Remove prevent_token_prefixed_password_fallback_sessionless FF
What does this MR do and why?
Remove prevent_token_prefixed_password_fallback_sessionless FF
The feature flag was introduced to prevent recognized token types from falling back to database or LDAP authentication when invalid, avoiding LDAP account lockouts during Git over HTTPS authentication.
The feature has been successfully rolled out and is now permanently enabled. This removes the feature flag definition and completes the cleanup.
Closes #431923 (closed)
Changelog: removed
References
Screenshots or screen recordings
| Before | After |
|---|---|
| Many LDAP login attempts | No LDAP login attempts |
How to set up and validate locally
- Integrate a ldap server successfully. See LDAP GDK documentation.
- Create a project and create a PAT on this project
- Open LDAP logs with
gdk tail openldap - Run the script to clone the project
- Revoke the PAT while the script is still running
- git clone will start to fail
Expected result:
Before fix: LDAP server logs show authentication attempts
After fix: No LDAP server requests in logs
Script used
#!/bin/bash
# Configuration
GITLAB_URL="127.0.0.1:3000"
PROJECT_PATH="gitlab-org/gitlab-test" # Replace with target project path
USERNAME="john" # LDAP Account username, provided by default by gdk openldap
PAT="<YOUR-PAY>". # Add the PAT generated
CLONE_DIR="test-clone"
SLEEP_INTERVAL=0.1 # Seconds between attempts
MAX_ATTEMPTS=1000 # Maximum number of attempts
echo "Starting clone script - will attempt $MAX_ATTEMPTS clones"
echo "Target: $GITLAB_URL/$PROJECT_PATH"
echo "Username: $USERNAME"
echo "Press Ctrl+C to stop"
echo "----------------------------------------"
attempt=1
while [ $attempt -le $MAX_ATTEMPTS ]; do
echo "Attempt $attempt at $(date)"
# Remove previous clone directory if it exists
if [ -d "$CLONE_DIR" ]; then
rm -rf "$CLONE_DIR"
fi
# Attempt to clone using HTTPS with PAT
git clone "http://$USERNAME:$PAT@$GITLAB_URL/$PROJECT_PATH.git" "$CLONE_DIR" 2>&1
clone_result=$?
if [ $clone_result -eq 0 ]; then
echo "✅ Clone successful"
rm -rf "$CLONE_DIR" # Clean up successful clone
else
echo "❌ Clone failed (exit code: $clone_result)"
fi
echo "Waiting $SLEEP_INTERVAL seconds before next attempt..."
sleep $SLEEP_INTERVAL
attempt=$((attempt + 1))
done
echo "Script completed after $MAX_ATTEMPTS attempts"
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Daniele Bracciani