Document lack of support for AD domain trusts

Overview

Microsoft Active Directory allows the configuration of "domain trusts" trusts allow one domain to access users on another domain (depending on the trust type). GitLab uses Net::LDAP, it's not clear if we support (or can support) an AD domain trust configuration.

Users report this doesn't work correctly. See https://forum.gitlab.com/t/using-users-from-a-domain-trust/2284, https://gitlab.zendesk.com/agent/tickets/50155

We should document that this is not supported or see if it can be supported

Documentation

• https://technet.microsoft.com/en-us/library/cc961481.aspx

• https://technet.microsoft.com/en-us/library/cc783351(v=ws.10).aspx

• https://en.wikipedia.org/wiki/Active_Directory#Trusting

• http://stackoverflow.com/questions/5051381

• http://stackoverflow.com/questions/3161566

@dblessing @stanhu

@MrChrisW I believe this is basically the same as gitlab-org/gitlab-ee#657.

I'll copy some information that you linked in the other issue. Let's use this issue to create documentation that explains we do not support this. If you have a good understanding of the trusted domains do you want to create some docs?

Mentioned in issue #657

Changed title: GitLab LDAP support for AD domain trusts → Document lack of support for AD domain trusts

Added ~111707 label

@dblessing It looks like #657 might be the same issue, it wasn't clear to me at that stage if it was an AD trusted domain configuration.

I've implemented domain trusts in an AD environment previously. I'll be happy to add a note that this isn't supported, however we should look to support this kind of functionally in future via #657.

It's a very common AD configuration, most of the time 1 domain administrator may not have access to the other domain therefore a trust relationship is formed.

changed milestone to %8.17

mentioned in issue gitlab-com/gitlab-docs#69 (closed)

changed milestone to %9.0

Moving to 9.0 to see if this can be supported.

added docs-todo label

changed milestone to %9.1

removed docs-todo label

added docs-missing label

@dblessing @MrChrisW is this as simple as adding a line saying we don't support this (yet)?

@axil Yes

changed milestone to %9.2

added customer label

changed milestone to %9.5