diff options
Diffstat (limited to 'doc/administration/auth')
| -rw-r--r-- | doc/administration/auth/authentiq.md | 2 | ||||
| -rw-r--r-- | doc/administration/auth/jwt.md | 2 | ||||
| -rw-r--r-- | doc/administration/auth/ldap/google_secure_ldap.md | 2 | ||||
| -rw-r--r-- | doc/administration/auth/ldap/index.md | 6 | ||||
| -rw-r--r-- | doc/administration/auth/ldap/ldap-troubleshooting.md | 18 | ||||
| -rw-r--r-- | doc/administration/auth/ldap/ldap_synchronization.md | 10 | ||||
| -rw-r--r-- | doc/administration/auth/oidc.md | 4 | ||||
| -rw-r--r-- | doc/administration/auth/smartcard.md | 2 |
8 files changed, 29 insertions, 17 deletions
diff --git a/doc/administration/auth/authentiq.md b/doc/administration/auth/authentiq.md index 1ac62b06fe7..d51601439f9 100644 --- a/doc/administration/auth/authentiq.md +++ b/doc/administration/auth/authentiq.md @@ -95,6 +95,6 @@ important to describe those, too. Think of things that may go wrong and include This is important to minimize requests for support, and to avoid doc comments with questions that you know someone might ask. -Each scenario can be a third-level heading, e.g. `### Getting error message X`. +Each scenario can be a third-level heading, for example `### Getting error message X`. If you have none to add when creating a doc, leave this section in place but commented out to help encourage others to add to it in the future. --> diff --git a/doc/administration/auth/jwt.md b/doc/administration/auth/jwt.md index c7e7253ef72..c1e76d1c2ed 100644 --- a/doc/administration/auth/jwt.md +++ b/doc/administration/auth/jwt.md @@ -87,6 +87,6 @@ important to describe those, too. Think of things that may go wrong and include This is important to minimize requests for support, and to avoid doc comments with questions that you know someone might ask. -Each scenario can be a third-level heading, e.g. `### Getting error message X`. +Each scenario can be a third-level heading, for example `### Getting error message X`. If you have none to add when creating a doc, leave this section in place but commented out to help encourage others to add to it in the future. --> diff --git a/doc/administration/auth/ldap/google_secure_ldap.md b/doc/administration/auth/ldap/google_secure_ldap.md index 2077c6f7baf..01197fdacdf 100644 --- a/doc/administration/auth/ldap/google_secure_ldap.md +++ b/doc/administration/auth/ldap/google_secure_ldap.md @@ -225,6 +225,6 @@ important to describe those, too. Think of things that may go wrong and include This is important to minimize requests for support, and to avoid doc comments with questions that you know someone might ask. -Each scenario can be a third-level heading, e.g. `### Getting error message X`. +Each scenario can be a third-level heading, for example `### Getting error message X`. If you have none to add when creating a doc, leave this section in place but commented out to help encourage others to add to it in the future. --> diff --git a/doc/administration/auth/ldap/index.md b/doc/administration/auth/ldap/index.md index 3bb9350e960..6243f3da2d2 100644 --- a/doc/administration/auth/ldap/index.md +++ b/doc/administration/auth/ldap/index.md @@ -179,7 +179,7 @@ These configuration settings are available: | `allow_username_or_email_login` | If enabled, GitLab ignores everything after the first `@` in the LDAP username submitted by the user on sign-in. If you are using `uid: 'userPrincipalName'` on ActiveDirectory you must disable this setting, because the userPrincipalName contains an `@`. | **{dotted-circle}** No | boolean | | `block_auto_created_users` | To maintain tight control over the number of billable users on your GitLab installation, enable this setting to keep new users blocked until they have been cleared by an administrator (default: false). | **{dotted-circle}** No | boolean | | `base` | Base where we can search for users. | **{check-circle}** Yes | `'ou=people,dc=gitlab,dc=example'` or `'DC=mydomain,DC=com'` | -| `user_filter` | Filter LDAP users. Format: [RFC 4515](https://tools.ietf.org/search/rfc4515) Note: GitLab does not support `omniauth-ldap`'s custom filter syntax. | **{dotted-circle}** No | For examples, read [Examples of user filters](#examples-of-user-filters). | +| `user_filter` | Filter LDAP users. Format: [RFC 4515](https://www.rfc-editor.org/rfc/rfc4515.html) Note: GitLab does not support `omniauth-ldap`'s custom filter syntax. | **{dotted-circle}** No | For examples, read [Examples of user filters](#examples-of-user-filters). | | `lowercase_usernames` | If enabled, GitLab converts the name to lower case. | **{dotted-circle}** No | boolean | | `retry_empty_result_with_codes` | An array of LDAP query response code that attempt to retry the operation if the result/content is empty. For Google Secure LDAP, set this value to `[80]`. | **{dotted-circle}** No | `[80]` | @@ -281,7 +281,7 @@ This example results in a sign-in page with the following tabs: To limit all GitLab access to a subset of the LDAP users on your LDAP server, first narrow the configured `base`. However, to further filter users if -necessary, you can set up an LDAP user filter. The filter must comply with [RFC 4515](https://tools.ietf.org/search/rfc4515). +necessary, you can set up an LDAP user filter. The filter must comply with [RFC 4515](https://www.rfc-editor.org/rfc/rfc4515.html). - Example user filter for Omnibus GitLab instances: @@ -336,7 +336,7 @@ The `user_filter` DN can contain special characters. For example: ``` These characters must be escaped as documented in - [RFC 4515](https://tools.ietf.org/search/rfc4515). + [RFC 4515](https://www.rfc-editor.org/rfc/rfc4515.html). - Escape commas with `\2C`. For example: diff --git a/doc/administration/auth/ldap/ldap-troubleshooting.md