_path
 
-        # allowed file types
-        attach_file(:appearance_favicon, Rails.root.join('spec', 'fixtures', 'sanitized.svg'))
-        click_button 'Update appearance settings'
+    attach_file(:appearance_favicon, logo_fixture)
+    click_button 'Update appearance settings'
 
-        expect(page).to have_content 'Favicon You are not allowed to upload "svg" files, allowed types: png, ico'
-      end
-    end
+    expect(page).to have_css('.appearance-light-logo-preview')
+
+    click_link 'Remove favicon'
+
+    expect(page).not_to have_css('.appearance-light-logo-preview')
+
+    # allowed file types
+    attach_file(:appearance_favicon, Rails.root.join('spec', 'fixtures', 'sanitized.svg'))
+    click_button 'Update appearance settings'
+
+    expect(page).to have_content 'Favicon You are not allowed to upload "svg" files, allowed types: png, ico'
   end
 
   def expect_custom_sign_in_appearance(appearance)
diff --git a/spec/features/admin/admin_mode/login_spec.rb b/spec/features/admin/admin_mode/login_spec.rb
index f2262464386..5e4935ee4b1 100644
--- a/spec/features/admin/admin_mode/login_spec.rb
+++ b/spec/features/admin/admin_mode/login_spec.rb
@@ -13,256 +13,248 @@ RSpec.describe 'Admin Mode Login', feature_category: :system_access do
       click_button 'Verify code'
     end
 
-    flag_values = [true, false]
-    flag_values.each do |val|
-      context "with #{val}" do
-        before do
-          stub_feature_flags(restyle_login_page: val)
-        end
-        context 'with valid username/password' do
-          let(:user) { create(:admin, :two_factor) }
+    context 'with valid username/password' do
+      let(:user) { create(:admin, :two_factor) }
 
-          context 'using one-time code' do
-            it 'blocks login if we reuse the same code immediately' do
-              gitlab_sign_in(user, remember: true)
+      context 'using one-time code' do
+        it 'blocks login if we reuse the same code immediately' do
+          gitlab_sign_in(user, remember: true)
 
-              expect(page).to have_content(_('Enter verification code'))
+          expect(page).to have_content(_('Enter verification code'))
 
-              repeated_otp = user.current_otp
-              enter_code(repeated_otp)
-              gitlab_enable_admin_mode_sign_in(user, use_mock_admin_mode: false)
+          repeated_otp = user.current_otp
+          enter_code(repeated_otp)
+          gitlab_enable_admin_mode_sign_in(user, use_mock_admin_mode: false)
 
-              expect(page).to have_content(_('Enter verification code'))
+          expect(page).to have_content(_('Enter verification code'))
 
-              enter_code(repeated_otp)
+          enter_code(repeated_otp)
 
-              expect(page).to have_current_path admin_session_path, ignore_query: true
-              expect(page).to have_content('Invalid two-factor code')
-            end
+          expect(page).to have_current_path admin_session_path, ignore_query: true
+          expect(page).to have_content('Invalid two-factor code')
+        end
 
-            context 'not re-using codes' do
-              before do
-                gitlab_sign_in(user, remember: true)
+        context 'not re-using codes' do
+          before do
+            gitlab_sign_in(user, remember: true)
 
-                expect(page).to have_content('Enter verification code')
+            expect(page).to have_content('Enter verification code')
 
-                enter_code(user.current_otp)
-                gitlab_enable_admin_mode_sign_in(user, use_mock_admin_mode: false)
+            enter_code(user.current_otp)
+            gitlab_enable_admin_mode_sign_in(user, use_mock_admin_mode: false)
 
-                expect(page).to have_content(_('Enter verification code'))
-              end
+            expect(page).to have_content(_('Enter verification code'))
+          end
 
-              it 'allows login with valid code' do
-                # Cannot reuse the TOTP
-                travel_to(30.seconds.from_now) do
-                  enter_code(user.current_otp)
+          it 'allows login with valid code' do
+            # Cannot reuse the TOTP
+            travel_to(30.seconds.from_now) do
+              enter_code(user.current_otp)
 
-                  expect(page).to have_current_path admin_root_path, ignore_query: true
-                  expect(page).to have_content('Admin mode enabled')
-                end
-              end
+              expect(page).to have_current_path admin_root_path, ignore_query: true
+              expect(page).to have_content('Admin mode enabled')
+            end
+          end
 
