Users With 2FA Enabled Cannot Log In After Updating to 8.8.3

After updating our server to GitLab CE 8.8.3, users that had 2FA enabled were unable to log in via the web interface, instead receiving the banner message:

Could not authenticate you from Ldapmain because "Undefined method `[]' for nil:nilclass".

• The server's production log showed a status of 500 after the attempt, but not much additional information
• This only affected users with 2FA enabled
• Users were able to log in after 2FA was disabled by the admin
• Upon re-enabling 2FA, users were again unable to log in
• Users with 2FA enabled were able to authenticate via SSH with no issue, even when they could not log in via the web interface

Can you include the Error 500 backtrace from /var/log/gitlab/gitlab-rails/production.log?

mentioned in issue #18186 (closed)

This is indeed the same issue as #18186 (closed)

Started POST "/users/auth/ldapmain/callback" for <IP-REDACTED> at 2016-06-03 12:40:59 -0400
Processing by OmniauthCallbacksController#ldapmain as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"[FILTERED]", "username"=>"<USER-REDACTED>", "password"=>"[FILTERED]"}
Completed 500 Internal Server Error in 89ms (ActiveRecord: 6.8ms)
Processing by OmniauthCallbacksController#failure as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"[FILTERED]", "username"=>"<USER-REDACTED>", "password"=>"[FILTERED]"}
Redirected to https://<HOST-NAME-REDACTED>/users/sign_in
Completed 302 Found in 12ms (ActiveRecord: 0.7ms)

Started POST "/users/auth/ldapmain/callback" for 127.0.0.1 at 2016-06-03 14:53:51 -0400
Processing by OmniauthCallbacksController#ldapmain as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"[FILTERED]", "username"=>"myuser", "password"=>"[FILTERED]"}
Completed 500 Internal Server Error in 217ms (ActiveRecord: 11.5ms)
Processing by OmniauthCallbacksController#failure as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"[FILTERED]", "username"=>"myuser", "password"=>"[FILTERED]"}
Redirected to https://gitlab/users/sign_in

Apologies, didn't notice my issue was closed before I submitted this.

The only LDAP-related change in 8.3.3 was in EE, so I think we can rule that out.

Does reverting !4369 (merged) change things?

@rspeicher Is it possible that user_params is nil?

@stanhu Ah, it could be when coming from Omniauth.

+1, I am using ldap for signin with 2fa enabled. cannot sign in anymore.

I assume that params[resource_name] is nil in two_factor.html.haml. When commenting out that line, I can sign in again.

Reassigned to @rspeicher

We'll try to get this resolved ASAP. For now, the workaround suggested above sounds like the way to go.

Hi, will this be released in 8.8.4? It stopped all of our users from logging in!

Milestone changed to %8.8

mentioned in merge request !4493 (merged)

https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/4493

For those of us running into this with production environments it would be nice to add how to comment it out in HAML.

Secondly - this is a showstopper currently breaking our production Gitlab for every single one of our users as we made 2FA mandatory. If a workaround was already in place 4 days ago I think there should be a patch release for something as breaking as this...?

I patched our production environment manually, to make it work again for us ;) I just hope, the next release will contain a fix.

Status changed to closed by merge request !4493 (merged)

mentioned in commit 8138f340

mentioned in commit 00cae51e

Currently preparing 8.8.4 to include this fix.

Thanks very much for your work

Mentioned in commit pfjason/gitlab-ce@00cae51e

Mentioned in commit pfjason/gitlab-ce@8138f340