Merge branch 'hvlad/gitlab-ce-feature/move_oauth_modules_to_auth_dir_structure-ee' into 'master'

[EE] Moved o_auth/saml/ldap modules under gitlab/auth

See merge request gitlab-org/gitlab-ee!4759

.rubocop_todo.yml

@@ -124,8 +124,8 @@ Lint/DuplicateMethods:
     - 'lib/gitlab/git/repository.rb'
     - 'lib/gitlab/git/tree.rb'
     - 'lib/gitlab/git/wiki_page.rb'
-    - 'lib/gitlab/ldap/person.rb'
-    - 'lib/gitlab/o_auth/user.rb'
+    - 'lib/gitlab/auth/ldap/person.rb'
+    - 'lib/gitlab/auth/o_auth/user.rb'
 
 # Offense count: 4
 Lint/InterpolationCheck:
@@ -812,7 +812,7 @@ Style/TrivialAccessors:
   Exclude:
     - 'app/models/external_issue.rb'
     - 'app/serializers/base_serializer.rb'
-    - 'lib/gitlab/ldap/person.rb'
+    - 'lib/gitlab/auth/ldap/person.rb'
     - 'lib/system_check/base_check.rb'
 
 # Offense count: 4

CHANGELOG-EE.md

@@ -1064,7 +1064,7 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Adds abitlity to render deploy boards in the frontend side. !1233
 - Add filtered search to MR page. !1243
 - Update project list API returns with approvals_before_merge attribute. !1245 (Geoff Webster)
-- Catch Net::LDAP::DN exceptions in EE::Gitlab::LDAP::Group. !1260
+- Catch Net::LDAP::DN exceptions in EE::Gitlab::Auth::LDAP::Group. !1260
 - API: Use `post ":id/#{type}/:subscribable_id/subscribe"` to subscribe and `post ":id/#{type}/:subscribable_id/unsubscribe"` to unsubscribe from a resource. !1274 (Robert Schilling)
 - API: Remove deprecated fields Notes#upvotes and Notes#downvotes. !1275 (Robert Schilling)
 - Deploy board backend. !1278

app/controllers/application_controller.rb

@@ -199,7 +199,7 @@ class ApplicationController < ActionController::Base
     return unless signed_in? && session[:service_tickets]
 
     valid = session[:service_tickets].all? do |provider, ticket|
-      Gitlab::OAuth::Session.valid?(provider, ticket)
+      Gitlab::Auth::OAuth::Session.valid?(provider, ticket)
     end
 
     unless valid
@@ -223,7 +223,7 @@ class ApplicationController < ActionController::Base
     if current_user && current_user.requires_ldap_check?
       return unless current_user.try_obtain_ldap_lease
 
-      unless Gitlab::LDAP::Access.allowed?(current_user)
+      unless Gitlab::Auth::LDAP::Access.allowed?(current_user)
         sign_out current_user
         flash[:alert] = "Access denied for your LDAP account."
         redirect_to new_user_session_path
@@ -238,7 +238,7 @@ class ApplicationController < ActionController::Base
   end
 
   def gitlab_ldap_access(&block)
-    Gitlab::LDAP::Access.open { |access| yield(access) }
+    Gitlab::Auth::LDAP::Access.open { |access| yield(access) }
   end
 
   # JSON for infinite scroll via Pager object
@@ -292,7 +292,7 @@ class ApplicationController < ActionController::Base
   end
 
   def github_import_configured?
-    Gitlab::OAuth::Provider.enabled?(:github)
+    Gitlab::Auth::OAuth::Provider.enabled?(:github)
   end
 
   def gitlab_import_enabled?
@@ -300,7 +300,7 @@ class ApplicationController < ActionController::Base
   end
 
   def gitlab_import_configured?
-    Gitlab::OAuth::Provider.enabled?(:gitlab)
+    Gitlab::Auth::OAuth::Provider.enabled?(:gitlab)
   end
 
   def bitbucket_import_enabled?
@@ -308,7 +308,7 @@ class ApplicationController < ActionController::Base
   end
 
   def bitbucket_import_configured?
-    Gitlab::OAuth::Provider.enabled?(:bitbucket)
+    Gitlab::Auth::OAuth::Provider.enabled?(:bitbucket)
   end
 
   def google_code_import_enabled?

app/controllers/import/bitbucket_controller.rb

@@ -71,7 +71,7 @@ class Import::BitbucketController < Import::BaseController
   end
 
   def provider
-    Gitlab::OAuth::Provider.config_for('bitbucket')
+    Gitlab::Auth::OAuth::Provider.config_for('bitbucket')
   end
 
   def options

app/controllers/omniauth_callbacks_controller.rb

@@ -11,8 +11,8 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
     end
   end
 
-  if Gitlab::LDAP::Config.enabled?
-    Gitlab::LDAP::Config.available_servers.each do |server|
+  if Gitlab::Auth::LDAP::Config.enabled?
+    Gitlab::Auth::LDAP::Config.available_servers.each do |server|
       define_method server['provider_name'] do
         ldap
       end
@@ -32,7 +32,7 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
   # We only find ourselves here
   # if the authentication to LDAP was successful.
   def ldap
-    ldap_user = Gitlab::LDAP::User.new(oauth)
+    ldap_user = Gitlab::Auth::LDAP::User.new(oauth)
     ldap_user.save if ldap_user.changed? # will also save new users
 
     @user = ldap_user.gl_user
@@ -65,13 +65,13 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
         redirect_to after_sign_in_path_for(current_user)
       end
     else
-      saml_user = Gitlab::Saml::User.new(oauth)
+      saml_user = Gitlab::Auth::Saml::User.new(oauth)
       saml_user.save if saml_user.changed?
       @user = saml_user.gl_user
 
       continue_login_process
     end
-  rescue Gitlab::OAuth::SignupDisabledError
+  rescue Gitlab::Auth::OAuth::User::SignupDisabledError
     handle_signup_error
   end
 
@@ -119,20 +119,20 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
       log_audit_event(current_user, with: oauth['provider'])
       redirect_to profile_account_path, notice: 'Authentication method updated'
     else
-      oauth_user = Gitlab::OAuth::User.new(oauth)
+      oauth_user = Gitlab::Auth::OAuth::User.new(oauth)
       oauth_user.save
       @user = oauth_user.gl_user
 
       continue_login_process
     end
-  rescue Gitlab::OAuth::SigninDisabledForProviderError
+  rescue Gitlab::Auth::OAuth::User::SigninDisabledForProviderError
     handle_disabled_provider
-  rescue Gitlab::OAuth::SignupDisabledError
+  rescue Gitlab::Auth::OAuth::User::SignupDisabledError
     handle_signup_error
   end
 
   def handle_service_ticket(provider, ticket)
-    Gitlab::OAuth::Session.create provider, ticket
+    Gitlab::Auth::OAuth::Session.create provider, ticket
     session[:service_tickets] ||= {}
     session[:service_tickets][provider] = ticket
   end
@@ -155,7 +155,7 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
   end
 
   def handle_signup_error
-    label = Gitlab::OAuth::Provider.label_for(oauth['provider'])
+    label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider'])
     message = "Signing in using your #{label} account without a pre-existing GitLab account is not allowed."
 
     if Gitlab::CurrentSettings.allow_signup?
@@ -184,7 +184,7 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
   end
 
   def handle_disabled_provider
-    label = Gitlab::OAuth::Provider.label_for(oauth['provider'])
+    label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider'])
     flash[:alert] = "Signing in using #{label} has been disabled"
 
     redirect_to new_user_session_path

app/controllers/sessions_controller.rb

@@ -17,7 +17,7 @@ class SessionsController < Devise::SessionsController
 
   def new
     set_minimum_password_length
-    @ldap_servers = Gitlab::LDAP::Config.available_servers
+    @ldap_servers = Gitlab::Auth::LDAP::Config.available_servers
 
     super
   end

app/helpers/application_settings_helper.rb

@@ -78,7 +78,7 @@ module ApplicationSettingsHelper
 
       label_tag(checkbox_name, class: css_class) do
         check_box_tag(checkbox_name, source, !disabled,
-                      autocomplete: 'off') + Gitlab::OAuth::Provider.label_for(source)
+                      autocomplete: 'off') + Gitlab::Auth::OAuth::Provider.label_for(source)
       end
     end
   end

app/helpers/auth_helper.rb

@@ -5,7 +5,7 @@ module AuthHelper
   delegate :slack_app_id, to: :'Gitlab::CurrentSettings.current_application_settings'
 
   def ldap_enabled?
-    Gitlab::LDAP::Config.enabled?
+    Gitlab::Auth::LDAP::Config.enabled?
   end
 
   def kerberos_enabled?
@@ -21,11 +21,11 @@ module AuthHelper
   end
 
   def auth_providers
-    Gitlab::OAuth::Provider.providers
+    Gitlab::Auth::OAuth::Provider.providers
   end
 
   def label_for_provider(name)
-    Gitlab::OAuth::Provider.label_for(name)
+    Gitlab::Auth::OAuth::Provider.label_for(name)
   end
 
   def form_based_provider?(name)

app/helpers/profiles_helper.rb

@@ -3,7 +3,7 @@ module ProfilesHelper
     user_synced_attributes_metadata = current_user.user_synced_attributes_metadata
     if user_synced_attributes_metadata&.synced?(attribute)
       if user_synced_attributes_metadata.provider
-        Gitlab::OAuth::Provider.label_for(user_synced_attributes_metadata.provider)
+        Gitlab::Auth::OAuth::Provider.label_for(user_synced_attributes_metadata.provider)
       else
         'LDAP'
       end

app/helpers/selects_helper.rb

@@ -25,7 +25,7 @@ module SelectsHelper
 
   def ldap_server_select_options
     options_from_collection_for_select(
-      Gitlab::LDAP::Config.available_servers,
+      Gitlab::Auth::LDAP::Config.available_servers,
       'provider_name',
       'label'
     )

app/models/identity.rb

@@ -19,12 +19,12 @@ class Identity < ActiveRecord::Base
   end
 
   def ldap?
-    Gitlab::OAuth::Provider.ldap_provider?(provider)
+    Gitlab::Auth::OAuth::Provider.ldap_provider?(provider)
   end
 
   def self.normalize_uid(provider, uid)
-    if Gitlab::OAuth::Provider.ldap_provider?(provider)
-      Gitlab::LDAP::Person.normalize_dn(uid)
+    if Gitlab::Auth::OAuth::Provider.ldap_provider?(provider)
+      Gitlab::Auth::LDAP::Person.normalize_dn(uid)
     else
       uid.to_s
     end

app/models/user.rb

@@ -746,7 +746,7 @@ class User < ActiveRecord::Base
 
   def ldap_user?
     if identities.loaded?
-      identities.find { |identity| Gitlab::OAuth::Provider.ldap_provider?(identity.provider) && !identity.extern_uid.nil? }
+      identities.find { |identity| Gitlab::Auth::OAuth::Provider.ldap_provider?(identity.provider) && !identity.extern_uid.nil? }
     else
       identities.exists?(["provider LIKE ? AND extern_uid IS NOT NULL", "ldap%"])
     end

app/models/user_synced_attributes_metadata.rb

@@ -26,6 +26,6 @@ class UserSyncedAttributesMetadata < ActiveRecord::Base
   private
 
   def sync_profile_from_provider?
-    Gitlab::OAuth::Provider.sync_profile_from_provider?(provider)
+    Gitlab::Auth::OAuth::Provider.sync_profile_from_provider?(provider)
   end
 end

app/views/admin/application_settings/_form.html.haml

@@ -203,7 +203,7 @@
             Password authentication enabled for Git over HTTP(S)
             .help-block
               When disabled, a Personal Access Token
-              - if Gitlab::LDAP::Config.enabled?
+              - if Gitlab::Auth::LDAP::Config.enabled?
                 or LDAP password
               must be used to authenticate.
     - if omniauth_enabled? && button_based_providers.any?

app/views/admin/groups/_form.html.haml

@@ -41,7 +41,7 @@
       = f.submit 'Save changes', class: "btn btn-save"
       = link_to  'Cancel', admin_group_path(@group), class: "btn btn-cancel"
 
