Gitlab keeps locking LDAP accounts when using personal access tokens in v9.0.1

Summary

Gitlab keeps locking LDAP accounts when using personal access tokens to authenticate against GIT or Docker repositories with username (=ldap username) and personal access tokens.

Actually, this bug was already solved once in https://gitlab.com/gitlab-org/gitlab-ce/blob/29414ab0438583c7401e94a74a613497874b5e4e/lib/gitlab/auth.rb where "personal_access_token_check(login, password)" is before "user_with_password_for_git(login, password)". This was the merge request: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/8752/diffs

But it was reverted in v9.0.1 again see https://gitlab.com/gitlab-org/gitlab-ce/blob/29414ab0438583c7401e94a74a613497874b5e4e/lib/gitlab/auth.rb. See also similar issue in https://forum.gitlab.com/t/gitlab-keep-locking-ldap-accounts/5364

Steps to reproduce

Create GitLab user with same username as the LDAP user. Login with username and personal access token. LDAP failed login attempts increase until user gets locked.

What is the current bug behavior?

Login with username and personal access token. LDAP failed login attempts increase until user gets locked.

What is the expected correct behavior?

Login with username and personal access token. No LDAP failed login attempts and user does not get locked.

Relevant logs and/or screenshots

See https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/8752/diffs

Output of checks

Results of GitLab environment info

System information System: Ubuntu 16.04 Current User: git Using RVM: no Ruby Version: 2.3.3p222 Gem Version: 2.6.6 Bundler Version:1.13.7 Rake Version: 10.5.0 Redis Version: 3.2.5 Git Version: 2.10.2 Sidekiq Version:4.2.7

GitLab information Version: 9.0.1 Revision: gitlab-foss@0fa55cc3 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: postgresql URL: https://example.com HTTP Clone URL: https://example.com/some-group/some-project.git SSH Clone URL: git@example.com:some-group/some-project.git Using LDAP: yes Using Omniauth: no

GitLab Shell Version: 5.0.0 Repository storage paths:

• default: /var/opt/gitlab/git-data/repositories Hooks: /opt/gitlab/embedded/service/gitlab-shell/hooks/ Git: /opt/gitlab/embedded/bin/git

Results of GitLab application Check

Checking GitLab Shell ...

GitLab Shell version >= 5.0.0 ? ... OK (5.0.0) Repo base directory exists? default... yes Repo storage directories are symlinks? default... no Repo paths owned by git:git? default... yes Repo paths access is drwxrws---? default... yes hooks directories in repos are links: ... 2/3 ... repository is empty 4/4 ... ok 4/5 ... ok 9/6 ... ok 5/7 ... ok 9/9 ... ok 9/10 ... ok 4/11 ... ok 8/12 ... ok 10/13 ... ok 13/14 ... ok 11/15 ... ok 12/16 ... ok 12/17 ... ok 12/18 ... ok 10/19 ... repository is empty 17/22 ... ok 4/23 ... ok 4/24 ... ok 4/25 ... ok 4/26 ... ok 4/27 ... ok 4/28 ... ok 4/29 ... ok 11/30 ... ok 9/31 ... ok 9/32 ... ok 17/33 ... ok 12/34 ... ok 9/35 ... ok 17/39 ... ok 13/40 ... ok 4/41 ... ok 13/42 ... ok 17/43 ... ok 2/48 ... ok 2/49 ... ok 17/50 ... ok 28/51 ... ok 4/53 ... ok 5/54 ... ok 10/55 ... ok 2/59 ... ok 26/60 ... ok 26/61 ... ok 12/62 ... ok 9/63 ... ok 37/64 ... ok 10/65 ... ok 10/68 ... ok 10/69 ... ok 9/70 ... ok 10/71 ... ok 10/72 ... ok 34/73 ... ok 10/76 ... ok 46/79 ... ok 43/81 ... ok 34/82 ... ok 13/86 ... ok 4/88 ... ok 4/91 ... ok 2/93 ... ok 10/94 ... ok 4/96 ... ok 2/98 ... ok 20/100 ... ok 33/102 ... ok 33/103 ... ok 30/104 ... ok 4/105 ... ok 51/108 ... ok 9/109 ... ok 3/110 ... ok 4/111 ... ok 17/112 ... ok 5/113 ... ok 12/116 ... ok 18/117 ... ok 34/120 ... ok 4/124 ... ok 4/125 ... ok 4/126 ... ok 64/127 ... ok 44/128 ... ok 20/130 ... ok 9/131 ... ok 18/133 ... ok 18/134 ... ok 18/135 ... ok 18/136 ... ok 4/143 ... ok 5/144 ... ok 4/145 ... ok 34/146 ... ok 11/147 ... ok 76/148 ... ok 22/149 ... ok 17/150 ... ok 17/151 ... ok 26/156 ... ok 48/157 ... ok 10/158 ... ok 5/160 ... ok 53/167 ... ok 58/169 ... ok 58/170 ... ok 17/171 ... ok 11/172 ... ok 77/174 ... ok 77/175 ... ok 77/176 ... ok 77/177 ... ok 77/178 ... ok 77/179 ... ok 5/189 ... ok 34/190 ... ok 13/191 ... ok 4/193 ... ok 4/194 ... ok 4/195 ... ok 34/196 ... ok 83/200 ... ok 22/202 ... ok 4/203 ... ok 4/204 ... ok 4/206 ... ok 48/207 ... ok 10/208 ... ok 22/209 ... ok 87/210 ... ok 88/211 ... ok 58/212 ... ok 18/213 ... ok 10/214 ... ok Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Check GitLab API access: OK Access to /var/opt/gitlab/.ssh/authorized_keys: OK Send ping to redis server: OK gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Sidekiq ...

