Skip to content

G
gitlab-ce
Commit b33c606a authored by Russell Dickenson's avatar Russell Dickenson Committed by Amy Qualls
Browse files
Options

Replace phrase active users with billable users in all docs

parent 8ff24e29
Show whitespace changes
Inline Side-by-side
Showing with 47 additions and 47 deletions
doc/administration/auth/ldap/index.md
View file @ b33c606a
......@@ -46,10 +46,10 @@ the LDAP server or share email addresses.
### User deletion **(CORE ONLY)**
If a user is deleted from the LDAP server, they will be blocked in GitLab as
well. Users will be immediately blocked from logging in. However, there is an
If a user is deleted from the LDAP server, they are also blocked in GitLab.
Users are immediately blocked from logging in. However, there is an
LDAP check cache time of one hour (see note) which means users that
are already logged in or are using Git over SSH will still be able to access
are already logged in or are using Git over SSH are be able to access
GitLab for up to one hour. Manually block the user in the GitLab Admin Area to
immediately block all access.
......@@ -66,7 +66,7 @@ in the application settings.
When a user signs in to GitLab with LDAP for the first time, and their LDAP
email address is the primary email address of an existing GitLab user, then
the LDAP DN will be associated with the existing user. If the LDAP email
the LDAP DN is associated with the existing user. If the LDAP email
attribute is not found in GitLab's database, a new user is created.
In other words, if an existing GitLab user wants to enable LDAP sign-in for
......@@ -94,7 +94,7 @@ for information on the LDAP check Rake task.
NOTE: **Note:**
The `encryption` value `simple_tls` corresponds to 'Simple TLS' in the LDAP
library. `start_tls` corresponds to StartTLS, not to be confused with regular TLS.
Normally, if you specify `simple_tls` it will be on port 636, while `start_tls` (StartTLS)
Normally, if you specify `simple_tls` it is on port 636, while `start_tls` (StartTLS)
would be on port 389. `plain` also operates on port 389. Removed values: `tls` was replaced with `start_tls` and `ssl` was replaced with `simple_tls`.
LDAP users must have a set email address, regardless of whether or not it's used
......@@ -167,27 +167,27 @@ production:
| Setting | Description | Required | Examples |
| ------- | ----------- | -------- | -------- |
| `label` | A human-friendly name for your LDAP server. It will be displayed on your sign-in page. | yes | `'Paris'` or `'Acme, Ltd.'` |
| `label` | A human-friendly name for your LDAP server. It is displayed on your sign-in page. | yes | `'Paris'` or `'Acme, Ltd.'` |
| `host` | IP address or domain name of your LDAP server. | yes | `'ldap.mydomain.com'` |
| `port` | The port to connect with on your LDAP server. Always an integer, not a string. | yes | `389` or `636` (for SSL) |
| `uid` | LDAP attribute for username. Should be the attribute, not the value that maps to the `uid`. | yes | `'sAMAccountName'` or `'uid'` or `'userPrincipalName'` |
| `bind_dn` | The full DN of the user you will bind with. | no | `'america\momo'` or `'CN=Gitlab,OU=Users,DC=domain,DC=com'` |
| `bind_dn` | The full DN of the user you bind with. | no | `'america\momo'` or `'CN=Gitlab,OU=Users,DC=domain,DC=com'` |
| `password` | The password of the bind user. | no | `'your_great_password'` |
| `encryption` | Encryption method. The `method` key is deprecated in favor of `encryption`. | yes | `'start_tls'` or `'simple_tls'` or `'plain'` |
| `verify_certificates` | Enables SSL certificate verification if encryption method is `start_tls` or `simple_tls`. Defaults to true. | no | boolean |