-              it 'blocks login with invalid code' do
-                # Cannot reuse the TOTP
-                travel_to(30.seconds.from_now) do
-                  enter_code('foo')
+          it 'blocks login with invalid code' do
+            # Cannot reuse the TOTP
+            travel_to(30.seconds.from_now) do
+              enter_code('foo')
 
-                  expect(page).to have_content('Invalid two-factor code')
-                end
-              end
+              expect(page).to have_content('Invalid two-factor code')
+            end
+          end
 
-              it 'allows login with invalid code, then valid code' do
-                # Cannot reuse the TOTP
-                travel_to(30.seconds.from_now) do
-                  enter_code('foo')
+          it 'allows login with invalid code, then valid code' do
+            # Cannot reuse the TOTP
+            travel_to(30.seconds.from_now) do
+              enter_code('foo')
 
-                  expect(page).to have_content('Invalid two-factor code')
+              expect(page).to have_content('Invalid two-factor code')
 
-                  enter_code(user.current_otp)
+              enter_code(user.current_otp)
 
-                  expect(page).to have_current_path admin_root_path, ignore_query: true
-                  expect(page).to have_content('Admin mode enabled')
-                end
-              end
+              expect(page).to have_current_path admin_root_path, ignore_query: true
+              expect(page).to have_content('Admin mode enabled')
+            end
+          end
 
-              context 'using backup code' do
-                let(:codes) { user.generate_otp_backup_codes! }
+          context 'using backup code' do
+            let(:codes) { user.generate_otp_backup_codes! }
 
-                before do
-                  expect(codes.size).to eq 10
+            before do
+              expect(codes.size).to eq 10
 
-                  # Ensure the generated codes get saved
-                  user.save!
-                end
+              # Ensure the generated codes get saved
+              user.save!
+            end
 
-                context 'with valid code' do
-                  it 'allows login' do
-                    enter_code(codes.sample)
+            context 'with valid code' do
+              it 'allows login' do
+                enter_code(codes.sample)
 
-                    expect(page).to have_current_path admin_root_path, ignore_query: true
-                    expect(page).to have_content('Admin mode enabled')
-                  end
+                expect(page).to have_current_path admin_root_path, ignore_query: true
+                expect(page).to have_content('Admin mode enabled')
+              end
 
-                  it 'invalidates the used code' do
-                    expect { enter_code(codes.sample) }
-                      .to change { user.reload.otp_backup_codes.size }.by(-1)
-                  end
-                end
+              it 'invalidates the used code' do
+                expect { enter_code(codes.sample) }
+                  .to change { user.reload.otp_backup_codes.size }.by(-1)
+              end
+            end
 
-                context 'with invalid code' do
-                  it 'blocks login' do
-                    code = codes.sample
-                    expect(user.invalidate_otp_backup_code!(code)).to eq true
+            context 'with invalid code' do
+              it 'blocks login' do
+                code = codes.sample
+                expect(user.invalidate_otp_backup_code!(code)).to eq true
 
-                    user.save!
-                    expect(user.reload.otp_backup_codes.size).to eq 9
+                user.save!
+                expect(user.reload.otp_backup_codes.size).to eq 9
 
-                    enter_code(code)
+                enter_code(code)
 
-                    expect(page).to have_content('Invalid two-factor code.')
-                  end
-                end
+                expect(page).to have_content('Invalid two-factor code.')
               end
             end
           end
+        end
+      end
 
-          context 'when logging in via omniauth' do
-            let(:user) { create(:omniauth_user, :admin, :two_factor, extern_uid: 'my-uid', provider: 'saml', password_automatically_set: false) }
-            let(:mock_saml_response) do
-              File.read('spec/fixtures/authentication/saml_response.xml')
-            end
+      context 'when logging in via omniauth' do
+        let(:user) { create(:omniauth_user, :admin, :two_factor, extern_uid: 'my-uid', provider: 'saml', password_automatically_set: false) }
+        let(:mock_saml_response) do
+          File.read('spec/fixtures/authentication/saml_response.xml')
+        end
 
-            before do
-              stub_omniauth_saml_config(enabled: true, auto_link_saml_user: true, allow_single_sign_on: ['saml'], providers: [mock_saml_config_with_upstream_two_factor_authn_contexts])
-            end
+        before do
+          stub_omniauth_saml_config(enabled: true, auto_link_saml_user: true, allow_single_sign_on: ['saml'], providers: [mock_saml_config_with_upstream_two_factor_authn_contexts])
+        end
 
