Make LDAP user update support adding sk-* format SSH keys
What does this MR do and why?
- When LDAP users perform auth-related actions like signing in, the code syncs user data between the LDAP server and GitLab.
- This includes adding SSH keys from the LDAP server to GitLab, if the sync feature is enabled.
-
sk-*type SSH keys (security keys) were not syncing because the code only supports non-sk-*keys
This MR updates the LDAP sync logic to support adding sk-* keys during sync.
Alternatives
The fix is low-impact and purely additive: make the existing regex also match on sk-* keys, optionally. This ensures this fix won't break anything else or have unintended side effects
I considered a couple other options:
- Make the regex filter only on key types supported in
SSHPublicKey::TECHNOLOGIESlist - Don't filter at all, and let the
Keymodel validation fail adding any non-supported keys
I decided against these because:
- They are larger changes that could have side effects.
- Requires more detailed testing and manual testing.
- Changes more behaviour than just fixing the
sk-*bug. - I'm not against implementing either of the alternatives but I'd suggest doing them separately from fixing this bug.
References
Issue: #415363
How to set up and validate locally
- Follow these instructions to validate locally
- The above instructions verify that
sk-*keys will be supported. To check that other non-sk-*types of keys continue to be supported, just add a bunch of different keys in step 4) when changingjohn's entry on the LDAP schema. Example:
Add more keys for `john` in `frontend.example.com.ldif`
# frontend.example.com.ldif
...
dn: uid=john,ou=people,dc=example,dc=com
...
objectClass: ldapPublicKey
...
initials: JD
sshPublicKey: <key_from_issue_description>
dn: uid=mary,ou=people,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: ldapPublicKey
...
initials: JD
sshPublicKey: sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIPnI5pgZCsItcMh9e4lVK3CBP7cU0RbYnDzFE73dtdQnAAAABHNzaDo=
sshPublicKey: sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIPnI5pgZCsItcMh9e4lVK3CBP7cU0RbYnDzFE73dtdQnAAAABHNzaDo= fake@email.com
sshPublicKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIETnVTgzqC1gatgSlC4zH6aYt2CAQzgJOhDRvf59ohL6 fake@email.com
...
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #415363
Edited by Jason Knabl