-- if @group.persisted? && Gitlab::LDAP::Config.group_sync_enabled?
+- if @group.persisted? && Gitlab::Auth::LDAP::Config.group_sync_enabled?
   %h3.page-title LDAP synchronizations
   = render 'ldap_group_links/form', group: @group
   = render 'ldap_group_links/ldap_group_links', group: @group

app/views/admin/groups/show.html.haml

@@ -62,7 +62,7 @@
 
         = render partial: "namespaces/shared_runner_status", locals: { namespace: @group }
 
-    - if Gitlab::LDAP::Config.group_sync_enabled? && @group.ldap_synced?
+    - if Gitlab::Auth::LDAP::Config.group_sync_enabled? && @group.ldap_synced?
       .panel.panel-default
         .panel-heading Active synchronizations
         %ul.well-list

app/views/admin/identities/_form.html.haml

@@ -4,7 +4,7 @@
   .form-group
     = f.label :provider, class: 'control-label'
     .col-sm-10
-      - values = Gitlab::OAuth::Provider.providers.map { |name| ["#{Gitlab::OAuth::Provider.label_for(name)} (#{name})", name] }
+      - values = Gitlab::Auth::OAuth::Provider.providers.map { |name| ["#{Gitlab::Auth::OAuth::Provider.label_for(name)} (#{name})", name] }
       = f.select :provider, values, { allow_blank: false }, class: 'form-control'
   .form-group
     = f.label :extern_uid, "Identifier", class: 'control-label'

app/views/admin/identities/_identity.html.haml

 %tr
   %td
-    #{Gitlab::OAuth::Provider.label_for(identity.provider)} (#{identity.provider})
+    #{Gitlab::Auth::OAuth::Provider.label_for(identity.provider)} (#{identity.provider})
   %td
     = identity.extern_uid
   %td

changelogs/unreleased/17359-move-oauth-modules-to-auth-dir-structure.yml

+---
+title: Moved o_auth/saml/ldap modules under gitlab/auth
+merge_request: 17359
+author: Horatiu Eugen Vlad

config/initializers/devise.rb

@@ -212,9 +212,9 @@ Devise.setup do |config|
   #   manager.default_strategies(scope: :user).unshift :some_external_strategy
   # end
 
-  if Gitlab::LDAP::Config.enabled?
-    Gitlab::LDAP::Config.providers.each do |provider|
-      ldap_config = Gitlab::LDAP::Config.new(provider)
+  if Gitlab::Auth::LDAP::Config.enabled?
+    Gitlab::Auth::LDAP::Config.providers.each do |provider|
+      ldap_config = Gitlab::Auth::LDAP::Config.new(provider)
       config.omniauth(provider, ldap_config.omniauth_options)
     end
   end
@@ -235,9 +235,9 @@ Devise.setup do |config|
       if provider['name'] == 'cas3'
         provider['args'][:on_single_sign_out] = lambda do |request|
           ticket = request.params[:session_index]
-          raise "Service Ticket not found." unless Gitlab::OAuth::Session.valid?(:cas3, ticket)
+          raise "Service Ticket not found." unless Gitlab::Auth::OAuth::Session.valid?(:cas3, ticket)
 
-          Gitlab::OAuth::Session.destroy(:cas3, ticket)
+          Gitlab::Auth::OAuth::Session.destroy(:cas3, ticket)
           true
         end
       end
@@ -245,8 +245,8 @@ Devise.setup do |config|
       if provider['name'] == 'authentiq'
         provider['args'][:remote_sign_out_handler] = lambda do |request|
           authentiq_session = request.params['sid']
-          if Gitlab::OAuth::Session.valid?(:authentiq, authentiq_session)
-            Gitlab::OAuth::Session.destroy(:authentiq, authentiq_session)
+          if Gitlab::Auth::OAuth::Session.valid?(:authentiq, authentiq_session)
+            Gitlab::Auth::OAuth::Session.destroy(:authentiq, authentiq_session)
             true
           else
             false

config/initializers/omniauth.rb

-if Gitlab::LDAP::Config.enabled?
+if Gitlab::Auth::LDAP::Config.enabled?
   module OmniAuth::Strategies
-    Gitlab::LDAP::Config.available_servers.each do |server|
+    Gitlab::Auth::LDAP::Config.available_servers.each do |server|
       # do not redeclare LDAP
       next if server['provider_name'] == 'ldap'
 

doc/administration/auth/ldap-ee.md

@@ -327,7 +327,7 @@ step of the sync.
 1. Run a group sync for this particular group.
 
     ```ruby
-    EE::Gitlab::LDAP::Sync::Group.execute_all_providers(group)
+    EE::Gitlab::Auth::LDAP::Sync::Group.execute_all_providers(group)
     ```
 1. Look through the output of the sync. See [example log output](#example-log-output)
    below for more information about the output.
@@ -336,11 +336,11 @@ step of the sync.
    run the following query:
 
     ```ruby
-    adapter = Gitlab::LDAP::Adapter.new('ldapmain') # If `main` is the LDAP provider
-    ldap_group = EE::Gitlab::LDAP::Group.find_by_cn('group_cn_here', adapter)
+    adapter = Gitlab::Auth::LDAP::Adapter.new('ldapmain') # If `main` is the LDAP provider
+    ldap_group = EE::Gitlab::Auth::LDAP::Group.find_by_cn('group_cn_here', adapter)
 
     # Output
-    => #<EE::Gitlab::LDAP::Group:0x007fcbdd0bb6d8
+    => #<EE::Gitlab::Auth::LDAP::Group:0x007fcbdd0bb6d8
     ```
 1. Query the LDAP group's member DNs and see if the user's DN is in the list.
    One of the DNs here should match the 'Identifier' from the LDAP identity

ee/app/controllers/groups/ldaps_controller.rb

@@ -17,6 +17,6 @@ class Groups::LdapsController < Groups::ApplicationController
   private
 
   def check_enabled_extras!
-    render_404 unless Gitlab::LDAP::Config.group_sync_enabled?
+    render_404 unless Gitlab::Auth::LDAP::Config.group_sync_enabled?
   end
 end

ee/app/models/ldap_group_link.rb

@@ -29,14 +29,14 @@ class LdapGroupLink < ActiveRecord::Base
   end
 
   def config
-    Gitlab::LDAP::Config.new(provider)
-  rescue Gitlab::LDAP::Config::InvalidProvider
+    Gitlab::Auth::LDAP::Config.new(provider)
+  rescue Gitlab::Auth::LDAP::Config::InvalidProvider
     nil
   end
 
   # default to the first LDAP server
   def provider
-    read_attribute(:provider) || Gitlab::LDAP::Config.providers.first
+    read_attribute(:provider) || Gitlab::Auth::LDAP::Config.providers.first
   end
 
   def provider_label

ee/app/views/groups/ee/_settings_nav.html.haml

-- if Gitlab::LDAP::Config.group_sync_enabled? && can?(current_user, :admin_ldap_group_links, @group)
+- if Gitlab::Auth::LDAP::Config.group_sync_enabled? && can?(current_user, :admin_ldap_group_links, @group)
   = nav_link(path: 'ldap_group_links#index') do
     = link_to group_ldap_group_links_path(@group), title: 'LDAP Group' do
       %span

ee/app/workers/ldap_all_groups_sync_worker.rb

@@ -3,10 +3,10 @@ class LdapAllGroupsSyncWorker
   include CronjobQueue
 
   def perform
-    return unless Gitlab::LDAP::Config.group_sync_enabled?
+    return unless Gitlab::Auth::LDAP::Config.group_sync_enabled?
 
     logger.info 'Started LDAP group sync'
-    EE::Gitlab::LDAP::Sync::Groups.execute
+    EE::Gitlab::Auth::LDAP::Sync::Groups.execute
     logger.info 'Finished LDAP group sync'
   end
 end

ee/app/workers/ldap_group_sync_worker.rb

@@ -2,12 +2,12 @@ class LdapGroupSyncWorker
   include ApplicationWorker
 
   def perform(group_ids, provider = nil)
-    return unless Gitlab::LDAP::Config.group_sync_enabled?
+    return unless Gitlab::Auth::LDAP::Config.group_sync_enabled?
 
     groups = Group.where(id: Array(group_ids))
 
     if provider
-      EE::Gitlab::LDAP::Sync::Proxy.open(provider) do |proxy|
+      EE::Gitlab::Auth::LDAP::Sync::Proxy.open(provider) do |proxy|
         sync_groups(groups, proxy: proxy)
       end
     else
@@ -23,9 +23,9 @@ class LdapGroupSyncWorker
     logger.info "Started LDAP group sync for group #{group.name} (#{group.id})"
 
     if proxy
-      EE::Gitlab::LDAP::Sync::Group.execute(group, proxy)
+      EE::Gitlab::Auth::LDAP::Sync::Group.execute(group, proxy)
     else
-      EE::Gitlab::LDAP::Sync::Group.execute_all_providers(group)
+      EE::Gitlab::Auth::LDAP::Sync::Group.execute_all_providers(group)
     end
 
     logger.info "Finished LDAP group sync for group #{group.name} (#{group.id})"

ee/app/workers/ldap_sync_worker.rb

@@ -3,14 +3,14 @@ class LdapSyncWorker
   include CronjobQueue
 
   def perform
-    return unless Gitlab::LDAP::Config.group_sync_enabled?
+    return unless Gitlab::Auth::LDAP::Config.group_sync_enabled?
 
     Rails.logger.info "Performing daily LDAP sync task."
     User.ldap.find_each(batch_size: 100).each do |ldap_user|
       Rails.logger.debug "Syncing user #{ldap_user.username}, #{ldap_user.email}"
       # Use the 'update_ldap_group_links_synchronously' option to avoid creating a ton
       # of new Sidekiq jobs all at once.
-      Gitlab::LDAP::Access.allowed?(ldap_user, update_ldap_group_links_synchronously: true)
+      Gitlab::Auth::LDAP::Access.allowed?(ldap_user, update_ldap_group_links_synchronously: true)
     end
   end
 end

ee/db/migrate/20151007110107_update_group_links.rb

 # rubocop:disable Rails/ReversibleMigration
 class UpdateGroupLinks < ActiveRecord::Migration
   def change
-    provider = quote_string(Gitlab::LDAP::Config.providers.first)
+    provider = quote_string(Gitlab::Auth::LDAP::Config.providers.first)
     execute("UPDATE ldap_group_links SET provider = '#{provider}' WHERE provider IS NULL")
   end
 end

ee/lib/api/ldap.rb

@@ -6,7 +6,7 @@ module API
       helpers do
         def get_group_list(provider, search)
           search = Net::LDAP::Filter.escape(search)
-          Gitlab::LDAP::Adapter.new(provider).groups("#{search}*", 20)
+          Gitlab::Auth::LDAP::Adapter.new(provider).groups("#{search}*", 20)
         end
 
         params :search_params do
@@ -21,7 +21,7 @@ module API
         use :search_params
       end
       get 'groups' do
-        provider = Gitlab::LDAP::Config.available_servers.first['provider_name']
+        provider = Gitlab::Auth::LDAP::Config.available_servers.first['provider_name']
         groups = get_group_list(provider, params[:search])
         present groups, with: Entities::LdapGroup
       end

ee/lib/audit/details.rb

@@ -30,7 +30,7 @@ module Audit
       when :remove
         "Removed #{value}"
       when :failed_login
-        "Failed to login with #{Gitlab::OAuth::Provider.label_for(value).upcase} authentication"
+        "Failed to login with #{Gitlab::Auth::OAuth::Provider.label_for(value).upcase} authentication"
       when :custom_message
         value
       else

ee/lib/ee/gitlab/auth/ldap/access_levels.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        # Create a hash map of member DNs to access levels. The highest
+        # access level is retained in cases where `set` is called multiple times
+        # for the same DN.
+        class AccessLevels < Hash
+          def set(dns, to:)
+            dns.each do |dn|
+              current = self[dn]
+
+              # Keep the higher of the access values.
+              self[dn] = to if current.nil? || to > current
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/adapter.rb