Running? ... yes Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

Checking Reply by email ...

Reply by email is disabled in config/gitlab.yml

Checking Reply by email ... Finished

Checking LDAP ...

Server: ldapmain LDAP authentication... Success LDAP users with access to your GitLab server (only showing the first 100 results) ... omitted ....

Checking LDAP ... Finished

Checking GitLab ...

Git configured with autocrlf=input? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config outdated? ... no Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory setup correctly? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) projects have namespace: ... 2/3 ... yes 4/4 ... yes 4/5 ... yes 9/6 ... yes 5/7 ... yes 9/9 ... yes 9/10 ... yes 4/11 ... yes 8/12 ... yes 10/13 ... yes 13/14 ... yes 11/15 ... yes 12/16 ... yes 12/17 ... yes 12/18 ... yes 10/19 ... yes 17/22 ... yes 4/23 ... yes 4/24 ... yes 4/25 ... yes 4/26 ... yes 4/27 ... yes 4/28 ... yes 4/29 ... yes 11/30 ... yes 9/31 ... yes 9/32 ... yes 17/33 ... yes 12/34 ... yes 9/35 ... yes 17/39 ... yes 13/40 ... yes 4/41 ... yes 13/42 ... yes 17/43 ... yes 2/48 ... yes 2/49 ... yes 17/50 ... yes 28/51 ... yes 4/53 ... yes 5/54 ... yes 10/55 ... yes 2/59 ... yes 26/60 ... yes 26/61 ... yes 12/62 ... yes 9/63 ... yes 37/64 ... yes 10/65 ... yes 10/68 ... yes 10/69 ... yes 9/70 ... yes 10/71 ... yes 10/72 ... yes 34/73 ... yes 10/76 ... yes 46/79 ... yes 43/81 ... yes 34/82 ... yes 13/86 ... yes 4/88 ... yes 4/91 ... yes 2/93 ... yes 10/94 ... yes 4/96 ... yes 2/98 ... yes 20/100 ... yes 33/102 ... yes 33/103 ... yes 30/104 ... yes 4/105 ... yes 51/108 ... yes 9/109 ... yes 3/110 ... yes 4/111 ... yes 17/112 ... yes 5/113 ... yes 12/116 ... yes 18/117 ... yes 34/120 ... yes 4/124 ... yes 4/125 ... yes 4/126 ... yes 64/127 ... yes 44/128 ... yes 20/130 ... yes 9/131 ... yes 18/133 ... yes 18/134 ... yes 18/135 ... yes 18/136 ... yes 4/143 ... yes 5/144 ... yes 4/145 ... yes 34/146 ... yes 11/147 ... yes 76/148 ... yes 22/149 ... yes 17/150 ... yes 17/151 ... yes 26/156 ... yes 48/157 ... yes 10/158 ... yes 5/160 ... yes 53/167 ... yes 58/169 ... yes 58/170 ... yes 17/171 ... yes 11/172 ... yes 77/174 ... yes 77/175 ... yes 77/176 ... yes 77/177 ... yes 77/178 ... yes 77/179 ... yes 5/189 ... yes 34/190 ... yes 13/191 ... yes 4/193 ... yes 4/194 ... yes 4/195 ... yes 34/196 ... yes 83/200 ... yes 22/202 ... yes 4/203 ... yes 4/204 ... yes 4/206 ... yes 48/207 ... yes 10/208 ... yes 22/209 ... yes 87/210 ... yes 88/211 ... yes 58/212 ... yes 18/213 ... yes 10/214 ... yes Redis version >= 2.8.0? ... yes Ruby version >= 2.1.0 ? ... yes (2.3.3) Your git bin path is "/opt/gitlab/embedded/bin/git" Git version >= 2.7.3 ? ... yes (2.10.2) Active users: 72

Checking GitLab ... Finished

Possible fixes

Maybe reverting the order like in the original merge request or like in v8.17.4. See https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/8752/diffs and https://gitlab.com/gitlab-org/gitlab-ce/blob/29414ab0438583c7401e94a74a613497874b5e4e/lib/gitlab/auth.rb