| `timeout` | Set a timeout, in seconds, for LDAP queries. This helps avoid blocking a request if the LDAP server becomes unresponsive. A value of 0 means there is no timeout. | no | `10` or `30` |
| `active_directory` | This setting specifies if LDAP server is Active Directory LDAP server. For non-AD servers it skips the AD specific queries. If your LDAP server is not AD, set this to false. | no | boolean |
| `allow_username_or_email_login` | If enabled, GitLab will ignore everything after the first `@` in the LDAP username submitted by the user on sign-in. If you are using `uid: 'userPrincipalName'` on ActiveDirectory you need to disable this setting, because the userPrincipalName contains an `@`. | no | boolean |
| `block_auto_created_users` | To maintain tight control over the number of active users on your GitLab installation, enable this setting to keep new users blocked until they have been cleared by the admin (default: false). | no | boolean |
| `allow_username_or_email_login` | If enabled, GitLab ignores everything after the first `@` in the LDAP username submitted by the user on sign-in. If you are using `uid: 'userPrincipalName'` on ActiveDirectory you need to disable this setting, because the userPrincipalName contains an `@`. | no | boolean |
| `block_auto_created_users` | To maintain tight control over the number of billable users on your GitLab installation, enable this setting to keep new users blocked until they have been cleared by an administrator (default: false). | no | boolean |
| `base` | Base where we can search for users. | yes | `'ou=people,dc=gitlab,dc=example'` or `'DC=mydomain,DC=com'` |
| `user_filter` | Filter LDAP users. Format: [RFC 4515](https://tools.ietf.org/search/rfc4515) Note: GitLab does not support `omniauth-ldap`'s custom filter syntax. | no | `'(employeeType=developer)'` or `'(&(objectclass=user)(|(samaccountname=momo)(samaccountname=toto)))'` |
| `lowercase_usernames` | If lowercase_usernames is enabled, GitLab will lower case the username. | no | boolean |
| `lowercase_usernames` | If lowercase_usernames is enabled, GitLab converts the name to lower case. | no | boolean |
### SSL Configuration Settings **(CORE ONLY)**
| Setting | Description | Required | Examples |
| ------- | ----------- | -------- | -------- |
| `ca_file` | Specifies the path to a file containing a PEM-format CA certificate, e.g. if you need to use an internal CA. | no | `'/etc/ca.pem'` |
| `ca_file` | Specifies the path to a file containing a PEM-format CA certificate, for example, if you need to use an internal CA. | no | `'/etc/ca.pem'` |
| `ssl_version` | Specifies the SSL version for OpenSSL to use, if the OpenSSL default is not appropriate. | no | `'TLSv1_1'` |
| `ciphers` | Specific SSL ciphers to use in communication with LDAP servers. | no | `'ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2'` |
| `cert` | Client certificate | no | `'-----BEGIN CERTIFICATE----- <REDACTED> -----END CERTIFICATE -----'` |
......@@ -195,11 +195,11 @@ production:
### Attribute Configuration Settings **(CORE ONLY)**
LDAP attributes that GitLab will use to create an account for the LDAP user. The specified attribute can either be the attribute name as a string (e.g. `'mail'`), or an array of attribute names to try in order (e.g. `['mail', 'email']`). Note that the user's LDAP sign-in will always be the attribute specified as `uid` above.
LDAP attributes that GitLab uses to create an account for the LDAP user. The specified attribute can either be the attribute name as a string (for example, `'mail'`), or an array of attribute names to try in order (for example, `['mail', 'email']`). Note that the user's LDAP sign-in is the attribute specified as `uid` above.