+# LDAP connection adapter EE mixin
+#
+# This module is intended to encapsulate EE-specific adapter methods
+# and be **prepended** in the `Gitlab::Auth::LDAP::Adapter` class.
+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Adapter
+          # Get LDAP groups from ou=Groups
+          #
+          # cn - filter groups by name
+          #
+          # Ex.
+          #   groups("dev*") # return all groups start with 'dev'
+          #
+          def groups(cn = "*", size = nil)
+            options = {
+              base: config.group_base,
+              filter: Net::LDAP::Filter.eq("cn", cn),
+              attributes: %w(dn cn memberuid member submember uniquemember memberof)
+            }
+
+            options[:size] = size if size
+
+            ldap_search(options).map do |entry|
+              LDAP::Group.new(entry, self)
+            end
+          end
+
+          def group(*args)
+            groups(*args).first
+          end
+
+          def group_members_in_range(dn, range_start)
+            ldap_search(
+              base: dn,
+              scope: Net::LDAP::SearchScope_BaseObject,
+              attributes: ["member;range=#{range_start}-*"]
+            ).first
+          end
+
+          def nested_groups(parent_dn)
+            options = {
+              base: config.group_base,
+              filter: Net::LDAP::Filter.join(
+                Net::LDAP::Filter.eq('objectClass', 'group'),
+                Net::LDAP::Filter.eq('memberOf', parent_dn)
+              )
+            }
+
+            ldap_search(options).map do |entry|
+              LDAP::Group.new(entry, self)
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/config.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Config
+          extend ActiveSupport::Concern
+
+          class_methods do
+            def group_sync_enabled?
+              enabled? && ::License.feature_available?(:ldap_group_sync)
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/group.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        class Group
+          attr_accessor :adapter
+          attr_reader :entry
+
+          def self.find_by_cn(cn, adapter)
+            cn = Net::LDAP::Filter.escape(cn)
+            adapter.group(cn)
+          end
+
+          def initialize(entry, adapter = nil)
+            Rails.logger.debug { "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}" }
+            @entry = entry
+            @adapter = adapter
+          end
+
+          def active_directory?
+            adapter.config.active_directory
+          end
+
+          def cn
+            entry.cn.first
+          end
+
+          def name
+            cn
+          end
+
+          def path
+            name.parameterize
+          end
+
+          def memberuid?
+            entry.respond_to? :memberuid
+          end
+
+          def member_uids
+            @member_uids ||= entry.memberuid.map do |uid|
+              ::Gitlab::Auth::LDAP::Person.normalize_uid(uid)
+            end
+          end
+
+          delegate :dn, to: :entry
+
+          def member_dns(nested_groups_to_skip = [])
+            dns = []
+
+            if active_directory? && adapter
+              dns.concat(active_directory_members(entry, nested_groups_to_skip))
+            end
+
+            dns.concat(entry_member_dns(entry))
+
+            dns.uniq
+          end
+
+          private
+
+          # Active Directory range member methods
+
+          def has_member_range?(entry)
+            member_range_attribute(entry).present?
+          end
+
+          def member_range_attribute(entry)
+            entry.attribute_names.find { |a| a.to_s.start_with?("member;range=")}.to_s
+          end
+
+          def active_directory_members(entry, nested_groups_to_skip)
+            require 'net/ldap/dn'
+
+            members = []
+
+            # Retrieve all member pages/ranges
+            members.concat(ranged_members(entry)) if has_member_range?(entry)
+            # Process nested group members
+            members.concat(nested_members(nested_groups_to_skip))
+            # Clean dns of groups and users outside the base
+            members.reject! { |dn| nested_groups_to_skip.include?(dn) }
+
+            return [] if members.empty?
+
+            # Only return members within our given base
+            members_within_base(members)
+          end
+
+          # AD requires use of range retrieval for groups with more than 1500 members
+          # cf. https://msdn.microsoft.com/en-us/library/aa367017(v=vs.85).aspx
+          def ranged_members(entry)
+            members = []
+
+            # Concatenate the members in the current range
+            dns = entry[member_range_attribute(entry)]
+            dns = normalize_dns(dns)
+            members.concat(dns)
+
+            # Recursively concatenate members until end of ranges
+            if has_more_member_ranges?(entry)
+              next_entry = adapter.group_members_in_range(dn, next_member_range_start(entry))
+
+              members.concat(ranged_members(next_entry))
+            end
+
+            members
+          end
+
+          # Process any AD nested groups. Use a manual process because
+          # the AD recursive member of filter is too slow and uses too
+          # much CPU on the AD server.
+          def nested_members(nested_groups_to_skip)
+            # Ignore this group if we see it again in a nested group.
+            # Prevents infinite loops.
+            nested_groups_to_skip << dn
+
+            members = []
+            nested_groups = adapter.nested_groups(dn)
+
+            nested_groups.each do |nested_group|
+              next if nested_groups_to_skip.include?(nested_group.dn)
+
+              members.concat(nested_group.member_dns(nested_groups_to_skip))
+            end
+
+            members
+          end
+
+          def has_more_member_ranges?(entry)
+            next_member_range_start(entry).present?
+          end
+
+          def next_member_range_start(entry)
+            match = member_range_attribute(entry).match /^member;range=\d+-(\d+|\*)$/
+
+            match[1].to_i + 1 if match.present? && match[1] != '*'
+          end
+
+          # The old AD recursive member filter would exclude any members that
+          # were outside the given search base. To maintain that behavior,
+          # we need to do the same.
+          #
+          # Split the base and each member DN into pairs. Compare the last
+          # base N pairs of the member DN. If they match, the user is within
+          # the base DN.
+          #
+          # Ex.
+          # - Member DN: 'uid=user,ou=users,dc=example,dc=com'
+          # - Base DN:   'dc=example,dc=com'
+          #
+          # Base has 2 pairs ([dc,example], [dc,com]). If the last 2 pairs of
+          # the user DN match, profit!
+          def members_within_base(members)
+            begin
+              base = ::Gitlab::Auth::LDAP::DN.new(adapter.config.base).to_a
+            rescue ::Gitlab::Auth::LDAP::DN::FormatError => e
+              Rails.logger.error "Configured LDAP `base` is invalid: '#{adapter.config.base}'. Error: \"#{e.message}\""
+              return []
+            end
+
+            members.select do |dn|
+              begin
+                ::Gitlab::Auth::LDAP::DN.new(dn).to_a.last(base.length) == base
+              rescue ::Gitlab::Auth::LDAP::DN::FormatError => e
+                Rails.logger.warn "Received invalid member DN from LDAP group '#{cn}': '#{dn}'. Error: \"#{e.message}\". Skipping"
+              end
+            end
+          end
+
+          def normalize_dns(dns)
+            dns.map do |dn|
+              ::Gitlab::Auth::LDAP::Person.normalize_dn(dn)
+            end
+          end
+
+          def entry_member_dns(entry)
+            dns = entry.try(:member) || entry.try(:uniquemember) || entry.try(:memberof)
+            dns&.concat(entry.try(:submember) || [])
+
+            if dns
+              normalize_dns(dns)
+            else
+              Rails.logger.warn("Could not find member DNs for LDAP group #{entry.inspect}")
+              []
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/person.rb

