LDAP 故障排查

无法从 Ldapmain 认证您，因为 "连接超时 - 用户指定超时"。

main: # 'main' 是此 LDAP 服务器的 GitLab 'provider ID'
  label: 'LDAP'
  host: 'ldap.example.com'
  # ...
  group_base: 'cn=my_group,ou=groups,dc=example,dc=com'
  admin_group: 'my_admin_group'

adapter = Gitlab::Auth::Ldap::Adapter.new('ldapmain')
options = {
    # :base 是必需的
    # 使用 .base 或 .group_base
    base: adapter.config.group_base,

    # :filter 是可选的
    # 'cn' 在 :base 下查找所有 "cn"
    # '*' 是搜索字符串 - 此处为通配符
    filter: Net::LDAP::Filter.eq('cn', '*'),

    # :attributes 是可选的
    # 需要返回的属性
    attributes: %w(dn cn memberuid member submember uniquemember memberof)
}
adapter.ldap_search(options)

adapter = Gitlab::Auth::Ldap::Adapter.new('ldapmain')
options = {
    # :base 是必需的
    # 使用 .base 或 .group_base
    base: adapter.config.base,

    # :filter 是可选的
    # 此过滤器包含 OID 1.2.840.113556.1.4.1941
    # 将搜索 LDAP 目录中组 gitlab_grp 的所有直接和嵌套成员
    filter: Net::LDAP::Filter.construct("(memberOf:1.2.840.113556.1.4.1941:=CN=gitlab_grp,DC=example,DC=com)"),

    # :attributes 是可选的
    # 需要返回的属性
    attributes: %w(dn cn memberuid member submember uniquemember memberof)
}
adapter.ldap_search(options)

(LDAP) 保存用户 <用户 DN> ([email protected]) 时出错：["邮箱已被占用"]

# 在主邮箱和次级邮箱中搜索
user = User.find_by_any_email('[email protected]')
user.username

ldapsearch -H ldaps://$host:$port -D "$bind_dn" -y bind_dn_password.txt  -b "$base" "$user_filter" sAMAccountName

Rails.logger.level = Logger::DEBUG

LdapSyncWorker.new.perform

同步用户 John, [email protected]
  身份加载 (0.9ms)  SELECT  "identities".* FROM "identities" WHERE "identities"."user_id" = 20 AND (provider LIKE 'ldap%') LIMIT 1
使用 LDIF 实例化 Gitlab::Auth::Ldap::Person：
dn: cn=John Smith,ou=people,dc=example,dc=com
cn: John Smith
mail: [email protected]
memberof: cn=admin_staff,ou=people,dc=example,dc=com
uid: John

  用户同步属性元数据加载 (0.9ms)  SELECT  "user_synced_attributes_metadata".* FROM "user_synced_attributes_metadata" WHERE "user_synced_attributes_metadata"."user_id" = 20 LIMIT 1
   (0.3ms)  BEGIN
  命名空间加载 (1.0ms)  SELECT  "namespaces".* FROM "namespaces" WHERE "namespaces"."owner_id" = 20 AND "namespaces"."type" IS NULL LIMIT 1
  路由加载 (0.8ms)  SELECT  "routes".* FROM "routes" WHERE "routes"."source_id" = 27 AND "routes"."source_type" = 'Namespace' LIMIT 1
  CI 运行器加载 (1.1ms)  SELECT "ci_runners".* FROM "ci_runners" INNER JOIN "ci_runner_namespaces" ON "ci_runners"."id" = "ci_runner_namespaces"."runner_id" WHERE "ci_runner_namespaces"."namespace_id" = 27
   (0.7ms)  COMMIT
   (0.4ms)  BEGIN
  路由加载 (0.8ms)  SELECT "routes".* FROM "routes" WHERE (LOWER("routes"."path") = LOWER('John'))
  命名空间加载 (1.0ms)  SELECT  "namespaces".* FROM "namespaces" WHERE "namespaces"."id" = 27 LIMIT 1
  路由存在 (0.9ms)  SELECT  1 AS one FROM "routes" WHERE LOWER("routes"."path") = LOWER('John') AND "routes"."id" != 50 LIMIT 1
  用户更新 (1.1ms)  UPDATE "users" SET "updated_at" = '2019-10-17 14:40:59.751685', "last_credential_check_at" = '2019-10-17 14:40:59.738714' WHERE "users"."id" = 20

同步用户 John, [email protected]