| Setting | Description | Required | Examples |
| ------- | ----------- | -------- | -------- |
| `username` | The username will be used in paths for the user's own projects (like `gitlab.example.com/username/project`) and when mentioning them in issues, merge request and comments (like `@username`). If the attribute specified for `username` contains an email address, the GitLab username will be the part of the email address before the `@`. | no | `['uid', 'userid', 'sAMAccountName']` |
| `username` | The username is used in paths for the user's own projects (like `gitlab.example.com/username/project`) and when mentioning them in issues, merge request and comments (like `@username`). If the attribute specified for `username` contains an email address, the GitLab username is part of the email address before the `@`. | no | `['uid', 'userid', 'sAMAccountName']` |
| `email` | LDAP attribute for user email. | no | `['mail', 'email', 'userPrincipalName']` |
| `name` | LDAP attribute for user display name. If no full name could be found at the attribute specified for `name`, the full name is determined using the attributes specified for `first_name` and `last_name`. | no | `'cn'` or `'displayName'` |
| `first_name` | LDAP attribute for user first name. | no | `'givenName'` |
......@@ -335,7 +335,7 @@ an alternative such as SAML is preferred. This allows LDAP to be used for group
sync, while also allowing your SAML identity provider to handle additional
checks like custom 2FA.
When LDAP web sign in is disabled, users will not see a **LDAP** tab on the sign in page.
When LDAP web sign in is disabled, users don't see an **LDAP** tab on the sign in page.
This does not disable [using LDAP credentials for Git access](#git-password-authentication).
**Omnibus configuration**
......@@ -383,7 +383,7 @@ be mandatory and clients cannot be authenticated with the TLS protocol.
## Multiple LDAP servers **(STARTER ONLY)**
With GitLab Enterprise Edition Starter, you can configure multiple LDAP servers
that your GitLab instance will connect to.
that your GitLab instance connects to.
To add another LDAP server:
......@@ -391,7 +391,7 @@ To add another LDAP server:
1. Edit them to match the additional LDAP server.
Be sure to choose a different provider ID made of letters a-z and numbers 0-9.
This ID will be stored in the database so that GitLab can remember which LDAP
This ID is stored in the database so that GitLab can remember which LDAP
server a user belongs to.
![Multiple LDAP Servers Sign in](img/multi_login.gif)
......@@ -437,7 +437,7 @@ The process executes the following access checks:
- Ensure the user is still present in LDAP.
- If the LDAP server is Active Directory, ensure the user is active (not
blocked/disabled state). This will only be checked if
blocked/disabled state). This is checked only if
`active_directory: true` is set in the LDAP configuration.
In Active Directory, a user is marked as disabled/blocked if the user
......@@ -446,7 +446,7 @@ has bit 2 set.
For more information, see <https://ctovswild.com/2009/09/03/bitmask-searches-in-ldap/>
The user is set to an `ldap_blocked` state in GitLab if the previous conditions
fail. This means the user won't be able to sign in or push/pull code.
fail. This means the user is not able to sign in or push/pull code.
The process also updates the following user information:
......@@ -495,18 +495,18 @@ sync to run once every 12 hours at the top of the hour.
## Group Sync **(STARTER ONLY)**
If your LDAP supports the `memberof` property, when the user signs in for the
first time GitLab will trigger a sync for groups the user should be a member of.
first time GitLab triggers a sync for groups the user should be a member of.
That way they don't need to wait for the hourly sync to be granted
access to their groups and projects.
A group sync process will run every hour on the hour, and `group_base` must be set
A group sync process runs every hour on the hour, and `group_base` must be set
in LDAP configuration for LDAP synchronizations based on group CN to work. This allows
GitLab group membership to be automatically updated based on LDAP group members.
The `group_base` configuration should be a base LDAP 'container', such as an
'organization' or 'organizational unit', that contains LDAP groups that should
be available to GitLab. For example, `group_base` could be
`ou=groups,dc=example,dc=com`. In the configuration file it will look like the
`ou=groups,dc=example,dc=com`. In the configuration file it looks like the
following.
**Omnibus configuration**
......@@ -539,7 +539,7 @@ following.
1. [Restart GitLab](../../restart_gitlab.md#installations-from-source) for the changes to take effect.
To take advantage of group sync, group owners or maintainers will need to [create one
To take advantage of group sync, group owners or maintainers need to [create one
or more LDAP group links](#adding-group-links).