-            context 'when authn_context is worth two factors' do
-              let(:mock_saml_response) do
-                File.read('spec/fixtures/authentication/saml_response.xml')
-                  .gsub(
-                    'urn:oasis:names:tc:SAML:2.0:ac:classes:Password',
-                    'urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS'
-                  )
-              end
+        context 'when authn_context is worth two factors' do
+          let(:mock_saml_response) do
+            File.read('spec/fixtures/authentication/saml_response.xml')
+              .gsub(
+                'urn:oasis:names:tc:SAML:2.0:ac:classes:Password',
+                'urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS'
+              )
+          end
 
-              it 'signs user in without prompting for second factor' do
-                sign_in_using_saml!
+          it 'signs user in without prompting for second factor' do
+            sign_in_using_saml!
 
-                expect(page).not_to have_content(_('Enter verification code'))
+            expect(page).not_to have_content(_('Enter verification code'))
 
-                enable_admin_mode_using_saml!
+            enable_admin_mode_using_saml!
 
-                expect(page).not_to have_content(_('Enter verification code'))
-                expect(page).to have_current_path admin_root_path, ignore_query: true
-                expect(page).to have_content('Admin mode enabled')
-              end
-            end
+            expect(page).not_to have_content(_('Enter verification code'))
+            expect(page).to have_current_path admin_root_path, ignore_query: true
+            expect(page).to have_content('Admin mode enabled')
+          end
+        end
 
-            context 'when two factor authentication is required' do
-              it 'shows 2FA prompt after omniauth login' do
-                sign_in_using_saml!
+        context 'when two factor authentication is required' do
+          it 'shows 2FA prompt after omniauth login' do
+            sign_in_using_saml!
 
-                expect(page).to have_content(_('Enter verification code'))
-                enter_code(user.current_otp)
+            expect(page).to have_content(_('Enter verification code'))
+            enter_code(user.current_otp)
 
-                enable_admin_mode_using_saml!
+            enable_admin_mode_using_saml!
 
-                expect(page).to have_content(_('Enter verification code'))
+            expect(page).to have_content(_('Enter verification code'))
 
-                # Cannot reuse the TOTP
-                travel_to(30.seconds.from_now) do
-                  enter_code(user.current_otp)
+            # Cannot reuse the TOTP
+            travel_to(30.seconds.from_now) do
+              enter_code(user.current_otp)
 
-                  expect(page).to have_current_path admin_root_path, ignore_query: true
-                  expect(page).to have_content('Admin mode enabled')
-                end
-              end
+              expect(page).to have_current_path admin_root_path, ignore_query: true
+              expect(page).to have_content('Admin mode enabled')
             end
+          end
+        end
 
-            def sign_in_using_saml!
-              gitlab_sign_in_via('saml', user, 'my-uid', mock_saml_response)
-            end
+        def sign_in_using_saml!
+          gitlab_sign_in_via('saml', user, 'my-uid', mock_saml_response)
+        end
 
-            def enable_admin_mode_using_saml!
-              gitlab_enable_admin_mode_sign_in_via('saml', user, 'my-uid', mock_saml_response)
-            end
-          end
+        def enable_admin_mode_using_saml!
+          gitlab_enable_admin_mode_sign_in_via('saml', user, 'my-uid', mock_saml_response)
+        end
+      end
 
-          context 'when logging in via ldap' do
-            let(:uid) { 'my-uid' }
-            let(:provider_label) { 'Main LDAP' }
-            let(:provider_name) { 'main' }
-            let(:provider) { "ldap#{provider_name}" }
-            let(:ldap_server_config) do
-              {
-                'label' => provider_label,
-                'provider_name' => provider,
-                'attributes' => {},
-                'encryption' => 'plain',
-                'uid' => 'uid',
-                'base' => 'dc=example,dc=com'
-              }
-            end
+      context 'when logging in via ldap' do
+        let(:uid) { 'my-uid' }
+        let(:provider_label) { 'Main LDAP' }
+        let(:provider_name) { 'main' }
+        let(:provider) { "ldap#{provider_name}" }
+        let(:ldap_server_config) do
+          {
+            'label' => provider_label,
+            'provider_name' => provider,
+            'attributes' => {},
+            'encryption' => 'plain',
+            'uid' => 'uid',
+            'base' => 'dc=example,dc=com'
+          }
+        end
 