+require 'net/ldap/dn'
+
+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Person
+          extend ActiveSupport::Concern
+
+          class_methods do
+            def find_by_email(email, adapter)
+              email_attributes = Array(adapter.config.attributes['email'])
+
+              email_attributes.each do |possible_attribute|
+                found_user = adapter.user(possible_attribute, email)
+                return found_user if found_user
+              end
+
+              nil
+            end
+
+            def find_by_kerberos_principal(principal, adapter)
+              uid, domain = principal.split('@', 2)
+              return nil unless uid && domain
+
+              # In multi-forest setups, there may be several users with matching
+              # uids but differing DNs, so skip adapters configured to connect to
+              # non-matching domains
+              return unless domain.casecmp(domain_from_dn(adapter.config.base)) == 0
+
+              find_by_uid(uid, adapter)
+            end
+
+            # Extracts the rightmost unbroken set of domain components from an
+            # LDAP DN and constructs a domain name from them
+            def domain_from_dn(dn)
+              dn_components = []
+              ::Gitlab::Auth::LDAP::DN.new(dn).each_pair { |name, value| dn_components << { name: name, value: value } }
+              dn_components
+                .reverse
+                .take_while { |rdn| rdn[:name].casecmp('DC').zero? } # Domain Component
+                .map { |rdn| rdn[:value] }
+                .reverse
+                .join('.')
+            end
+
+            def ldap_attributes(config)
+              attributes = super + [
+                'memberof',
+                (config.sync_ssh_keys if config.sync_ssh_keys.is_a?(String))
+              ]
+              attributes.compact.uniq
+            end
+          end
+
+          def ssh_keys
+            if config.sync_ssh_keys? && entry.respond_to?(config.sync_ssh_keys)
+              entry[config.sync_ssh_keys.to_sym]
+                .map { |key| key[/(ssh|ecdsa)-[^ ]+ [^\s]+/] }
+                .compact
+            else
+              []
+            end
+          end
+
+          # We assume that the Kerberos username matches the configured uid
+          # attribute in LDAP. For Active Directory, this is `sAMAccountName`
+          def kerberos_principal
+            return nil unless uid
+
+            uid + '@' + self.class.domain_from_dn(dn).upcase
+          end
+
+          def memberof
+            return [] unless entry.attribute_names.include?(:memberof)
+
+            entry.memberof
+          end
+
+          def group_cns
+            memberof.map { |memberof_value| cn_from_memberof(memberof_value) }
+          end
+
+          def cn_from_memberof(memberof)
+            # Only get the first CN value of the string, that's the one that contains
+            # the group name
+            memberof.match(/(?:cn=([\w\s]+))/i)&.captures&.first
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/sync/admin_users.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Sync
+          class AdminUsers < Sync::Users
+            private
+
+            def attribute
+              :admin
+            end
+
+            def member_dns
+              return [] if admin_group.empty?
+
+              proxy.dns_for_group_cn(admin_group)
+            end
+
+            def admin_group
+              proxy.adapter.config.admin_group
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/sync/external_users.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Sync
+          class ExternalUsers < Sync::Users
+            private
+
+            def attribute
+              :external
+            end
+
+            def member_dns
+              external_groups.flat_map do |group|
+                proxy.dns_for_group_cn(group)
+              end.uniq
+            end
+
+            def external_groups
+              proxy.adapter.config.external_groups
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/sync/group.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Sync
+          class Group
+            attr_reader :provider, :group, :proxy
+
+            class << self
+              # Sync members across all providers for the given group.
+              def execute_all_providers(group)
+                return unless ldap_sync_ready?(group)
+
+                group.start_ldap_sync
+                Rails.logger.debug { "Started syncing all providers for '#{group.name}' group" }
+
+                # Shuffle providers to prevent a scenario where sync fails after a time
+                # and only the first provider or two get synced. This shuffles the order
+                # so subsequent syncs should eventually get to all providers. Obviously
+                # we should avoid failure, but this is an additional safeguard.
+                ::Gitlab::Auth::LDAP::Config.providers.shuffle.each do |provider|
+                  Sync::Proxy.open(provider) do |proxy|
+                    new(group, proxy).update_permissions
+                  end
+                end
+
+                group.finish_ldap_sync
+                Rails.logger.debug { "Finished syncing all providers for '#{group.name}' group" }
+              end
+
+              # Sync members across a single provider for the given group.
+              def execute(group, proxy)
+                return unless ldap_sync_ready?(group)
+
+                group.start_ldap_sync
+                Rails.logger.debug { "Started syncing '#{proxy.provider}' provider for '#{group.name}' group" }
+
+                sync_group = new(group, proxy)
+                sync_group.update_permissions
+
+                group.finish_ldap_sync
+                Rails.logger.debug { "Finished syncing '#{proxy.provider}' provider for '#{group.name}' group" }
+              end
+
+              def ldap_sync_ready?(group)
+                fail_stuck_group(group)
+
+                return true unless group.ldap_sync_started?
+
+                Rails.logger.warn "Group '#{group.name}' is not ready for LDAP sync. Skipping"
+                false
+              end
+
+              def fail_stuck_group(group)
+                return unless group.ldap_sync_started?
+
+                if group.ldap_sync_last_sync_at < 1.hour.ago
+                  group.mark_ldap_sync_as_failed('The sync took too long to complete.')
+                end
+              end
+            end
+
+            def initialize(group, proxy)
+              @provider = proxy.provider
+              @group = group
+              @proxy = proxy
+            end
+
+            def update_permissions
+              unless group.ldap_sync_started?
+                logger.warn "Group '#{group.name}' LDAP sync status must be 'started' before updating permissions"
+                return
+              end
+
+              access_levels = AccessLevels.new
+              # Only iterate over group links for the current provider
+              group.ldap_group_links.with_provider(provider).each do |group_link|
+                next unless group_link.active?
+
+                update_access_levels(access_levels, group_link)
+              end
+
+              update_existing_group_membership(group, access_levels)
+              add_new_members(group, access_levels)
+            end
+
+            private
+
+            def update_access_levels(access_levels, group_link)
+              if member_dns = get_member_dns(group_link)
+                access_levels.set(member_dns, to: group_link.group_access)
+
+                logger.debug do
+                  "Resolved '#{group.name}' group member access: #{access_levels.to_hash}"
+                end
+              end
+            end
+
+            def get_member_dns(group_link)
+              group_link.cn ? dns_for_group_cn(group_link.cn) : UserFilter.filter(@proxy, group_link.filter)
+            end
+
+            def dns_for_group_cn(group_cn)
+              if config.group_base.blank?
+                logger.debug { "No `group_base` configured for '#{provider}' provider and group link CN #{group_cn}. Skipping" }
+
+                return nil
+              end
+
+              proxy.dns_for_group_cn(group_cn)
+            end
+
+            def dn_for_uid(uid)
+              proxy.dn_for_uid(uid)
+            end
+
+            def update_existing_group_membership(group, access_levels)
+              logger.debug { "Updating existing membership for '#{group.name}' group" }
+
+              select_and_preload_group_members(group).each do |member|
+                user = member.user
+                identity = user.identities.select(:id, :extern_uid)
+                             .with_provider(provider).first
+                member_dn = identity.extern_uid.downcase
+
+                # Skip if this is not an LDAP user with a valid `extern_uid`.
+                next unless member_dn.present?
+
+                # Prevent shifting group membership, in case where user is a member
+                # of two LDAP groups from different providers linked to the same
+                # GitLab group. This is not ideal, but preserves existing behavior.
+                if user.ldap_identity.id != identity.id
+                  access_levels.delete(member_dn)
+                  next
+                end
+
+                desired_access = access_levels[member_dn]
+
+                # Skip validations and callbacks. We have a limited set of attrs
+                # due to the `select` lookup, and we need to be efficient.
+                # Low risk, because the member should already be valid.
+                member.update_column(:ldap, true) unless member.ldap?
+
+                # Don't do anything if the user already has the desired access level
+                if member.access_level == desired_access
+                  access_levels.delete(member_dn)
+                  next
+                end
+
+                # Check and update the access level. If `desired_access` is `nil`
+                # we need to delete the user from the group.
+                if desired_access.present?
+                  # Delete this entry from the hash now that we're acting on it
+                  access_levels.delete(member_dn)
+
+                  next if member.ldap? && member.override?
+
+                  add_or_update_user_membership(
+                    user,
+                    group,
+                    desired_access
+                  )
+                elsif group.last_owner?(user)
+                  warn_cannot_remove_last_owner(user, group)
+                else
+                  group.users.destroy(user)
+                end
+              end
+            end
+
+            def add_new_members(group, access_levels)
+              logger.debug { "Adding new members to '#{group.name}' group" }
+
+              access_levels.each do |member_dn, access_level|
+                user = ::Gitlab::Auth::LDAP::User.find_by_uid_and_provider(member_dn, provider)
+
+                if user.present?
+                  add_or_update_user_membership(
+                    user,
+                    group,
+                    access_level
+                  )
+                else
+                  logger.debug do
+                    <<-MSG.strip_heredoc.tr("\n", ' ')
+                      #{self.class.name}: User with DN `#{member_dn}` should have access
+                      to '#{group.name}' group but there is no user in GitLab with that
+                      identity. Membership will be updated once the user signs in for
+                      the first time.
+                    MSG
+                  end
+                end
+              end
+            end
+
+            def add_or_update_user_membership(user, group, access, current_user: nil)
+              # Prevent the last owner of a group from being demoted
+              if access < ::Gitlab::Access::OWNER && group.last_owner?(user)
+                warn_cannot_remove_last_owner(user, group)
+              else
+                # If you pass the user object, instead of just user ID,
+                # it saves an extra user database query.
+                group.add_user(
+                  user,
+                  access,
+                  current_user: current_user,
+                  ldap: true
+                )
+              end
+            end
+
+            def warn_cannot_remove_last_owner(user, group)
+              logger.warn do
+                <<-MSG.strip_heredoc.tr("\n", ' ')
+                  #{self.class.name}: LDAP group sync cannot remove #{user.name}
+                  (#{user.id}) from group #{group.name} (#{group.id}) as this is
+                  the group's last owner
+                MSG
+              end
+            end
+
+            def select_and_preload_group_members(group)
+              group.members.select(:id, :access_level, :user_id, :ldap, :override)
+                .with_identity_provider(provider).preload(:user)
+            end
+
+            def logger
+              Rails.logger
+            end
+
+            def config
+              @proxy.adapter.config
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/sync/groups.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Sync
+          class Groups
+            attr_reader :provider, :proxy
+
+            def self.execute
+              # Shuffle providers to prevent a scenario where sync fails after a time
+              # and only the first provider or two get synced. This shuffles the order
+              # so subsequent syncs should eventually get to all providers. Obviously
+              # we should avoid failure, but this is an additional safeguard.
+              ::Gitlab::Auth::LDAP::Config.providers.shuffle.each do |provider|
+                Sync::Proxy.open(provider) do |proxy|
+                  group_sync = self.new(proxy)
+                  group_sync.update_permissions
+                end
+              end
+
+              true
+            end
+
+            def initialize(proxy)
+              @provider = proxy.provider
+              @proxy = proxy
+            end
+
+            def update_permissions
+              logger.debug { "Performing LDAP group sync for '#{provider}' provider" }
+              sync_groups
+              logger.debug { "Finished LDAP group sync for '#{provider}' provider" }
+
+              if config.admin_group.present?
+                logger.debug { "Syncing admin users for '#{provider}' provider" }
+                sync_admin_users
+                logger.debug { "Finished syncing admin users for '#{provider}' provider" }
+              else
+                logger.debug { "No `admin_group` configured for '#{provider}' provider. Skipping" }
+              end
+
+              if config.external_groups.empty?
+                logger.debug { "No `external_groups` configured for '#{provider}' provider. Skipping" }
+              else
+                logger.debug { "Syncing external users for '#{provider}' provider" }
+                sync_external_users
+                logger.debug { "Finished syncing external users for '#{provider}' provider" }
+              end
+
+              nil
+            end
+
+            private
+
+            def sync_groups
+              groups_where_group_links_with_provider_ordered.each do |group|
+                Sync::Group.execute(group, proxy)
+              end
+            end
+
+            def sync_admin_users
+              Sync::AdminUsers.execute(proxy)
+            end
+
+            def sync_external_users
+              Sync::ExternalUsers.execute(proxy)
+            end
+
+            def groups_where_group_links_with_provider_ordered
+              ::Group.where_group_links_with_provider(provider)
+                .preload(:ldap_group_links)
+                .reorder('ldap_sync_last_successful_update_at ASC, namespaces.id ASC')
+                .distinct
+            end
+
+            def config
+              proxy.adapter.config
+            end
+
+            def logger
+              Rails.logger
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/sync/proxy.rb

+require 'net/ldap/dn'
+
+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Sync
+          class Proxy
+            attr_reader :provider, :adapter
+
+            # Open a connection and run all queries through it.
+            # It's more efficient than the default of opening/closing per LDAP query.
+            def self.open(provider, &block)
+              ::Gitlab::Auth::LDAP::Adapter.open(provider) do |adapter|
+                block.call(self.new(provider, adapter))
+              end
+            end
+
+            def initialize(provider, adapter)
+              @adapter = adapter
+              @provider = provider
+            end
+
+            # Cache LDAP group member DNs so we don't query LDAP groups more than once.
+            def dns_for_group_cn(group_cn)
+              @dns_for_group_cn ||= Hash.new { |h, k| h[k] = ldap_group_member_dns(k) }
+              @dns_for_group_cn[group_cn]
+            end
+
+            # Cache user DN so we don't generate excess queries to map UID to DN
+            def dn_for_uid(uid)
+              @dn_for_uid ||= Hash.new { |h, k| h[k] = member_uid_to_dn(k) }
+              @dn_for_uid[uid]
+            end
+
+            private
+
+            def ldap_group_member_dns(ldap_group_cn)
+              ldap_group = LDAP::Group.find_by_cn(ldap_group_cn, adapter)
+              unless ldap_group.present?
+                logger.warn { "Cannot find LDAP group with CN '#{ldap_group_cn}'. Skipping" }
+                return []
+              end
+
+              member_dns = ldap_group.member_dns
+              if member_dns.empty?
+                # Group must be empty
+                return [] unless ldap_group.memberuid?
+
+                members = ldap_group.member_uids
+                member_dns = members.map { |uid| dn_for_uid(uid) }
+              end
+
+              # Various lookups in this method could return `nil` values.
+              # Compact the array to remove those entries
+              member_dns.compact!
+
+              ensure_full_dns!(member_dns)
+
+              logger.debug { "Members in '#{ldap_group.name}' LDAP group: #{member_dns}" }
+
+              # Various lookups in this method could return `nil` values.
+              # Compact the array to remove those entries
+              member_dns
+            end
+
+            # At least one customer reported that their LDAP `member` values contain
+            # only `uid=username` and not the full DN. This method allows us to
+            # account for that. See gitlab-ee#442
+            def ensure_full_dns!(dns)
+              dns.map! do |dn|
+                begin
+                  parsed_dn = ::Gitlab::Auth::LDAP::DN.new(dn).to_a
+                rescue ::Gitlab::Auth::LDAP::DN::FormatError => e
+                  logger.error { "Found malformed DN: '#{dn}'. Skipping. Error: \"#{e.message}\"" }
+                  next
+                end
+
+                final_dn =
+                  # If there is more than one key/value set we must have a full DN,
+                  # or at least the probability is higher.
+                  if parsed_dn.count > 2
+                    dn
+                  elsif parsed_dn.count == 0
+                    logger.warn { "Found null DN. Skipping." }
+                    nil
+                  elsif parsed_dn[0] == 'uid'
+                    dn_for_uid(parsed_dn[1])
+                  else
+                    logger.warn { "Found potentially malformed/incomplete DN: '#{dn}'" }
+                    dn
+                  end
+
+                clean_encoding(final_dn)
+              end
+
+              # Remove `nil` values generated by the rescue above.
+              dns.compact!
+            end
+
+            # net-ldap only returns ASCII-8BIT and does not support UTF-8 out-of-the-box:
+            # https://github.com/ruby-ldap/ruby-net-ldap/issues/4
+            def clean_encoding(dn)
+              return dn unless dn.present?
+
+              dn.force_encoding('UTF-8')
+            rescue
+              dn
+            end
+
+            def member_uid_to_dn(uid)
+              identity = ::Identity.with_secondary_extern_uid(provider, uid).take
+
+              if identity.present?
+                # Use the DN on record in GitLab when it's available
+                identity.extern_uid
+              else
+                ldap_user = ::Gitlab::Auth::LDAP::Person.find_by_uid(uid, adapter)
+
+                # Can't find a matching user
+                return nil unless ldap_user.present?
+
+                # Update user identity so we don't have to go through this again
+                update_identity(ldap_user.dn, uid)
+
+                ldap_user.dn
+              end
+            end
+
+            def update_identity(dn, uid)
+              identity = ::Identity.with_extern_uid(provider, dn).take
+
+              # User may not exist in GitLab yet. Skip.
+              return unless identity.present?
+
+              identity.secondary_extern_uid = uid
+              identity.save
+            end
+
+            def logger
+              Rails.logger
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/sync/users.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module Sync
+          class Users
+            attr_reader :provider, :proxy
+
+            def self.execute(proxy)
+              self.new(proxy).update_permissions
+            end
+
+            def initialize(proxy)
+              @provider = proxy.provider
+              @proxy = proxy
+            end
+
+            def update_permissions
+              dns = member_dns
+              return if dns.empty?
+
+              current_users_with_attribute = ::User.with_provider(provider).where(attribute => true)
+              verified_users_with_attribute = []
+
+              # Verify existing users and add new ones.
+              dns.each do |member_dn|
+                user = update_user_by_dn(member_dn)
+                verified_users_with_attribute << user if user
+              end
+
+              # Revoke the unverified users.
+              (current_users_with_attribute - verified_users_with_attribute).each do |user|
+                user[attribute] = false
+                user.save
+              end
+            end
+
+            private
+
+            def attribute
+              raise NotImplementedError
+            end
+
+            def member_dns
+              raise NotImplementedError
+            end
+
+            def update_user_by_dn(member_dn)
+              user = ::Gitlab::Auth::LDAP::User.find_by_uid_and_provider(member_dn, provider)
+
+              if user.present?
+                user[attribute] = true
+                user.save
+
+                user
+              else
+                Rails.logger.debug do
+                  <<-MSG.strip_heredoc.tr("\n", ' ')
+                    #{self.class.name}: User with DN `#{member_dn}` should be marked as
+                    #{attribute} but there is no user in GitLab with that identity.
+                    Membership will be updated once the user signs in for the first time.
+                  MSG
+                end
+
+                nil
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/user.rb