### Adding group links **(STARTER ONLY)**
......@@ -550,11 +550,11 @@ For information on adding group links via CNs and filters, refer to [the GitLab
As an extension of group sync, you can automatically manage your global GitLab
administrators. Specify a group CN for `admin_group` and all members of the
LDAP group will be given administrator privileges. The configuration will look
LDAP group will be given administrator privileges. The configuration looks
like the following.
NOTE: **Note:**
Administrators will not be synced unless `group_base` is also
Administrators are not synced unless `group_base` is also
specified alongside `admin_group`. Also, only specify the CN of the admin
group, as opposed to the full DN.
......@@ -691,10 +691,10 @@ There is a lot going on with group sync 'under the hood'. This section
outlines what LDAP queries are executed and what behavior you can expect
from group sync.
Group member access will be downgraded from a higher level if their LDAP group
Group member access are downgraded from a higher level if their LDAP group
membership changes. For example, if a user has 'Owner' rights in a group and the
next group sync reveals they should only have 'Developer' privileges, their
access will be adjusted accordingly. The only exception is if the user is the
access is adjusted accordingly. The only exception is if the user is the
*last* owner in a group. Groups need at least one owner to fulfill
administrative duties.
......@@ -716,13 +716,13 @@ are defined as one of the mentioned attributes. This also means GitLab supports
Microsoft Active Directory, Apple Open Directory, Open LDAP, and 389 Server.
Other LDAP servers should work, too.
Active Directory also supports nested groups. Group sync will recursively
resolve membership if `active_directory: true` is set in the configuration file.
Active Directory also supports nested groups. Group sync recursively
resolves membership if `active_directory: true` is set in the configuration file.
##### Nested group memberships
Nested group memberships are resolved only if the nested group
is found within the configured `group_base`. For example, if GitLab sees a
is found in the configured `group_base`. For example, if GitLab sees a
nested group with DN `cn=nested_group,ou=special_groups,dc=example,dc=com` but
the configured `group_base` is `ou=groups,dc=example,dc=com`, `cn=nested_group`
is ignored.
......@@ -731,7 +731,7 @@ is ignored.
- Each LDAP group is queried a maximum of one time with base `group_base` and
filter `(cn=<cn_from_group_link>)`.
- If the LDAP group has the `memberuid` attribute, GitLab will execute another
- If the LDAP group has the `memberuid` attribute, GitLab executes another
LDAP query per member to obtain each user's full DN. These queries are
executed with base `base`, scope 'base object', and a filter depending on
whether `user_filter` is set. Filter may be `(uid=<uid_from_group>)` or a
......@@ -750,9 +750,9 @@ LDAP group links each:
- Subsequent syncs (checking membership, no writes) took 15 minutes
These metrics are meant to provide a baseline and performance may vary based on
any number of factors. This was a pretty extreme benchmark and most instances will
not have near this many users or groups. Disk speed, database performance,
network and LDAP server response time will affect these metrics.
any number of factors. This was an extreme benchmark and most instances don't
have near this many users or groups. Disk speed, database performance,
network and LDAP server response time affects these metrics.
## Troubleshooting
......
doc/api/license.md
View file @ b33c606a
......@@ -7,7 +7,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
# License **(CORE ONLY)**
To interact with license endpoints, you need to authenticate yourself as an
admin.
administrator.
## Retrieve information about the current license
......@@ -86,11 +86,11 @@ GET /licenses
]
```
Overage is the difference between the number of active users and the licensed number of users.
Overage is the difference between the number of billable users and the licensed number of users.
This is calculated differently depending on whether the license has expired or not.
- If the license has expired, it uses the historical maximum active user count (`historical_max`).
- If the license has not expired, it uses the current active users count.
- If the license has expired, it uses the historical maximum billable user count (`historical_max`).
- If the license has not expired, it uses the current billable users count.
Returns:
......
doc/api/users.md
View file @ b33c606a
......@@ -54,7 +54,7 @@ GET /users?username=jack_smith
```
In addition, you can filter users based on the states `blocked` and `active`.