b/doc/administration/auth/ldap/ldap-troubleshooting.md index 0ec482648a9..499c3c64af7 100644 --- a/doc/administration/auth/ldap/ldap-troubleshooting.md +++ b/doc/administration/auth/ldap/ldap-troubleshooting.md @@ -196,7 +196,7 @@ same user) has the email `email@example.com` set as a secondary email, which is throwing this error. We can check where this conflicting email address is coming from using the -[rails console](#rails-console). Once in the console, run the following: +[rails console](#rails-console). In the console, run the following: ```ruby # This searches for an email among the primary AND secondary emails @@ -546,7 +546,7 @@ this entry, it could be due to a mismatched DN stored in GitLab. See ```shell User with DN `uid=john0,ou=people,dc=example,dc=com` should have access to 'my_group' group but there is no user in GitLab with that -identity. Membership will be updated once the user signs in for +identity. Membership will be updated when the user signs in for the first time. ``` @@ -556,7 +556,7 @@ Finally, the following entry says syncing has finished for this group: Finished syncing all providers for 'my_group' group ``` -Once all the configured group links have been synchronized, GitLab looks +When all the configured group links have been synchronized, GitLab looks for any Administrators or External users to sync: ```shell @@ -614,6 +614,16 @@ ldap_group.member_dns ldap_group.member_uids ``` +#### LDAP synchronization does not remove group creator from group + +[LDAP synchronization](ldap_synchronization.md) should remove an LDAP group's creator +from that group, if that user does not exist in the group. If running LDAP synchronization +does not do this: + +1. Add the user to the LDAP group. +1. Wait until LDAP group synchronization has finished running. +1. Remove the user from the LDAP group. + ### User DN or/and email have changed When an LDAP user is created in GitLab, their LDAP DN is stored for later reference. @@ -735,7 +745,7 @@ To resolve this error, you must apply a new license to the GitLab instance witho 1. Remove or comment out the GitLab configuration lines for all non-primary LDAP servers. 1. [Reconfigure GitLab](../../restart_gitlab.md#omnibus-gitlab-reconfigure) so that it temporarily uses only one LDAP server. -1. Enter the [Rails console and add the license key](../../troubleshooting/gitlab_rails_cheat_sheet.md#add-a-license-through-the-console). +1. Enter the [Rails console and add the license key](../../../user/admin_area/license_file.md#add-a-license-through-the-console). 1. Re-enable the additional LDAP servers in the GitLab configuration and reconfigure GitLab again. ## Debugging Tools diff --git a/doc/administration/auth/ldap/ldap_synchronization.md b/doc/administration/auth/ldap/ldap_synchronization.md index af2b1400670..02b04861844 100644 --- a/doc/administration/auth/ldap/ldap_synchronization.md +++ b/doc/administration/auth/ldap/ldap_synchronization.md @@ -182,16 +182,18 @@ group, GitLab revokes their `admin` role when syncing. > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/1793) in GitLab 12.0. -"Lock memberships to LDAP synchronization" setting allows instance administrators -to lock down user abilities to invite new members to a group. +GitLab administrators can prevent group members from inviting new members to subgroups that have their membership synchronized with LDAP. -When enabled, the following applies: +Global group membership lock only applies to subgroups of the top-level group where LDAP synchronization is configured. No user can modify the +membership of a top-level group configured for LDAP synchronization. + +When global group memberships lock is enabled: - Only an administrator can manage memberships of any group including access levels. - Users are not allowed to share a project with other groups or invite members to a project created in a group. -To enable it, you must: +To enable global group memberships lock: 1. [Configure LDAP](index.md#configure-ldap). 1. On the top bar, select **Main menu > Admin**. diff --git a/doc/administration/auth/oidc.md b/doc/administration/auth/oidc.md index bb263512e06..1f73d8bff38 100644 --- a/doc/administration/auth/oidc.md +++ b/doc/administration/auth/oidc.md @@ -154,7 +154,7 @@ different providers with Omnibus GitLab. ### Configure Google -See the [Google documentation](https://developers.google.com/identity/protocols/oauth2/openid-connect) +See the [Google documentation](https://developers.google.com/identity/openid-connect/openid-connect) for more details: ```ruby @@ -502,7 +502,7 @@ For your app, complete the following steps on Casdoor: ensure the Casdoor app has the following `Redirect URI`: `https://gitlab.example.com/users/auth/openid_connect/callback`. -See the [Casdoor documentation](https://casdoor.org/docs/integration/gitlab) for more details. +See the [Casdoor documentation](https://casdoor.org/docs/integration/ruby/gitlab) for more details. Example Omnibus GitLab configuration (file path: `/etc/gitlab/gitlab.rb`): diff --git a/doc/administration/auth/smartcard.md b/doc/administration/auth/smartcard.md index 11117e8a74c..5b6d299f171 100644 --- a/doc/administration/auth/smartcard.md +++ b/doc/administration/auth/smartcard.md @@ -342,6 +342,6 @@ important to describe those, too. Think of things that may go wrong and include This is important to minimize requests for support, and to avoid doc comments with questions that you know someone might ask. -Each scenario can be a third-level heading, e.g. `### Getting error message X`. +Each scenario can be a third-level heading, for example `### Getting error message X`. If you have none to add when creating a doc, leave this section in place but commented out to help encourage others to add to it in the future. --> |