Add LDAP GroupSync support for Auditor users

Sergey Pechenkorequested to merge
gitlab-community/gitlab-org/gitlab:2998-ldap-auditor-sync into master

What does this MR do and why?

Closes #2998 (closed): there was no way to sync LDAP users to GitLab as Auditor users through LDAP GroupSync, even though the equivalent already existed for Administrator users (admin_group).

This MR adds an audit_group LDAP config option, following the exact pattern already used for admin_group:

  • EE::Gitlab::Auth::Ldap::Sync::AuditorUsers is a new subclass of the existing Sync::Users base class (the same base class AdminUsers and ExternalUsers already use), setting attribute :auditor and reading member DNs from audit_group.
  • EE::Gitlab::Auth::Ldap::Sync::Groups#update_permissions calls it whenever audit_group is configured, mirroring the existing admin_group branch.
  • Gitlab::Auth::Ldap::Config#audit_group reads the new option, next to the existing admin_group reader.

Members of the configured LDAP group are granted the auditor role on sync; users who are no longer members have it revoked, exactly like the existing admin sync behavior.

Disclosure

This merge request was prepared with the assistance of Claude Code (Anthropic), including root-cause analysis of the existing admin_group sync pattern, and the implementation, tests, and documentation above. All changes have been reviewed prior to submission.

Screenshots or screen recordings

N/A — backend/config change, no UI changes.

How to set up and validate locally

  1. bin/rspec ee/spec/lib/ee/gitlab/auth/ldap/sync/auditor_users_spec.rb ee/spec/lib/ee/gitlab/auth/ldap/sync/groups_spec.rb
  2. All examples pass, including the new audit_group sync and revoke cases.

Merge request reports