Skip to content

Unblock LDAP blocked user on sign-in with other auth methods

Drew Blessing requested to merge dblessing_ldap_unblock_on_sign_in into master

What does this MR do and why?

Fixes #343298 (closed)

Many organizations use LDAP in conjunction with other authentication methods such as SAML or OAuth. If transient LDAP errors cause the user to become ldap_blocked it is desirable to also unblock the user if the issue resolves itself. Otherwise, the user is unable to sign-in again without manual intervention or to sign-in once via LDAP directly. This change enables any sign-in to recheck LDAP if the user is ldap_blocked.

Screenshots or screen recordings

The screen recording shows the new behavior. I first ldap_block the user in the console. On sign-in notice the LDAP logs in the bottom terminal which show a query took place. Then the user is signed in and you subsequently see the user is no longer ldap_blocked.

unblock_ldap_via_omniauth_480

How to set up and validate locally

  1. Configure your GDK or test instance for LDAP. See GDK docs for instructions.
  2. Sign-in once as a test LDAP user such as john.
  3. Connect this test LDAP account to some external authentication method such as Google, GitHub, etc.
  4. Open a Rails console, find the user and manually block them: 
    user = User.find_by_username 'john'
user.ldap_block!
  5. Sign-in via the external auth method - Google, etc.
  6. Observe the user signed in successfully.
  7. Observe the user is no longer ldap_blocked in the console: 
    user.reload.ldap_blocked?

Prior to this change the last 2 steps would not happen. The user would receive a message they are blocked.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Drew Blessing

Merge request reports