+# LDAP User EE mixin
+#
+# This module is intended to encapsulate EE-specific User methods
+# and be **prepended** in the `Gitlab::Auth::LDAP::User` class.
+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        module User
+          def initialize(auth_hash)
+            super
+
+            set_external_with_external_groups
+          end
+
+          private
+
+          # Intended to be called during #initialize, and #save should be called
+          # after initialize.
+          def set_external_with_external_groups
+            return if ldap_config.external_groups.empty?
+
+            gl_user.external = in_any_external_group?
+          end
+
+          # Returns true if the User is found in an external group listed in the
+          # config.
+          def in_any_external_group?
+            with_proxy do |proxy|
+              external_groups = proxy.adapter.config.external_groups
+              external_groups.any? do |group_cn|
+                in_group?(group_cn, proxy)
+              end
+            end
+          end
+
+          # Returns true if the User is a member of the group.
+          def in_group?(group_cn, proxy)
+            member_dns = proxy.dns_for_group_cn(group_cn)
+            member_dns.include?(auth_hash.uid)
+          end
+
+          def with_proxy(&block)
+            ::EE::Gitlab::Auth::LDAP::Sync::Proxy.open(auth_hash.provider, &block)
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/ldap/user_filter.rb

+module EE
+  module Gitlab
+    module Auth
+      module LDAP
+        class UserFilter
+          def self.filter(*args)
+            new(*args).filter
+          end
+
+          def initialize(proxy, filter)
+            @proxy = proxy
+            @filter = filter
+          end
+
+          def filter
+            logger.debug "Running filter #{@filter} against #{@proxy.provider}"
+
+            @proxy.adapter.ldap_search(options).map(&:dn).tap do |dns|
+              logger.debug "Found #{dns.count} mathing users for filter #{@filter}"
+            end
+          end
+
+          private
+
+          def options
+            { base: config.base, filter: construct_filter }
+          end
+
+          def construct_filter
+            Net::LDAP::Filter.construct(@filter)
+          end
+
+          def config
+            @proxy.adapter.config
+          end
+
+          def logger
+            Rails.logger
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/o_auth/auth_hash.rb

+module EE
+  module Gitlab
+    module Auth
+      module OAuth
+        module AuthHash
+          include ::Gitlab::Utils::StrongMemoize
+
+          def kerberos_default_realm
+            ::Gitlab::Kerberos::Authentication.kerberos_default_realm
+          end
+
+          def uid
+            strong_memoize(:ee_uid) do
+              ee_uid = super
+
+              # For Kerberos, usernames `principal` and `principal@DEFAULT.REALM`
+              # are equivalent and may be used indifferently, but omniauth_kerberos
+              # does not normalize them as of version 0.3.0, so add the default
+              # realm ourselves if appropriate
+              if provider == 'kerberos' && ee_uid.present?
+                ee_uid += "@#{kerberos_default_realm}" unless ee_uid.include?('@')
+              end
+
+              ee_uid
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/auth/o_auth/user.rb

+module EE
+  module Gitlab
+    module Auth
+      module OAuth
+        module User
+          protected
+
+          def find_ldap_person(auth_hash, adapter)
+            if auth_hash.provider == 'kerberos'
+              ::Gitlab::Auth::LDAP::Person.find_by_kerberos_principal(auth_hash.uid, adapter)
+            else
+              super
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/ee/gitlab/ldap/access_levels.rb

-module EE
-  module Gitlab
-    module LDAP
-      # Create a hash map of member DNs to access levels. The highest
-      # access level is retained in cases where `set` is called multiple times
-      # for the same DN.
-      class AccessLevels < Hash
-        def set(dns, to:)
-          dns.each do |dn|
-            current = self[dn]
-
-            # Keep the higher of the access values.
-            self[dn] = to if current.nil? || to > current
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/adapter.rb

-# LDAP connection adapter EE mixin
-#
-# This module is intended to encapsulate EE-specific adapter methods
-# and be **prepended** in the `Gitlab::LDAP::Adapter` class.
-module EE
-  module Gitlab
-    module LDAP
-      module Adapter
-        # Get LDAP groups from ou=Groups
-        #
-        # cn - filter groups by name
-        #
-        # Ex.
-        #   groups("dev*") # return all groups start with 'dev'
-        #
-        def groups(cn = "*", size = nil)
-          options = {
-            base: config.group_base,
-            filter: Net::LDAP::Filter.eq("cn", cn),
-            attributes: %w(dn cn memberuid member submember uniquemember memberof)
-          }
-
-          options[:size] = size if size
-
-          ldap_search(options).map do |entry|
-            LDAP::Group.new(entry, self)
-          end
-        end
-
-        def group(*args)
-          groups(*args).first
-        end
-
-        def group_members_in_range(dn, range_start)
-          ldap_search(
-            base: dn,
-            scope: Net::LDAP::SearchScope_BaseObject,
-            attributes: ["member;range=#{range_start}-*"]
-          ).first
-        end
-
-        def nested_groups(parent_dn)
-          options = {
-            base: config.group_base,
-            filter: Net::LDAP::Filter.join(
-              Net::LDAP::Filter.eq('objectClass', 'group'),
-              Net::LDAP::Filter.eq('memberOf', parent_dn)
-            )
-          }
-
-          ldap_search(options).map do |entry|
-            LDAP::Group.new(entry, self)
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/config.rb

-module EE
-  module Gitlab
-    module LDAP
-      module Config
-        extend ActiveSupport::Concern
-
-        class_methods do
-          def group_sync_enabled?
-            enabled? && ::License.feature_available?(:ldap_group_sync)
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/group.rb

-module EE
-  module Gitlab
-    module LDAP
-      class Group
-        attr_accessor :adapter
-        attr_reader :entry
-
-        def self.find_by_cn(cn, adapter)
-          cn = Net::LDAP::Filter.escape(cn)
-          adapter.group(cn)
-        end
-
-        def initialize(entry, adapter = nil)
-          Rails.logger.debug { "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}" }
-          @entry = entry
-          @adapter = adapter
-        end
-
-        def active_directory?
-          adapter.config.active_directory
-        end
-
-        def cn
-          entry.cn.first
-        end
-
-        def name
-          cn
-        end
-
-        def path
-          name.parameterize
-        end
-
-        def memberuid?
-          entry.respond_to? :memberuid
-        end
-
-        def member_uids
-          @member_uids ||= entry.memberuid.map do |uid|
-            ::Gitlab::LDAP::Person.normalize_uid(uid)
-          end
-        end
-
-        delegate :dn, to: :entry
-
-        def member_dns(nested_groups_to_skip = [])
-          dns = []
-
-          if active_directory? && adapter
-            dns.concat(active_directory_members(entry, nested_groups_to_skip))
-          end
-
-          dns.concat(entry_member_dns(entry))
-
-          dns.uniq
-        end
-
-        private
-
-        # Active Directory range member methods
-
-        def has_member_range?(entry)
-          member_range_attribute(entry).present?
-        end
-
-        def member_range_attribute(entry)
-          entry.attribute_names.find { |a| a.to_s.start_with?("member;range=")}.to_s
-        end
-
-        def active_directory_members(entry, nested_groups_to_skip)
-          require 'net/ldap/dn'
-
-          members = []
-
-          # Retrieve all member pages/ranges
-          members.concat(ranged_members(entry)) if has_member_range?(entry)
-          # Process nested group members
-          members.concat(nested_members(nested_groups_to_skip))
-          # Clean dns of groups and users outside the base
-          members.reject! { |dn| nested_groups_to_skip.include?(dn) }
-
-          return [] if members.empty?
-
-          # Only return members within our given base
-          members_within_base(members)
-        end
-
-        # AD requires use of range retrieval for groups with more than 1500 members
-        # cf. https://msdn.microsoft.com/en-us/library/aa367017(v=vs.85).aspx
-        def ranged_members(entry)
-          members = []
-
-          # Concatenate the members in the current range
-          dns = entry[member_range_attribute(entry)]
-          dns = normalize_dns(dns)
-          members.concat(dns)
-
-          # Recursively concatenate members until end of ranges
-          if has_more_member_ranges?(entry)
-            next_entry = adapter.group_members_in_range(dn, next_member_range_start(entry))
-
-            members.concat(ranged_members(next_entry))
-          end
-
-          members
-        end
-
-        # Process any AD nested groups. Use a manual process because
-        # the AD recursive member of filter is too slow and uses too
-        # much CPU on the AD server.
-        def nested_members(nested_groups_to_skip)
-          # Ignore this group if we see it again in a nested group.
-          # Prevents infinite loops.
-          nested_groups_to_skip << dn
-
-          members = []
-          nested_groups = adapter.nested_groups(dn)
-
-          nested_groups.each do |nested_group|
-            next if nested_groups_to_skip.include?(nested_group.dn)
-
-            members.concat(nested_group.member_dns(nested_groups_to_skip))
-          end
-
-          members
-        end
-
-        def has_more_member_ranges?(entry)
-          next_member_range_start(entry).present?
-        end
-
-        def next_member_range_start(entry)
-          match = member_range_attribute(entry).match /^member;range=\d+-(\d+|\*)$/
-
-          match[1].to_i + 1 if match.present? && match[1] != '*'
-        end
-
-        # The old AD recursive member filter would exclude any members that
-        # were outside the given search base. To maintain that behavior,
-        # we need to do the same.
-        #
-        # Split the base and each member DN into pairs. Compare the last
-        # base N pairs of the member DN. If they match, the user is within
-        # the base DN.
-        #
-        # Ex.
-        # - Member DN: 'uid=user,ou=users,dc=example,dc=com'
-        # - Base DN:   'dc=example,dc=com'
-        #
-        # Base has 2 pairs ([dc,example], [dc,com]). If the last 2 pairs of
-        # the user DN match, profit!
-        def members_within_base(members)
-          begin
-            base = ::Gitlab::LDAP::DN.new(adapter.config.base).to_a
-          rescue ::Gitlab::LDAP::DN::FormatError => e
-            Rails.logger.error "Configured LDAP `base` is invalid: '#{adapter.config.base}'. Error: \"#{e.message}\""
-            return []
-          end
-
-          members.select do |dn|
-            begin
-              ::Gitlab::LDAP::DN.new(dn).to_a.last(base.length) == base
-            rescue ::Gitlab::LDAP::DN::FormatError => e
-              Rails.logger.warn "Received invalid member DN from LDAP group '#{cn}': '#{dn}'. Error: \"#{e.message}\". Skipping"
-            end
-          end
-        end
-
-        def normalize_dns(dns)
-          dns.map do |dn|
-            ::Gitlab::LDAP::Person.normalize_dn(dn)
-          end
-        end
-
-        def entry_member_dns(entry)
-          dns = entry.try(:member) || entry.try(:uniquemember) || entry.try(:memberof)
-          dns&.concat(entry.try(:submember) || [])
-
-          if dns
-            normalize_dns(dns)
-          else
-            Rails.logger.warn("Could not find member DNs for LDAP group #{entry.inspect}")
-            []
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/person.rb

