Improve gitlab:ldap:check Rake task to detect possible bad user_filter or base configuration

A couple of customer issues this week have led me to think there are a couple of improvements we can make to the gitlab:ldap:check Rake task to prevent much banging of heads against walls.

If the user check returns 0 users:

  1. Try the query again but skip the user_filter value. If users are then returned then alert the user that the user_filter is likely incorrect.
  2. If the check still returns 0 users, try the query again but skip/widen the base to global. If users are then returned alert the user that the base may be incorrect.

Another improvements for the check would be to show sample(s) of the derived LDAP user username, email and first and last name. These values are configurable via the attributes configuration so we can easily avoid configuration issues by showing what values would be set for a sample of users. Currently, we print a line like DN: uid=foo,dc=example,dc-=com UID: foo". We can probably simply email, first and last name. If it's too long consider truncating the DN to simply the first/second pair.

Edited May 28, 2025 by 🤖 GitLab Bot 🤖
Assignee Loading
Time tracking Loading