Set "Project limit" and "Can create groups" attributes via SAML attribute statements
What does this MR do?
Related to #263661 (closed)
Allow new Group SAML users to be created with custom values for projects_limit and can_create_group based on SAML attribute statements.
This is an extension to SAML User Provisioning recently introduced. When a user is created automatically via Group SAML that user is 'owned' by the group. Given ownership, we can allow the SAML IdP to also dictate some user attributes for the user. The two attribute we allow here are currently the most requested by GitLab.com enterprise users. It will effectively allow enterprises to prevent users from working outside the group's namespace.
Screenshots (strongly suggested)
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team