Issue with Group IP restriction bypass
Problem to solve
https://docs.gitlab.com/ee/user/group/index.html#ip-access-restriction says IP restrictions apply to UI, API, and SSH
However, it also says:
To avoid accidental lock-out, admins and group owners are able to access the group regardless of the IP restriction.
Further details
Our testing shows that with IP restriction turned on:
- UI: A user with
Ownerpermissions can still access the top-level group along with any subgroup within, but cannot access projects. - API: A user with
Ownerpermissions can still access the related API endpoints. - SSH: A user with
Ownerpermissions cannot access any projects via SSH to perform Git operations. - Pages: With Access Control enabled, IP addresses can be rejected and Pages can be inaccessible.
The root cause is that the source IP is not passed correctly gitlab-com/gl-infra/infrastructure#10954
Proposal
Address root cause by implementing &5219
Who can address the issue
Source Code team
Other links/references
Original question came from customer (internal): https://gitlab.zendesk.com/agent/tickets/177588
Update
Looks like this may be a bug specific to GitLab.com due to gitlab-com/gl-infra/infrastructure#10954
Follow-up
- Once this issue is fixed, update (and quite possibly revert) this doc change: !50801 (merged)