-            let(:user) { create(:omniauth_user, :admin, :two_factor, extern_uid: uid, provider: provider) }
+        let(:user) { create(:omniauth_user, :admin, :two_factor, extern_uid: uid, provider: provider) }
 
-            before do
-              setup_ldap(provider, user, uid, ldap_server_config)
-            end
+        before do
+          setup_ldap(provider, user, uid, ldap_server_config)
+        end
 
-            context 'when two factor authentication is required' do
-              it 'shows 2FA prompt after ldap login' do
-                sign_in_using_ldap!(user, provider_label)
-                expect(page).to have_content(_('Enter verification code'))
+        context 'when two factor authentication is required' do
+          it 'shows 2FA prompt after ldap login' do
+            sign_in_using_ldap!(user, provider_label)
+            expect(page).to have_content(_('Enter verification code'))
 
-                enter_code(user.current_otp)
-                enable_admin_mode_using_ldap!(user)
+            enter_code(user.current_otp)
+            enable_admin_mode_using_ldap!(user)
 
-                expect(page).to have_content(_('Enter verification code'))
+            expect(page).to have_content(_('Enter verification code'))
 
-                # Cannot reuse the TOTP
-                travel_to(30.seconds.from_now) do
-                  enter_code(user.current_otp)
+            # Cannot reuse the TOTP
+            travel_to(30.seconds.from_now) do
+              enter_code(user.current_otp)
 
-                  expect(page).to have_current_path admin_root_path, ignore_query: true
-                  expect(page).to have_content('Admin mode enabled')
-                end
-              end
+              expect(page).to have_current_path admin_root_path, ignore_query: true
+              expect(page).to have_content('Admin mode enabled')
             end
+          end
+        end
 
-            def setup_ldap(provider, user, uid, ldap_server_config)
-              stub_ldap_setting(enabled: true)
+        def setup_ldap(provider, user, uid, ldap_server_config)
+          stub_ldap_setting(enabled: true)
 
-              allow(::Gitlab::Auth::Ldap::Config).to receive_messages(enabled: true, servers: [ldap_server_config])
-              allow(Gitlab::Auth::OAuth::Provider).to receive_messages(providers: [provider.to_sym])
+          allow(::Gitlab::Auth::Ldap::Config).to receive_messages(enabled: true, servers: [ldap_server_config])
+          allow(Gitlab::Auth::OAuth::Provider).to receive_messages(providers: [provider.to_sym])
 
-              Ldap::OmniauthCallbacksController.define_providers!
-              Rails.application.reload_routes!
+          Ldap::OmniauthCallbacksController.define_providers!
+          Rails.application.reload_routes!
 
-              mock_auth_hash(provider, uid, user.email)
-              allow(Gitlab::Auth::Ldap::Access).to receive(:allowed?).with(user).and_return(true)
+          mock_auth_hash(provider, uid, user.email)
+          allow(Gitlab::Auth::Ldap::Access).to receive(:allowed?).with(user).and_return(true)
 
-              allow_any_instance_of(ActionDispatch::Routing::RoutesProxy)
-                .to receive(:"user_#{provider}_omniauth_callback_path")
-                .and_return("/users/auth/#{provider}/callback")
-            end
+          allow_any_instance_of(ActionDispatch::Routing::RoutesProxy)
+            .to receive(:"user_#{provider}_omniauth_callback_path")
+            .and_return("/users/auth/#{provider}/callback")
+        end
 
-            def sign_in_using_ldap!(user, provider_label)
-              visit new_user_session_path
-              click_link provider_label
-              fill_in 'username', with: user.username
-              fill_in 'password', with: user.password
-              click_button 'Sign in'
-            end
+        def sign_in_using_ldap!(user, provider_label)
+          visit new_user_session_path
+          click_link provider_label
+          fill_in 'username', with: user.username
+          fill_in 'password', with: user.password
+          click_button 'Sign in'
+        end
 
-            def enable_admin_mode_using_ldap!(user)
-              visit new_admin_session_path
-              click_link provider_label
-              fill_in 'username', with: user.username
-              fill_in 'password', with: user.password
-              click_button 'Enter admin mode'
-            end
-          end
+        def enable_admin_mode_using_ldap!(user)
+          visit new_admin_session_path
+          click_link provider_label
+          fill_in 'username', with: user.username
+          fill_in 'password', with: user.password
+          click_button 'Enter admin mode'
         end
       end
     end