  身份加载 (0.9ms)  SELECT  "identities".* FROM "identities" WHERE "identities"."user_id" = 20 AND (provider LIKE 'ldap%') LIMIT 1

使用 LDIF 实例化 Gitlab::Auth::Ldap::Person：
dn: cn=John Smith,ou=people,dc=example,dc=com
cn: John Smith
mail: [email protected]
memberof: cn=admin_staff,ou=people,dc=example,dc=com
uid: John

LDAP 搜索错误：无此类对象

  用户更新 (0.4ms)  UPDATE "users" SET "state" = $1, "updated_at" = $2 WHERE "users"."id" = $3  [["state", "ldap_blocked"], ["updated_at", "2019-10-18 15:46:22.902177"], ["id", 20]]

Rails.logger.level = Logger::DEBUG

adapter = Gitlab::Auth::Ldap::Adapter.new('ldapmain') # 若 `main` 是 LDAP 提供商
Gitlab::Auth::Ldap::Person.find_by_uid('<uid>', adapter)

# 查找相关组
group = Group.find_by(name: 'my_gitlab_group')

# 检查组本身的错误
group.valid?
group.errors.map(&:full_messages)

# 检查组成员和请求者的错误
group.requesters.map(&:valid?)
group.requesters.map(&:errors).map(&:full_messages)
group.members.map(&:valid?)
group.members.map(&:errors).map(&:full_messages)

irb(main):018:0> group.members.map(&:errors).map(&:full_messages)
=> [["成员的邮箱地址不允许加入此组。请前往组的 **设置 > 常规** 页面，检查 **按邮箱域名限制成员**。"]]

Rails.logger.level = Logger::DEBUG

LdapAllGroupsSyncWorker.new.perform

开始同步 'ldapmain' 提供商的 'my_group' 组

'ldap_group_1' LDAP 组中的成员：["uid=john0,ou=people,dc=example,dc=com",
"uid=mary0,ou=people,dc=example,dc=com", "uid=john1,ou=people,dc=example,dc=com",
"uid=mary1,ou=people,dc=example,dc=com", "uid=john2,ou=people,dc=example,dc=com",
"uid=mary2,ou=people,dc=example,dc=com", "uid=john3,ou=people,dc=example,dc=com",
"uid=mary3,ou=people,dc=example,dc=com", "uid=john4,ou=people,dc=example,dc=com",
"uid=mary4,ou=people,dc=example,dc=com"]

已解析 'my_group' 组成员访问：{"uid=john0,ou=people,dc=example,dc=com"=>30,
"uid=mary0,ou=people,dc=example,dc=com"=>30, "uid=john1,ou=people,dc=example,dc=com"=>30,
"uid=mary1,ou=people,dc=example,dc=com"=>30, "uid=john2,ou=people,dc=example,dc=com"=>30,
"uid=mary2,ou=people,dc=example,dc=com"=>30, "uid=john3,ou=people,dc=example,dc=com"=>30,
"uid=mary3,ou=people,dc=example,dc=com"=>30, "uid=john4,ou=people,dc=example,dc=com"=>30,
"uid=mary4,ou=people,dc=example,dc=com"=>30}

用户 DN `uid=john0,ou=people,dc=example,dc=com` 应有权访问 'my_group' 组，
但 GitLab 中无此身份的用户。用户首次登录时将更新成员资格。

完成所有提供商的 'my_group' 组同步

同步 'ldapmain' 提供商的管理员用户

完成 'ldapmain' 提供商的管理员用户同步

未为 'ldapmain' 提供商配置 'admin_group'。跳过

Rails.logger.level = Logger::DEBUG

# 查找 GitLab 组。
# 若输出为 `nil`，则未找到组。
# 若输出包含大量组属性，则成功找到组。
group = Group.find_by(name: 'my_gitlab_group')

# 将此组与 LDAP 同步
EE::Gitlab::Auth::Ldap::Sync::Group.execute_all_providers(group)

# 查找适配器和组本身
adapter = Gitlab::Auth::Ldap::Adapter.new('ldapmain') # 若 `main` 是 LDAP 提供商
ldap_group = EE::Gitlab::Auth::Ldap::Group.find_by_cn('group_cn_here', adapter)

# 查找 LDAP 组的成员
ldap_group.member_dns
ldap_group.member_uids

# 每条记录必须包含旧用户名和新邮箱
emails = {
  '原始用户名' => '新邮箱地址',
  ...
}

emails.each do |username, email|
  user = User.find_by_username(username)
  user.email = email
  user.skip_reconfirmation!
  user.save!
end

认证失败！invalid_credentials: OAuth2::Error, invalid_grant.

