Allow managing service accounts through LDAP

Release notes

Allow service accounts to be managed with LDAP synchronization.

Problem to solve

We are a large Gitlab Premium enterprise user, managing group membership in Gitlab through the LDAP synchronization process. We have the requirement that AD is the single source of truth for authorization/authentication for the whole enterprise.

We control our Unix service accounts through LDAP as well and assign permissions / SSH keys through AD.

These service accounts are synced into Gitlab to allow access to repositories from production hosts.

Currently, the way we sync these accounts in is by creating a service account in Gitlab and syncing in the attributes from LDAP through an external sync application.

However, because the internal Gitlab LDAP sync does not apply to service accounts, when we add a service account to a security group in AD, this change is not reflected in Gitlab. This means we currently have to add the service account directly to any projects/groups they are supposed to have access to according to LDAP, and manage this through our third party synchronization application.

We would like the ability to sync service account attributes and membership from LDAP into Gitlab.

User experience goal

System administrators should be able to manage Gitlab project/group membership for service accounts entirely via LDAP.

Availability & Testing

Available Tier

• Premium
• Ultimate