diff options
Diffstat (limited to 'doc/administration/auth/ldap/ldap-troubleshooting.md')
| -rw-r--r-- | doc/administration/auth/ldap/ldap-troubleshooting.md | 23 |
1 files changed, 11 insertions, 12 deletions
diff --git a/doc/administration/auth/ldap/ldap-troubleshooting.md b/doc/administration/auth/ldap/ldap-troubleshooting.md index 9d9c01b870f..1e6684751ed 100644 --- a/doc/administration/auth/ldap/ldap-troubleshooting.md +++ b/doc/administration/auth/ldap/ldap-troubleshooting.md @@ -5,7 +5,7 @@ group: Access info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments --- -# LDAP Troubleshooting for Administrators +# LDAP Troubleshooting for Administrators **(FREE SELF)** ## Common Problems & Workflows @@ -27,7 +27,7 @@ Could not authenticate you from Ldapmain because "Connection timed out - user sp ``` If your configured LDAP provider and/or endpoint is offline or otherwise -unreachable by GitLab, no LDAP user will be able to authenticate and sign-in. +unreachable by GitLab, no LDAP user is able to authenticate and sign-in. GitLab does not cache or store credentials for LDAP users to provide authentication during an LDAP outage. @@ -181,14 +181,13 @@ user = User.find_by_any_email('email@example.com') user.username ``` -This will show you which user has this email address. One of two steps will -have to be taken here: +This shows you which user has this email address. One of two steps must be taken here: - To create a new GitLab user/username for this user when signing in with LDAP, remove the secondary email to remove the conflict. - To use an existing GitLab user/username for this user to use with LDAP, remove this email as a secondary email and make it a primary one so GitLab - will associate this profile to the LDAP identity. + associates this profile to the LDAP identity. The user can do either of these steps [in their profile](../../../user/profile/index.md#access-your-user-profile) or an administrator can do it. @@ -227,7 +226,7 @@ output](#example-console-output-after-a-user-sync). ##### Example console output after a user sync **(PREMIUM SELF)** -The output from a [manual user sync](#sync-all-users) will be very verbose, and a +The output from a [manual user sync](#sync-all-users) is very verbose, and a single user's successful sync can look like this: ```shell @@ -255,8 +254,8 @@ uid: John There's a lot here, so let's go over what could be helpful when debugging. -First, GitLab will look for all users that have previously -signed in with LDAP and iterate on them. Each user's sync will start with +First, GitLab looks for all users that have previously +signed in with LDAP and iterate on them. Each user's sync starts with the following line that contains the user's username and email, as they exist in GitLab now: @@ -274,7 +273,7 @@ link between this user and the configured LDAP provider(s): Identity Load (0.9ms) SELECT "identities".* FROM "identities" WHERE "identities"."user_id" = 20 AND (provider LIKE 'ldap%') LIMIT 1 ``` -The identity object will have the DN that GitLab will use to look for the user +The identity object has the DN that GitLab uses to look for the user in LDAP. If the DN isn't found, the email is used instead. We can see that this user is found in LDAP: @@ -294,18 +293,18 @@ following message instead: LDAP search error: No Such Object ``` -...in which case the user will be blocked: +...in which case the user is blocked: ```shell User Update (0.4ms) UPDATE "users" SET "state" = $1, "updated_at" = $2 WHERE "users"."id" = $3 [["state", "ldap_blocked"], ["updated_at", "2019-10-18 15:46:22.902177"], ["id", 20]] ``` -Once the user is found in LDAP the rest of the output will update the GitLab +Once the user is found in LDAP, the rest of the output updates the GitLab database with any changes. #### Query a user in LDAP -This will test that GitLab can reach out to LDAP and read a particular user. +This tests that GitLab can reach out to LDAP and read a particular user. It can expose potential errors connecting to and/or querying LDAP that may seem to fail silently in the GitLab UI. |