It does not support `active=false` or `blocked=false`. The list of active users
It does not support `active=false` or `blocked=false`. The list of billable users
is the total number of users minus the blocked users.
```plaintext
......
doc/install/requirements.md
View file @ b33c606a
......@@ -221,7 +221,7 @@ Redis stores all user sessions and the background task queue.
The storage requirements for Redis are minimal, about 25kB per user.
Sidekiq processes the background jobs with a multithreaded process.
This process starts with the entire Rails stack (200MB+) but it can grow over time due to memory leaks.
On a very active server (10,000 active users) the Sidekiq process can use 1GB+ of memory.
On a very active server (10,000 billable users) the Sidekiq process can use 1GB+ of memory.
## Prometheus and its exporters
......
doc/raketasks/user_management.md
View file @ b33c606a
......@@ -58,9 +58,9 @@ sudo gitlab-rake gitlab:import:all_users_to_all_groups
bundle exec rake gitlab:import:all_users_to_all_groups RAILS_ENV=production
```
Admin users are added as owners so they can add additional users to the group.
Administrators are added as owners so they can add additional users to the group.
## Control the number of active users
## Control the number of billable users
Enable this setting to keep new users blocked until they have been cleared by the administrator.
Defaults to `false`:
......
doc/subscriptions/self_managed/index.md
View file @ b33c606a
......@@ -161,7 +161,7 @@ We recommend following these steps during renewal:
TIP: **Tip:**
If you need to change your [GitLab tier](https://about.gitlab.com/pricing/), contact our sales team via `renewals@gitlab.com` for assistance as this can't be done in the Customers Portal.
1. In the first box, enter the total number of user licenses you’ll need for the upcoming year. Be sure this number is at least **equal to, or greater than** the number of active users in the system at the time of performing the renewal.
1. In the first box, enter the total number of user licenses you’ll need for the upcoming year. Be sure this number is at least **equal to, or greater than** the number of billable users in the system at the time of performing the renewal.
1. Enter the number of [users over license](#users-over-license) in the second box for the user overage incurred in your previous subscription term.
TIP: **Tip:**
......@@ -172,8 +172,8 @@ We recommend following these steps during renewal:
| Field | Description |
|:------|:------------|
| Users in License | The number of users you've paid for in the current license loaded on the system. This does not include the amount you've paid for `Users over license` during renewal. |
| Active users | The daily count of active users on your system. |
| Maximum users | The highest number of active users on your system during the term of the loaded license. If this number exceeds your users in license count at any point, you incur users over license. |
| Billable users | The daily count of billable users on your system. |
| Maximum users | The highest number of billable users on your system during the term of the loaded license. If this number exceeds your users in license count at any point, you incur users over license. |
| Users over license | The number of users that exceed the `Users in License` for the current license term. Charges for this number of users are incurred at the next renewal. |
1. Review your renewal details and complete the payment process.
......@@ -195,7 +195,7 @@ Seat Link provides **only** the following information to GitLab:
- Date
- License key
- Historical maximum user count
- Active users count
- Billable users count
For offline or closed network customers, the existing [true-up model](#users-over-license) is used. Prorated charges are not possible without user count data.
......
doc/user/admin_area/analytics/dev_ops_report.md
View file @ b33c606a
......@@ -21,7 +21,7 @@ To see DevOps Report, go to **Admin Area > Analytics > DevOps Report**.
## DevOps Score
DevOps Score displays the usage of GitLab's major features on your instance over
the last 30 days, averaged over the number of active users in that time period. It also
the last 30 days, averaged over the number of billable users in that time period. It also
provides a Lead score per feature, which is calculated based on GitLab's analysis
of top-performing instances based on [usage ping data](../settings/usage_statistics.md#usage-ping) that GitLab has
collected. Your score is compared to the lead score of each feature and then expressed as a percentage at the bottom of said feature.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7