Skip to content

Fix LDAP tls_options not working

Stan Hu requested to merge sh-fix-ldap-tls-options into master

What does this MR do and why

The removal of the Settingslogic gem in !113040 (merged) created a regression when LDAP tls_options were used. It resulted in Gitlab::config.ldap.servers.main.tls_options.cert returning nil instead of the certificate.

This occurred because Gitlab::Auth::Ldap::Config#custom_tls_options attempts to duplicate the tls_options Hash and symbolize the keys, but instead it altered the internal Hash representation of GitlabSettings::Options. Since all the keys were transformed to symbols but GitlabSettings::Options converts all keys to strings, the values were inaccessible.

To fix this, implement a dup to create a copy of the internal representation. We should also consider refactoring Gitlab::Auth::Ldap::Config.

Relates to #413017 (closed)

How to set up and validate locally

  1. Use the master branch.
  2. In your config/gitlab.yml, use this block (you may have to remove the exising ldap line):
  ldap:
    enabled: true
    servers:
      main: {"label":"Google Secure LDAP","host":"ldap.google.com","port":636,"uid":"uid","bind_dn":"XXXX","password":"XXXXX","encryption":"simple_tls","verify_certificates":false,"retry_empty_result_with_codes":[80\
],"base":"DC=XX,DC=XX","tls_options":{"cert":"-----BEGIN CERTIFICATE-----\nXXXX\n-----END CERTIFICATE-----\n","key":"-----BEGIN PRIVATE KEY-----\nXXXXX\n-----END PRIVATE KEY-----\n"}}
  1. Run bin/rails console
  2. Enter: Gitlab::config.ldap.servers.main.tls_options.cert. You should get a nil value back.
  3. Change to this branch and repeat steps 3 and 4.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Stan Hu

Merge request reports