Gitlab EE - LDAP Authentication gives empty list

Question

I'm trying to add the LDAP feature for our GitLab. We have a running ActiveDirectoy server running on windows. Gitlab itself is hosted on an ubuntu server machine. For the authentication we created a serverice-user on the ad server. here is my gitlab.rb file (showing only the ldap config.)

gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
   main:
     label: 'LDAP'
     host: '1.2.3.4'
     port: 389
     uid: 'serviceAcc'
     bind_dn: 'CN=serviceACC,OU=Org 1,DC=organisation,DC=com'
     password: 'supersecurePass'
     encryption: 'plain'
     active_directory: true
EOS

The options which are not listed, are commented-out (so the default values will be used). Next I execute the both commands:

sudo gitlab-ctl reconfigure
sudo gitlab-rake gitlab:ldap:check

This is the result of the last command:

Checking LDAP ...

LDAP: ... Server: ldapmain
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)

Checking LDAP ... Finished

Why is my list empty? Shouldn't there be listed all users of the ad? I also tried applying the base_dn option, where the users are stored.

If I do an lsdapsearch i get the results:

ldapsearch -H ldap://1.2.3.4 -x -W -D "serviceAcc@organisation.com" -b "dc=organisation,dc=com" "(objectClass=user)" mail

.
.
.
# serviceACC, Org 1, organisation.com
dn: CN=serviceACC,OU=Org 1,DC=organisation,DC=com
.
.
.

So the AD server is reachable and response to my ldapsearch query. Am I missing something in the gitlab.rb config?

I'm using the gitlab EE with the version 12.5.3

UPDATE Here are the requested details for @EricLavault:

username:user.1 ; dn:CN=User 1,OU=Company Workers,DC=company,DC=com
The user submits it's AD credentials: Username:user.1 PW:#his AD-PW#
For the error logs i can proivde you the production.log. If you need some more logs, let me know:

Started POST "/users/auth/ldapmain/callback" for 1.2.3.8 at 2019-12-11-07:48:59 +0000
Processing by OmniauthCallbacksController#failure as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"[FILTERED]", "username"=>"user.1", "password"=>"[FILTERED]"}
Redirected to https://git.company.com/users/sign_in

For security reasons I have to change the real values with dummy values. But please, trust me that the provided user details are similars to the real values. (usernames with ".", Service User is in another OU than the users which will login to the gitlab)

The user will be displayed following error message:

Could not authenticate you from Ldapmain because "Invalid credentials for user.1".

The credentials are right.

Thanks for the edit, in 1) does this entry has attribute values for sAMAccountName and/or userPrincipalName ? Can you add it ? — EricLavault, Dec 11 '19 at 09:44
yes. the sAMAccountName would be _user.1_ and the userPrincipalName would be _user.1@company.com_ — Virtual, Dec 11 '19 at 12:40
Ok, that part of the configuration seems ok to me. Given the message "Invalid credentials for user.1", it looks like *user.1* matches the corresponding ldap entry but not the password. If the provided credentials are correct, it's likely that the password encoding scheme used is wrong and thus the password doesn't match even if the user submits the correct one. You can refer to [this post](https://stackoverflow.com/a/56165991/2529954) to dig further in that direction. — EricLavault, Dec 11 '19 at 15:36

score 1 · Answer 1 · answered Dec 09 '19 at 13:16

First, you need to fix the uid setting. It should hold the username attribute, not the value that maps to a username. Since you are targeting AD, this should be either sAMAccountName or userPrincipalName (eg. matching respectively username or username@domain.com).

If using sAMAccountName as uid and in case users submit username@domain.com format on login (instead of just username) you need to set allow_username_or_email_login: true (default is false).

Otheriwse if using userPrincipalName as uid, you must set it to false.

Then, you can set the base to narrow the search to users only, if you are not sure where users are located in the directory, just set the domain components as you did with ldapsearch: base: 'dc=organisation,dc=com'.

You can also set a filter as you did with ldapsearch : user_filter: '(objectClass=user)'.

Recap :

gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
   main:
     label: 'LDAP'
     host: '1.2.3.4'
     port: 389
     uid: 'sAMAccountName'
     bind_dn: 'CN=serviceACC,OU=Org 1,DC=organisation,DC=com'
     password: 'supersecurePass'
     encryption: 'plain'
     active_directory: true
     allow_username_or_email_login: true
     base: 'dc=organisation,dc=com'
     user_filter: '(objectClass=user)'
EOS

Thank you @EricLavault for your response. Unfortunately I get the same output in the console and I'm still not able to login via the webinterface of gitlab. I'm using the _sAMAccountName_ and i set the provided parameters which you gave me. But still no result. :( — Virtual, Dec 10 '19 at 12:15
Ok, can you please provide a use case with 1) an ldap user entry corresponding to a user that should be able to login (at least full dn and username attribute), 2) what this user submits (or is expected to submit) on login, and 3) the response from the server or any log/error message ? — EricLavault, Dec 10 '19 at 17:13
I updated my question with your requested informations. let me know if you need something else. — Virtual, Dec 11 '19 at 09:32

Gitlab EE - LDAP Authentication gives empty list

1 Answers1