Fix LDAP tls_options not working
What does this MR do and why
The removal of the Settingslogic gem in
!113040 (merged) created a
regression when LDAP tls_options
were used. It resulted in
Gitlab::config.ldap.servers.main.tls_options.cert
returning nil
instead of the certificate.
This occurred because Gitlab::Auth::Ldap::Config#custom_tls_options
attempts to duplicate the tls_options
Hash and symbolize the keys,
but instead it altered the internal Hash representation of
GitlabSettings::Options
. Since all the keys were transformed to
symbols but GitlabSettings::Options
converts all keys to strings,
the values were inaccessible.
To fix this, implement a dup
to create a copy of the internal
representation. We should also consider refactoring
Gitlab::Auth::Ldap::Config
.
Relates to #413017 (closed)
How to set up and validate locally
- Use the
master
branch. - In your
config/gitlab.yml
, use this block (you may have to remove the exisingldap
line):
ldap:
enabled: true
servers:
main: {"label":"Google Secure LDAP","host":"ldap.google.com","port":636,"uid":"uid","bind_dn":"XXXX","password":"XXXXX","encryption":"simple_tls","verify_certificates":false,"retry_empty_result_with_codes":[80\
],"base":"DC=XX,DC=XX","tls_options":{"cert":"-----BEGIN CERTIFICATE-----\nXXXX\n-----END CERTIFICATE-----\n","key":"-----BEGIN PRIVATE KEY-----\nXXXXX\n-----END PRIVATE KEY-----\n"}}
- Run
bin/rails console
- Enter:
Gitlab::config.ldap.servers.main.tls_options.cert
. You should get anil
value back. - Change to this branch and repeat steps 3 and 4.
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.