修改配置文件

重要的配置项：

  1. bind_dn：gitlab 系统使用该用户登录 ldap 系统，用于查找其它用户。
  2. uid：参考图 1
  3. encryption：加密方式
  4. verify_certificates：验证证书
  5. active_directory：是否活动目录
  6. allow_username_or_email_login：允许用户名和邮箱登录
  7. lowercase_usernames：小写用户名
  8. base：用户查找区域

uid.png

gitlab_rails['ldap_enabled'] = true

###! **remember to close this block with 'EOS' below**
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
   main: 
     label: 'LDAP'
     host: '172.17.1.13'
     port: 389
     uid: 'uid'
     bind_dn: 'uid=gitlab,ou=System,dc=qiansw,dc=com'
     password: 'a409dxcgv28ffffe7a'
     encryption: 'plain'
     verify_certificates: false
     active_directory: false
     allow_username_or_email_login: true
     lowercase_usernames: false
     block_auto_created_users: false
     base: 'ou=People,dc=qiansw,dc=com'
     user_filter: ''
     ## EE only
     #group_base: ''
     #admin_group: ''
     #sync_ssh_keys: false
#
#   secondary: # 'secondary' is the GitLab 'provider ID' of second LDAP server
#     label: 'LDAP'
#     host: '_your_ldap_server'
#     port: 389
#     uid: 'sAMAccountName'
#     bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
#     password: '_the_password_of_the_bind_user'
#     encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
#     verify_certificates: true
#     active_directory: true
#     allow_username_or_email_login: false
#     lowercase_usernames: false
#     block_auto_created_users: false
#     base: ''
#     user_filter: ''
#     ## EE only
#     group_base: ''
#     admin_group: ''
#     sync_ssh_keys: false
EOS

注意事项

修改完配置文件后，需要重启 gitlab 服务，才能在 web 界面看到 ldap 登录选项。

gitlab_ldap.png

配置途中可以使用 gitlab-rake gitlab:ldap:check 指令验证 ldap 是否配置正常。

Checking LDAP ...

Server: ldapmain
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)
        DN: uid=test,ou=people,dc=qiansw,dc=com       uid: test
        DN: uid=root,ou=people,dc=qiansw,dc=com       uid: root


Checking LDAP ... Finished