"Other sign-in" broken when ldap is enabled in 5.1
Created by: fredrik-w
Hi,
After upgrading GitLab to 5.1 I noticed that the "Other sign-in" to use local sign-in isn't working when ldap is enabled. I just keep getting the "Invalid email or password." message. I've done some debugging and found the offending commit: 9d92433a. Specifically in the "devise.rb" [1] initializer, if I revert that minor change (":login" => ":email") both ldap and local logins work fine.
In "lib/api/session.rb" it seems like we're still sending the parameter name in as "email" rather than "login". Though my ruby isn't any good so I might be wrong.
Regards, Fredrik
Activity
Created by: sroth80021
I'm running into this also -- this is preventing admin@local.host from logging in. It took awhile to track it down to having LDAP enabled.
You cannot login with the admin@local.host account if you have LDAP configured. So as far as I can tell, the only way to both use LDAP and perform admin tasks is to shutdown gitlab, turn off ldap, restart gitlab and login as admin, do tasks, and undo it all when you want to use LDAP again. Painful!
Trying to find a workaround...
By Administrator on 2013-04-23T17:36:22 (imported from GitLab)
Created by: sroth80021
ok, here is a workaround allowing one to turn an LDAP user into an admin:
- config with LDAP off, start GitLab
- login as Admin. KEEP BROWSER WINDOW OPEN
- config with LDAP on, restart GitLab, login as LDAP user
- using BROWSER WINDOW from #2 (closed), configure LDAP user from #3 (closed) as an admin.
from this point forward, although you cannot login as admin@local.host anymore, your LDAP user has admin privs and can do admin tasks.
By Administrator on 2013-04-23T17:48:03 (imported from GitLab)
Created by: keith9820
My site is running now after I followed fredrik-w's advice.
- Edit config/initializers/devise.rb
- Change line #26 (closed) from: config.authentication_keys = [ :login ] to: config.authentication_keys = [ :email ] now I can login using LDAP or gitlab authentication. Thanks, Fredrik!
By Administrator on 2013-04-23T17:57:39 (imported from GitLab)
Created by: lbt
I'm pretty sure this is the wrong way to workaround this fix - ie it will break in future releases.
Note that commit 9d92433a by @randx changes the haml to use :login instead of :email
See: https://github.com/gitlabhq/gitlabhq/pull/3469 commit 57046353 for how I did it (change to haml - still applies just fine to 5.1 and is not too intrusive so should rollback easily)
Also check comment from @raphendyr about a more correct/complete fix in pull #3046 which isn't applied yet
Since you are using LDAP, there's some discussion in https://github.com/gitlabhq/gitlabhq/pull/3646 about an alternate approach to mapping LDAP attributes which may be of interest.
By Administrator on 2013-04-24T16:38:28 (imported from GitLab)
Created by: raphendyr
I think easiest is to cherry-pick #3469 into production machine and go with that and give gitlab time to find correct solution. Do this with new branch to help you upgrade to new release later on.
Other easy way is to manually edit haml file. In this way you can easily run
git reset --hardbefore upgrading to new release.These are just my own thoughts.
By Administrator on 2013-04-25T14:32:58 (imported from GitLab)
Created by: sroth80021
Thanks @lbt and @raphendyr
By Administrator on 2013-04-25T21:50:10 (imported from GitLab)
Created by: fredrik-w
Hi,
I can confirm that the cherry-picked commit from the pull request (#3469) by @lbt fixed the issue. And I also see that it has been applied to the 5-1-stable branch, thank you!
Regards, Fredrik
By Administrator on 2013-04-29T05:43:41 (imported from GitLab)