-require 'net/ldap/dn'
-
-module EE
-  module Gitlab
-    module LDAP
-      module Person
-        extend ActiveSupport::Concern
-
-        class_methods do
-          def find_by_email(email, adapter)
-            email_attributes = Array(adapter.config.attributes['email'])
-
-            email_attributes.each do |possible_attribute|
-              found_user = adapter.user(possible_attribute, email)
-              return found_user if found_user
-            end
-
-            nil
-          end
-
-          def find_by_kerberos_principal(principal, adapter)
-            uid, domain = principal.split('@', 2)
-            return nil unless uid && domain
-
-            # In multi-forest setups, there may be several users with matching
-            # uids but differing DNs, so skip adapters configured to connect to
-            # non-matching domains
-            return unless domain.casecmp(domain_from_dn(adapter.config.base)) == 0
-
-            find_by_uid(uid, adapter)
-          end
-
-          # Extracts the rightmost unbroken set of domain components from an
-          # LDAP DN and constructs a domain name from them
-          def domain_from_dn(dn)
-            dn_components = []
-            ::Gitlab::LDAP::DN.new(dn).each_pair { |name, value| dn_components << { name: name, value: value } }
-            dn_components
-              .reverse
-              .take_while { |rdn| rdn[:name].casecmp('DC').zero? } # Domain Component
-              .map { |rdn| rdn[:value] }
-              .reverse
-              .join('.')
-          end
-
-          def ldap_attributes(config)
-            attributes = super + [
-              'memberof',
-              (config.sync_ssh_keys if config.sync_ssh_keys.is_a?(String))
-            ]
-            attributes.compact.uniq
-          end
-        end
-
-        def ssh_keys
-          if config.sync_ssh_keys? && entry.respond_to?(config.sync_ssh_keys)
-            entry[config.sync_ssh_keys.to_sym]
-              .map { |key| key[/(ssh|ecdsa)-[^ ]+ [^\s]+/] }
-              .compact
-          else
-            []
-          end
-        end
-
-        # We assume that the Kerberos username matches the configured uid
-        # attribute in LDAP. For Active Directory, this is `sAMAccountName`
-        def kerberos_principal
-          return nil unless uid
-
-          uid + '@' + self.class.domain_from_dn(dn).upcase
-        end
-
-        def memberof
-          return [] unless entry.attribute_names.include?(:memberof)
-
-          entry.memberof
-        end
-
-        def group_cns
-          memberof.map { |memberof_value| cn_from_memberof(memberof_value) }
-        end
-
-        def cn_from_memberof(memberof)
-          # Only get the first CN value of the string, that's the one that contains
-          # the group name
-          memberof.match(/(?:cn=([\w\s]+))/i)&.captures&.first
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/sync/admin_users.rb

-module EE
-  module Gitlab
-    module LDAP
-      module Sync
-        class AdminUsers
-          attr_reader :provider, :proxy
-
-          def self.execute(proxy)
-            self.new(proxy).update_permissions
-          end
-
-          def initialize(proxy)
-            @provider = proxy.provider
-            @proxy = proxy
-          end
-
-          def update_permissions
-            return if admin_group.empty?
-
-            admin_group_member_dns = proxy.dns_for_group_cn(admin_group)
-            current_admin_users = ::User.admins.with_provider(provider)
-            verified_admin_users = []
-
-            # Verify existing admin users and add new ones.
-            admin_group_member_dns.each do |member_dn|
-              user = ::Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
-
-              if user.present?
-                user.admin = true
-                user.save
-                verified_admin_users << user
-              else
-                Rails.logger.debug do
-                  <<-MSG.strip_heredoc.tr("\n", ' ')
-                    #{self.class.name}: User with DN `#{member_dn}` should have admin
-                    access but there is no user in GitLab with that identity.
-                    Membership will be updated once the user signs in for the first time.
-                  MSG
-                end
-              end
-            end
-
-            # Revoke the unverified admins.
-            current_admin_users.each do |user|
-              unless verified_admin_users.include?(user)
-                user.admin = false
-                user.save
-              end
-            end
-          end
-
-          private
-
-          def admin_group
-            proxy.adapter.config.admin_group
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/sync/external_users.rb

-module EE
-  module Gitlab
-    module LDAP
-      module Sync
-        class ExternalUsers
-          attr_reader :provider, :proxy
-
-          def self.execute(proxy)
-            self.new(proxy).update_permissions
-          end
-
-          def initialize(proxy)
-            @provider = proxy.provider
-            @proxy = proxy
-          end
-
-          def update_permissions
-            return unless external_groups.any?
-
-            current_external_users = ::User.external.with_provider(provider)
-            verified_external_users = []
-
-            external_groups.each do |group|
-              group_dns = proxy.dns_for_group_cn(group)
-
-              group_dns.each do |member_dn|
-                user = ::Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
-
-                if user.present?
-                  user.external = true
-                  user.save
-                  verified_external_users << user
-                else
-                  Rails.logger.debug do
-                    <<-MSG.strip_heredoc.tr("\n", ' ')
-                      #{self.class.name}: User with DN `#{member_dn}` should be marked as
-                      external but there is no user in GitLab with that identity.
-                      Membership will be updated once the user signs in for the first time.
-                    MSG
-                  end
-                end
-              end
-            end
-
-            # Restore normal access to users no longer found in the external groups
-            current_external_users.each do |user|
-              unless verified_external_users.include?(user)
-                user.external = false
-                user.save
-              end
-            end
-          end
-
-          private
-
-          def external_groups
-            proxy.adapter.config.external_groups
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/sync/group.rb

-module EE
-  module Gitlab
-    module LDAP
-      module Sync
-        class Group
-          attr_reader :provider, :group, :proxy
-
-          class << self
-            # Sync members across all providers for the given group.
-            def execute_all_providers(group)
-              return unless ldap_sync_ready?(group)
-
-              group.start_ldap_sync
-              Rails.logger.debug { "Started syncing all providers for '#{group.name}' group" }
-
-              # Shuffle providers to prevent a scenario where sync fails after a time
-              # and only the first provider or two get synced. This shuffles the order
-              # so subsequent syncs should eventually get to all providers. Obviously
-              # we should avoid failure, but this is an additional safeguard.
-              ::Gitlab::LDAP::Config.providers.shuffle.each do |provider|
-                Sync::Proxy.open(provider) do |proxy|
-                  new(group, proxy).update_permissions
-                end
-              end
-
-              group.finish_ldap_sync
-              Rails.logger.debug { "Finished syncing all providers for '#{group.name}' group" }
-            end
-
-            # Sync members across a single provider for the given group.
-            def execute(group, proxy)
-              return unless ldap_sync_ready?(group)
-
-              group.start_ldap_sync
-              Rails.logger.debug { "Started syncing '#{proxy.provider}' provider for '#{group.name}' group" }
-
-              sync_group = new(group, proxy)
-              sync_group.update_permissions
-
-              group.finish_ldap_sync
-              Rails.logger.debug { "Finished syncing '#{proxy.provider}' provider for '#{group.name}' group" }
-            end
-
-            def ldap_sync_ready?(group)
-              fail_stuck_group(group)
-
-              return true unless group.ldap_sync_started?
-
-              Rails.logger.warn "Group '#{group.name}' is not ready for LDAP sync. Skipping"
-              false
-            end
-
-            def fail_stuck_group(group)
-              return unless group.ldap_sync_started?
-
-              if group.ldap_sync_last_sync_at < 1.hour.ago
-                group.mark_ldap_sync_as_failed('The sync took too long to complete.')
-              end
-            end
-          end
-
-          def initialize(group, proxy)
-            @provider = proxy.provider
-            @group = group
-            @proxy = proxy
-          end
-
-          def update_permissions
-            unless group.ldap_sync_started?
-              logger.warn "Group '#{group.name}' LDAP sync status must be 'started' before updating permissions"
-              return
-            end
-
-            access_levels = AccessLevels.new
-            # Only iterate over group links for the current provider
-            group.ldap_group_links.with_provider(provider).each do |group_link|
-              next unless group_link.active?
-
-              update_access_levels(access_levels, group_link)
-            end
-
-            update_existing_group_membership(group, access_levels)
-            add_new_members(group, access_levels)
-          end
-
-          private
-
-          def update_access_levels(access_levels, group_link)
-            if member_dns = get_member_dns(group_link)
-              access_levels.set(member_dns, to: group_link.group_access)
-
-              logger.debug do
-                "Resolved '#{group.name}' group member access: #{access_levels.to_hash}"
-              end
-            end
-          end
-
-          def get_member_dns(group_link)
-            group_link.cn ? dns_for_group_cn(group_link.cn) : UserFilter.filter(@proxy, group_link.filter)
-          end
-
-          def dns_for_group_cn(group_cn)
-            if config.group_base.blank?
-              logger.debug { "No `group_base` configured for '#{provider}' provider and group link CN #{group_cn}. Skipping" }
-
-              return nil
-            end
-
-            proxy.dns_for_group_cn(group_cn)
-          end
-
-          def dn_for_uid(uid)
-            proxy.dn_for_uid(uid)
-          end
-
-          def update_existing_group_membership(group, access_levels)
-            logger.debug { "Updating existing membership for '#{group.name}' group" }
-
-            select_and_preload_group_members(group).each do |member|
-              user = member.user
-              identity = user.identities.select(:id, :extern_uid)
-                           .with_provider(provider).first
-              member_dn = identity.extern_uid.downcase
-
-              # Skip if this is not an LDAP user with a valid `extern_uid`.
-              next unless member_dn.present?
-
-              # Prevent shifting group membership, in case where user is a member
-              # of two LDAP groups from different providers linked to the same
-              # GitLab group. This is not ideal, but preserves existing behavior.
-              if user.ldap_identity.id != identity.id
-                access_levels.delete(member_dn)
-                next
-              end
-
-              desired_access = access_levels[member_dn]
-
-              # Skip validations and callbacks. We have a limited set of attrs
-              # due to the `select` lookup, and we need to be efficient.
-              # Low risk, because the member should already be valid.
-              member.update_column(:ldap, true) unless member.ldap?
-
-              # Don't do anything if the user already has the desired access level
-              if member.access_level == desired_access
-                access_levels.delete(member_dn)
-                next
-              end
-
-              # Check and update the access level. If `desired_access` is `nil`
-              # we need to delete the user from the group.
-              if desired_access.present?
-                # Delete this entry from the hash now that we're acting on it
-                access_levels.delete(member_dn)
-
-                next if member.ldap? && member.override?
-
-                add_or_update_user_membership(
-                  user,
-                  group,
-                  desired_access
-                )
-              elsif group.last_owner?(user)
-                warn_cannot_remove_last_owner(user, group)
-              else
-                group.users.destroy(user)
-              end
-            end
-          end
-
-          def add_new_members(group, access_levels)
-            logger.debug { "Adding new members to '#{group.name}' group" }
-
-            access_levels.each do |member_dn, access_level|
-              user = ::Gitlab::LDAP::User.find_by_uid_and_provider(member_dn, provider)
-
-              if user.present?
-                add_or_update_user_membership(
-                  user,
-                  group,
-                  access_level
-                )
-              else
-                logger.debug do
-                  <<-MSG.strip_heredoc.tr("\n", ' ')
-                    #{self.class.name}: User with DN `#{member_dn}` should have access
-                    to '#{group.name}' group but there is no user in GitLab with that
-                    identity. Membership will be updated once the user signs in for
-                    the first time.
-                  MSG
-                end
-              end
-            end
-          end
-
-          def add_or_update_user_membership(user, group, access, current_user: nil)
-            # Prevent the last owner of a group from being demoted
-            if access < ::Gitlab::Access::OWNER && group.last_owner?(user)
-              warn_cannot_remove_last_owner(user, group)
-            else
-              # If you pass the user object, instead of just user ID,
-              # it saves an extra user database query.
-              group.add_user(
-                user,
-                access,
-                current_user: current_user,
-                ldap: true
-              )
-            end
-          end
-
-          def warn_cannot_remove_last_owner(user, group)
-            logger.warn do
-              <<-MSG.strip_heredoc.tr("\n", ' ')
-                #{self.class.name}: LDAP group sync cannot remove #{user.name}
-                (#{user.id}) from group #{group.name} (#{group.id}) as this is
-                the group's last owner
-              MSG
-            end
-          end
-
-          def select_and_preload_group_members(group)
-            group.members.select(:id, :access_level, :user_id, :ldap, :override)
-              .with_identity_provider(provider).preload(:user)
-          end
-
-          def logger
-            Rails.logger
-          end
-
-          def config
-            @proxy.adapter.config
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/sync/groups.rb