无法从 Ldapmain 认证，因为 "未知提供商 (ldapsecondary)。可用提供商：["ldapmain"]"。

ldap_identities = Identity.where(provider: "ldapsecondary")
ldap_identities.each do |identity|
  u=User.find_by_id(identity.user_id)
  ui=Identity.where(user_id: identity.user_id)
  puts "用户: #{u.username}\n   #{u.email}\n   最后活动时间: #{u.last_activity_on}\n   #{identity.provider} ID: #{identity.id} 外部: #{identity.extern_uid}"
  puts "   所有身份:"
  ui.each do |alli|
    puts "    - #{alli.provider} ID: #{alli.id} 外部: #{alli.extern_uid}"
  end
end;nil

sudo gitlab-rake gitlab:ldap:rename_provider[ldapsecondary,ldapmain]

ldap_identities = Identity.where(provider: "ldapsecondary")
ldap_identities.each do |identity|
  puts "删除身份: #{identity.id} #{identity.provider}: #{identity.extern_uid}"
  identity.destroy!
rescue => e
  puts '删除身份时生成错误：\n ' + e.to_s
end; nil

gitlab_rails['ldap_servers'] = YAML.load <<-'EOS' # 记得在下面用 'EOS' 关闭此块
   main: # 'main' 是此 LDAP 服务器的 GitLab 'provider ID'
     label: 'LDAP'
     host: '127.0.0.1'
     port: 389
     uid: 'uid'
     encryption: 'plain'
     bind_dn: 'cn=admin,dc=ldap-testing,dc=example,dc=com'
     password: 'Password1'
     active_directory: true
     allow_username_or_email_login: false
     block_auto_created_users: false
     base: 'dc=ldap-testing,dc=example,dc=com'
     user_filter: ''
     attributes:
       username: ['uid', 'userid', 'sAMAccountName']
       email:    ['mail', 'email', 'userPrincipalName']
       name:       'cn'
       first_name: 'givenName'
       last_name:  'sn'
     group_base: 'ou=groups,dc=ldap-testing,dc=example,dc=com'
     admin_group: 'gitlab_admin'
EOS

ldapsearch -D "cn=admin,dc=ldap-testing,dc=example,dc=com" \
  -w Password1 \
  -p 389 \
  -h 127.0.0.1 \
  -b "dc=ldap-testing,dc=example,dc=com"

ldapsearch -D "cn=admin,dc=ldap-testing,dc=example,dc=com" \
  -w Password1 \
  -p 389 \
  -h "testing.ldap.com" \
  -b "dc=ldap-testing,dc=example,dc=com" -Z

ldapsearch -D "cn=admin,dc=ldap-testing,dc=example,dc=com" \
  -w Password1 \
  -H "ldaps://testing.ldap.com:636" \
  -b "dc=ldap-testing,dc=example,dc=com"

adfind -h ad.example.org:636 -ssl -u "CN=GitLabSRV,CN=Users,DC=GitLab,DC=org" -up Password1 -b "OU=GitLab INT,DC=GitLab,DC=org" -f (objectClass=*)

adfind -h ad.example.org:636 -ssl -u "CN=GitLabSRV,CN=Users,DC=GitLab,DC=org" -up Password1 -b "OU=GitLab INT,DC=GitLab,DC=org" -f "(&(objectcategory=person)(CN=Leroy Fox))"

Rails.logger.level = Logger::DEBUG

# 查找组和子组
group = Group.find_by_full_path("parent_group")
subgroup = Group.find_by_full_path("parent_group/child_group")

# 组和子组错误
group.valid?
group.errors.map(&:full_messages)

subgroup.valid?
subgroup.errors.map(&:full_messages)

# 组和子组的成员及请求者错误
group.requesters.map(&:valid?)
group.requesters.map(&:errors).map(&:full_messages)
group.members.map(&:valid?)
group.members.map(&:errors).map(&:full_messages)
group.members_and_requesters.map(&:errors).map(&:full_messages)

subgroup.requesters.map(&:valid?)
subgroup.requesters.map(&:errors).map(&:full_messages)
subgroup.members.map(&:valid?)
subgroup.members.map(&:errors).map(&:full_messages)
subgroup.members_and_requesters.map(&:errors).map(&:full_messages)