Users blocked by SAML required groups incorrectly show as "LDAP Blocked" in Admin UI

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Label this issue
• Close this issue

Summary

Users who are blocked due to SAML required_groups validation failure are incorrectly displayed as "LDAP Blocked" in the GitLab Admin UI, even when LDAP is not configured or completely disabled. This creates confusion for administrators trying to understand why users cannot access the system.

Steps to reproduce

1. Configure SAML authentication with required_groups setting
2. Have a user attempt to sign in via SAML who is not in the required groups
3. User gets blocked with log message: SAML(saml) account "user@example.com" not in required group, blocking GitLab user
4. Check the user's status in Admin Area > Users

What is the current bug behavior?

• User shows as "LDAP Blocked" in the Admin UI
• Database state is set to ldap_blocked
• This is misleading when the actual cause is SAML group validation failure
• Administrators may incorrectly troubleshoot LDAP issues when LDAP is not even configured

What is the expected correct behavior?

• Users blocked by SAML required groups should show as "SAML Blocked" or similar
• Database state should be saml_blocked instead of ldap_blocked
• UI should clearly indicate the blocking mechanism (SAML vs LDAP)
• Consistent labeling between the actual cause and the displayed status

Relevant logs and/or screenshots

Application Log Entry:

"message":"SAML(saml) account \"user@example.com\" not in required group, blocking GitLab user \"User Name\" (user@example.com)"

Admin UI Display: Shows "LDAP Blocked" status despite SAML being the blocking mechanism

Environment

• GitLab Version: 17.10.4-ee (also affects other versions)
• Installation Method: GitLab Environment Toolkit (GET)
• Authentication: SAML only (no LDAP configured)

Impact

• Severity: Medium - Causes administrator confusion and incorrect troubleshooting
• Frequency: Affects all users blocked by SAML required groups
• Workaround: Administrators must check logs to understand the real cause

Additional Context

This issue was discovered during customer support case where administrators spent significant time troubleshooting "LDAP" issues on an instance that never had LDAP configured. The root cause was SAML required groups blocking users, but the UI misleadingly showed "LDAP Blocked" status.

The inconsistency between the blocking mechanism (SAML) and the UI label (LDAP) creates unnecessary confusion and support overhead.