-module EE
-  module Gitlab
-    module LDAP
-      module Sync
-        class Groups
-          attr_reader :provider, :proxy
-
-          def self.execute
-            # Shuffle providers to prevent a scenario where sync fails after a time
-            # and only the first provider or two get synced. This shuffles the order
-            # so subsequent syncs should eventually get to all providers. Obviously
-            # we should avoid failure, but this is an additional safeguard.
-            ::Gitlab::LDAP::Config.providers.shuffle.each do |provider|
-              Sync::Proxy.open(provider) do |proxy|
-                group_sync = self.new(proxy)
-                group_sync.update_permissions
-              end
-            end
-
-            true
-          end
-
-          def initialize(proxy)
-            @provider = proxy.provider
-            @proxy = proxy
-          end
-
-          def update_permissions
-            logger.debug { "Performing LDAP group sync for '#{provider}' provider" }
-            sync_groups
-            logger.debug { "Finished LDAP group sync for '#{provider}' provider" }
-
-            if config.admin_group.present?
-              logger.debug { "Syncing admin users for '#{provider}' provider" }
-              sync_admin_users
-              logger.debug { "Finished syncing admin users for '#{provider}' provider" }
-            else
-              logger.debug { "No `admin_group` configured for '#{provider}' provider. Skipping" }
-            end
-
-            if config.external_groups.empty?
-              logger.debug { "No `external_groups` configured for '#{provider}' provider. Skipping" }
-            else
-              logger.debug { "Syncing external users for '#{provider}' provider" }
-              sync_external_users
-              logger.debug { "Finished syncing external users for '#{provider}' provider" }
-            end
-
-            nil
-          end
-
-          private
-
-          def sync_groups
-            groups_where_group_links_with_provider_ordered.each do |group|
-              Sync::Group.execute(group, proxy)
-            end
-          end
-
-          def sync_admin_users
-            Sync::AdminUsers.execute(proxy)
-          end
-
-          def sync_external_users
-            Sync::ExternalUsers.execute(proxy)
-          end
-
-          def groups_where_group_links_with_provider_ordered
-            ::Group.where_group_links_with_provider(provider)
-              .preload(:ldap_group_links)
-              .reorder('ldap_sync_last_successful_update_at ASC, namespaces.id ASC')
-              .distinct
-          end
-
-          def config
-            proxy.adapter.config
-          end
-
-          def logger
-            Rails.logger
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/sync/proxy.rb

-require 'net/ldap/dn'
-
-module EE
-  module Gitlab
-    module LDAP
-      module Sync
-        class Proxy
-          attr_reader :provider, :adapter
-
-          # Open a connection and run all queries through it.
-          # It's more efficient than the default of opening/closing per LDAP query.
-          def self.open(provider, &block)
-            ::Gitlab::LDAP::Adapter.open(provider) do |adapter|
-              block.call(self.new(provider, adapter))
-            end
-          end
-
-          def initialize(provider, adapter)
-            @adapter = adapter
-            @provider = provider
-          end
-
-          # Cache LDAP group member DNs so we don't query LDAP groups more than once.
-          def dns_for_group_cn(group_cn)
-            @dns_for_group_cn ||= Hash.new { |h, k| h[k] = ldap_group_member_dns(k) }
-            @dns_for_group_cn[group_cn]
-          end
-
-          # Cache user DN so we don't generate excess queries to map UID to DN
-          def dn_for_uid(uid)
-            @dn_for_uid ||= Hash.new { |h, k| h[k] = member_uid_to_dn(k) }
-            @dn_for_uid[uid]
-          end
-
-          private
-
-          def ldap_group_member_dns(ldap_group_cn)
-            ldap_group = LDAP::Group.find_by_cn(ldap_group_cn, adapter)
-            unless ldap_group.present?
-              logger.warn { "Cannot find LDAP group with CN '#{ldap_group_cn}'. Skipping" }
-              return []
-            end
-
-            member_dns = ldap_group.member_dns
-            if member_dns.empty?
-              # Group must be empty
-              return [] unless ldap_group.memberuid?
-
-              members = ldap_group.member_uids
-              member_dns = members.map { |uid| dn_for_uid(uid) }
-            end
-
-            # Various lookups in this method could return `nil` values.
-            # Compact the array to remove those entries
-            member_dns.compact!
-
-            ensure_full_dns!(member_dns)
-
-            logger.debug { "Members in '#{ldap_group.name}' LDAP group: #{member_dns}" }
-
-            # Various lookups in this method could return `nil` values.
-            # Compact the array to remove those entries
-            member_dns
-          end
-
-          # At least one customer reported that their LDAP `member` values contain
-          # only `uid=username` and not the full DN. This method allows us to
-          # account for that. See gitlab-ee#442
-          def ensure_full_dns!(dns)
-            dns.map! do |dn|
-              begin
-                parsed_dn = ::Gitlab::LDAP::DN.new(dn).to_a
-              rescue ::Gitlab::LDAP::DN::FormatError => e
-                logger.error { "Found malformed DN: '#{dn}'. Skipping. Error: \"#{e.message}\"" }
-                next
-              end
-
-              final_dn =
-                # If there is more than one key/value set we must have a full DN,
-                # or at least the probability is higher.
-                if parsed_dn.count > 2
-                  dn
-                elsif parsed_dn.count == 0
-                  logger.warn { "Found null DN. Skipping." }
-                  nil
-                elsif parsed_dn[0] == 'uid'
-                  dn_for_uid(parsed_dn[1])
-                else
-                  logger.warn { "Found potentially malformed/incomplete DN: '#{dn}'" }
-                  dn
-                end
-
-              clean_encoding(final_dn)
-            end
-
-            # Remove `nil` values generated by the rescue above.
-            dns.compact!
-          end
-
-          # net-ldap only returns ASCII-8BIT and does not support UTF-8 out-of-the-box:
-          # https://github.com/ruby-ldap/ruby-net-ldap/issues/4
-          def clean_encoding(dn)
-            return dn unless dn.present?
-
-            dn.force_encoding('UTF-8')
-          rescue
-            dn
-          end
-
-          def member_uid_to_dn(uid)
-            identity = ::Identity.with_secondary_extern_uid(provider, uid).take
-
-            if identity.present?
-              # Use the DN on record in GitLab when it's available
-              identity.extern_uid
-            else
-              ldap_user = ::Gitlab::LDAP::Person.find_by_uid(uid, adapter)
-
-              # Can't find a matching user
-              return nil unless ldap_user.present?
-
-              # Update user identity so we don't have to go through this again
-              update_identity(ldap_user.dn, uid)
-
-              ldap_user.dn
-            end
-          end
-
-          def update_identity(dn, uid)
-            identity = ::Identity.with_extern_uid(provider, dn).take
-
-            # User may not exist in GitLab yet. Skip.
-            return unless identity.present?
-
-            identity.secondary_extern_uid = uid
-            identity.save
-          end
-
-          def logger
-            Rails.logger
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/user.rb

-# LDAP User EE mixin
-#
-# This module is intended to encapsulate EE-specific User methods
-# and be **prepended** in the `Gitlab::LDAP::User` class.
-module EE
-  module Gitlab
-    module LDAP
-      module User
-        def initialize(auth_hash)
-          super
-
-          set_external_with_external_groups
-        end
-
-        private
-
-        # Intended to be called during #initialize, and #save should be called
-        # after initialize.
-        def set_external_with_external_groups
-          return if ldap_config.external_groups.empty?
-
-          gl_user.external = in_any_external_group?
-        end
-
-        # Returns true if the User is found in an external group listed in the
-        # config.
-        def in_any_external_group?
-          with_proxy do |proxy|
-            external_groups = proxy.adapter.config.external_groups
-            external_groups.any? do |group_cn|
-              in_group?(group_cn, proxy)
-            end
-          end
-        end
-
-        # Returns true if the User is a member of the group.
-        def in_group?(group_cn, proxy)
-          member_dns = proxy.dns_for_group_cn(group_cn)
-          member_dns.include?(auth_hash.uid)
-        end
-
-        def with_proxy(&block)
-          ::EE::Gitlab::LDAP::Sync::Proxy.open(auth_hash.provider, &block)
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/ldap/user_filter.rb

-module EE
-  module Gitlab
-    module LDAP
-      class UserFilter
-        def self.filter(*args)
-          new(*args).filter
-        end
-
-        def initialize(proxy, filter)
-          @proxy = proxy
-          @filter = filter
-        end
-
-        def filter
-          logger.debug "Running filter #{@filter} against #{@proxy.provider}"
-
-          @proxy.adapter.ldap_search(options).map(&:dn).tap do |dns|
-            logger.debug "Found #{dns.count} mathing users for filter #{@filter}"
-          end
-        end
-
-        private
-
-        def options
-          { base: config.base, filter: construct_filter }
-        end
-
-        def construct_filter
-          Net::LDAP::Filter.construct(@filter)
-        end
-
-        def config
-          @proxy.adapter.config
-        end
-
-        def logger
-          Rails.logger
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/o_auth/auth_hash.rb

-module EE
-  module Gitlab
-    module OAuth
-      module AuthHash
-        include ::Gitlab::Utils::StrongMemoize
-
-        def kerberos_default_realm
-          ::Gitlab::Kerberos::Authentication.kerberos_default_realm
-        end
-
-        def uid
-          strong_memoize(:ee_uid) do
-            ee_uid = super
-
-            # For Kerberos, usernames `principal` and `principal@DEFAULT.REALM`
-            # are equivalent and may be used indifferently, but omniauth_kerberos
-            # does not normalize them as of version 0.3.0, so add the default
-            # realm ourselves if appropriate
-            if provider == 'kerberos' && ee_uid.present?
-              ee_uid += "@#{kerberos_default_realm}" unless ee_uid.include?('@')
-            end
-
-            ee_uid
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/ee/gitlab/o_auth/user.rb

-module EE
-  module Gitlab
-    module OAuth
-      module User
-        protected
-
-        def find_ldap_person(auth_hash, adapter)
-          if auth_hash.provider == 'kerberos'
-            ::Gitlab::LDAP::Person.find_by_kerberos_principal(auth_hash.uid, adapter)
-          else
-            super
-          end
-        end
-      end
-    end
-  end
-end

ee/lib/tasks/migrate/ldap.rake

 desc "GITLAB | migrate provider names to multiple ldap setup"
 namespace :gitlab do
   task migrate_ldap_providers: :environment do
-    config = Gitlab::LDAP::Config
+    config = Gitlab::Auth::LDAP::Config
     raise 'No LDAP server hash defined. See config/gitlab.yml.example for an example' unless config.servers.any?
 
     provider = config.servers.first['provider_name']

ee/spec/lib/ee/gitlab/ldap/access_levels_spec.rb → ee/spec/lib/ee/gitlab/auth/ldap/access_levels_spec.rb

 require 'spec_helper'
 
-describe EE::Gitlab::LDAP::AccessLevels do
+describe EE::Gitlab::Auth::LDAP::AccessLevels do
   describe '#set' do
     let(:access_levels) { described_class.new }
     let(:dns) do

ee/spec/lib/ee/gitlab/ldap/group_spec.rb → ee/spec/lib/ee/gitlab/auth/ldap/group_spec.rb

 require 'spec_helper'
 
-describe EE::Gitlab::LDAP::Group do
+describe EE::Gitlab::Auth::LDAP::Group do
   include LdapHelpers
 
   before do

ee/spec/lib/ee/gitlab/ldap/sync/admin_users_spec.rb → ee/spec/lib/ee/gitlab/auth/ldap/sync/admin_users_spec.rb

 require 'spec_helper'
 
-describe EE::Gitlab::LDAP::Sync::AdminUsers do
+describe EE::Gitlab::Auth::LDAP::Sync::AdminUsers do
   include LdapHelpers
 
   let(:adapter) { ldap_adapter }

ee/spec/lib/ee/gitlab/ldap/sync/external_users_spec.rb → ee/spec/lib/ee/gitlab/auth/ldap/sync/external_users_spec.rb

 require 'spec_helper'
 
-describe EE::Gitlab::LDAP::Sync::ExternalUsers do
+describe EE::Gitlab::Auth::LDAP::Sync::ExternalUsers do
   include LdapHelpers
 
   describe '#update_permissions' do

ee/spec/lib/ee/gitlab/ldap/sync/group_spec.rb → ee/spec/lib/ee/gitlab/auth/ldap/sync/group_spec.rb

 require 'spec_helper'
 
-describe EE::Gitlab::LDAP::Sync::Group do
+describe EE::Gitlab::Auth::LDAP::Sync::Group do
   include LdapHelpers
 
   let(:adapter) { ldap_adapter }
@@ -69,7 +69,7 @@ describe EE::Gitlab::LDAP::Sync::Group do
 
       adapter = ldap_adapter('main')
       proxy = proxy(adapter, 'main')
-      allow(EE::Gitlab::LDAP::Sync::Proxy).to receive(:open).and_yield(proxy)
+      allow(EE::Gitlab::Auth::LDAP::Sync::Proxy).to receive(:open).and_yield(proxy)
     end
 
     let(:group) do
@@ -303,7 +303,7 @@ describe EE::Gitlab::LDAP::Sync::Group do
         it 'does not update permissions when group base is missing' do
           stub_ldap_config(group_base: nil)
 
-          expect_any_instance_of(EE::Gitlab::LDAP::Sync::Proxy).not_to receive(:dns_for_group_cn)
+          expect_any_instance_of(EE::Gitlab::Auth::LDAP::Sync::Proxy).not_to receive(:dns_for_group_cn)
 
           sync_group.update_permissions
         end
@@ -390,7 +390,7 @@ describe EE::Gitlab::LDAP::Sync::Group do
         # Safe-check because some permissions are removed when `Group#ldap_synced?`
         # is true (e.g. in `GroupPolicy`).
         expect(group).to be_ldap_synced
-        allow(EE::Gitlab::LDAP::UserFilter).to receive(:filter).and_return([user_dn(user.username)])
+        allow(EE::Gitlab::Auth::LDAP::UserFilter).to receive(:filter).and_return([user_dn(user.username)])
 
         group.start_ldap_sync
       end

ee/spec/lib/ee/gitlab/ldap/sync/groups_spec.rb → ee/spec/lib/ee/gitlab/auth/ldap/sync/groups_spec.rb

 require 'spec_helper'
 
-describe EE::Gitlab::LDAP::Sync::Groups do
+describe EE::Gitlab::Auth::LDAP::Sync::Groups do
   include LdapHelpers
 
   let(:adapter) { ldap_adapter }
@@ -8,9 +8,9 @@ describe EE::Gitlab::LDAP::Sync::Groups do
 
   describe '#update_permissions' do
     before do
-      allow(EE::Gitlab::LDAP::Sync::Group).to receive(:execute)
-      allow(EE::Gitlab::LDAP::Sync::AdminUsers).to receive(:execute)
-      allow(EE::Gitlab::LDAP::Sync::ExternalUsers).to receive(:execute)
+      allow(EE::Gitlab::Auth::LDAP::Sync::Group).to receive(:execute)
+      allow(EE::Gitlab::Auth::LDAP::Sync::AdminUsers).to receive(:execute)
+      allow(EE::Gitlab::Auth::LDAP::Sync::ExternalUsers).to receive(:execute)
 
       2.times { create(:group_with_ldap_group_link) }
     end
@@ -24,12 +24,12 @@ describe EE::Gitlab::LDAP::Sync::Groups do
         stub_ldap_config(group_base: nil)
       end
 
-      it 'does not call EE::Gitlab::LDAP::Sync::AdminUsers#execute' do
-        expect(EE::Gitlab::LDAP::Sync::AdminUsers).not_to receive(:execute)
+      it 'does not call EE::Gitlab::Auth::LDAP::Sync::AdminUsers#execute' do
+        expect(EE::Gitlab::Auth::LDAP::Sync::AdminUsers).not_to receive(:execute)
       end
 
-      it 'does not call EE::Gitlab::LDAP::Sync::ExternalUsers#execute' do
-        expect(EE::Gitlab::LDAP::Sync::ExternalUsers).not_to receive(:execute)
+      it 'does not call EE::Gitlab::Auth::LDAP::Sync::ExternalUsers#execute' do
+        expect(EE::Gitlab::Auth::LDAP::Sync::ExternalUsers).not_to receive(:execute)
       end
     end
 
@@ -39,16 +39,16 @@ describe EE::Gitlab::LDAP::Sync::Groups do
           stub_ldap_config(group_base: 'dc=example,dc=com')
         end
 
-        it 'calls EE::Gitlab::LDAP::Sync::Group#execute' do
-          expect(EE::Gitlab::LDAP::Sync::Group).to receive(:execute).twice
+        it 'calls EE::Gitlab::Auth::LDAP::Sync::Group#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::Group).to receive(:execute).twice
         end
 
-        it 'does not call EE::Gitlab::LDAP::Sync::AdminUsers#execute' do
-          expect(EE::Gitlab::LDAP::Sync::AdminUsers).not_to receive(:execute)
+        it 'does not call EE::Gitlab::Auth::LDAP::Sync::AdminUsers#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::AdminUsers).not_to receive(:execute)
         end
 
-        it 'does not call EE::Gitlab::LDAP::Sync::ExternalUsers#execute' do
-          expect(EE::Gitlab::LDAP::Sync::ExternalUsers).not_to receive(:execute)
+        it 'does not call EE::Gitlab::Auth::LDAP::Sync::ExternalUsers#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::ExternalUsers).not_to receive(:execute)
         end
       end
 
@@ -60,16 +60,16 @@ describe EE::Gitlab::LDAP::Sync::Groups do
           )
         end
 
-        it 'calls EE::Gitlab::LDAP::Sync::Group#execute' do
-          expect(EE::Gitlab::LDAP::Sync::Group).to receive(:execute).twice
+        it 'calls EE::Gitlab::Auth::LDAP::Sync::Group#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::Group).to receive(:execute).twice
         end
 
-        it 'does not call EE::Gitlab::LDAP::Sync::AdminUsers#execute' do
-          expect(EE::Gitlab::LDAP::Sync::AdminUsers).to receive(:execute).once
+        it 'does not call EE::Gitlab::Auth::LDAP::Sync::AdminUsers#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::AdminUsers).to receive(:execute).once
         end
 
-        it 'does not call EE::Gitlab::LDAP::Sync::ExternalUsers#execute' do
-          expect(EE::Gitlab::LDAP::Sync::ExternalUsers).not_to receive(:execute)
+        it 'does not call EE::Gitlab::Auth::LDAP::Sync::ExternalUsers#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::ExternalUsers).not_to receive(:execute)
         end
       end
 
@@ -81,16 +81,16 @@ describe EE::Gitlab::LDAP::Sync::Groups do
           )
         end
 
-        it 'calls EE::Gitlab::LDAP::Sync::Group#execute' do
-          expect(EE::Gitlab::LDAP::Sync::Group).to receive(:execute).twice
+        it 'calls EE::Gitlab::Auth::LDAP::Sync::Group#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::Group).to receive(:execute).twice
         end
 
-        it 'does not call EE::Gitlab::LDAP::Sync::AdminUsers#execute' do
-          expect(EE::Gitlab::LDAP::Sync::AdminUsers).not_to receive(:execute)
+        it 'does not call EE::Gitlab::Auth::LDAP::Sync::AdminUsers#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::AdminUsers).not_to receive(:execute)
         end
 
-        it 'does not call EE::Gitlab::LDAP::Sync::ExternalUsers#execute' do
-          expect(EE::Gitlab::LDAP::Sync::ExternalUsers).to receive(:execute).once
+        it 'does not call EE::Gitlab::Auth::LDAP::Sync::ExternalUsers#execute' do
+          expect(EE::Gitlab::Auth::LDAP::Sync::ExternalUsers).to receive(:execute).once
         end
       end
     end

ee/spec/lib/ee/gitlab/ldap/sync/proxy_spec.rb → ee/spec/lib/ee/gitlab/auth/ldap/sync/proxy_spec.rb

 require 'spec_helper'
 require 'net/ldap/dn'
 
-describe EE::Gitlab::LDAP::Sync::Proxy do
+describe EE::Gitlab::Auth::LDAP::Sync::Proxy do
   include LdapHelpers
 
   let(:adapter) { ldap_adapter }
@@ -56,7 +56,7 @@ describe EE::Gitlab::LDAP::Sync::Proxy do
         sync_proxy.dns_for_group_cn('ldap_group1')
 
         expect(sync_proxy).not_to receive(:ldap_group_member_dns)
-        expect(EE::Gitlab::LDAP::Group).not_to receive(:find_by_cn)
+        expect(EE::Gitlab::Auth::LDAP::Group).not_to receive(:find_by_cn)
 
         sync_proxy.dns_for_group_cn('ldap_group1')
       end
@@ -123,7 +123,7 @@ describe EE::Gitlab::LDAP::Sync::Proxy do
       end
 
       it 'retrieves the user from LDAP' do
-        expect(::Gitlab::LDAP::Person).to receive(:find_by_uid)
+        expect(::Gitlab::Auth::LDAP::Person).to receive(:find_by_uid)
 
         sync_proxy.dn_for_uid('jane_doe')
       end
@@ -133,7 +133,7 @@ describe EE::Gitlab::LDAP::Sync::Proxy do
 
         expect(sync_proxy).not_to receive(:member_uid_to_dn)
         expect(Identity).not_to receive(:find_by)
-        expect(::Gitlab::LDAP::Person).not_to receive(:find_by_uid)
+        expect(::Gitlab::Auth::LDAP::Person).not_to receive(:find_by_uid)
 
         sync_proxy.dn_for_uid('jane_doe')
       end
@@ -177,7 +177,7 @@ describe EE::Gitlab::LDAP::Sync::Proxy do
       end
 
       it 'does not query LDAP' do
-        expect(::Gitlab::LDAP::Person).not_to receive(:find_by_uid)
+        expect(::Gitlab::Auth::LDAP::Person).not_to receive(:find_by_uid)
       end
 
       it 'retrieves the DN from the identity' do

ee/spec/lib/ee/gitlab/ldap/user_filter_spec.rb → ee/spec/lib/ee/gitlab/auth/ldap/user_filter_spec.rb

 require 'spec_helper'
 
-describe EE::Gitlab::LDAP::UserFilter do
+describe EE::Gitlab::Auth::LDAP::UserFilter do
   include LdapHelpers
 
   let(:auth_hash) do

ee/spec/lib/gitlab/ldap/adapter_spec.rb → ee/spec/lib/gitlab/auth/ldap/adapter_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::Adapter do
+describe Gitlab::Auth::LDAP::Adapter do
   include LdapHelpers
 
   let(:adapter) { ldap_adapter('ldapmain') }
 
   it 'includes the EE module' do
-    expect(described_class).to include_module(EE::Gitlab::LDAP::Adapter)
+    expect(described_class).to include_module(EE::Gitlab::Auth::LDAP::Adapter)
   end
 
   describe '#groups' do
@@ -34,7 +34,7 @@ describe Gitlab::LDAP::Adapter do
 
       results = adapter.groups('group1')
 
-      expect(results.first).to be_a(EE::Gitlab::LDAP::Group)
+      expect(results.first).to be_a(EE::Gitlab::Auth::LDAP::Group)
       expect(results.first.cn).to eq('group1')
       expect(results.first.member_dns).to match_array(%w(uid=john uid=mary))
     end

ee/spec/lib/gitlab/ldap/person_spec.rb → ee/spec/lib/gitlab/auth/ldap/person_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::Person do
+describe Gitlab::Auth::LDAP::Person do
   include LdapHelpers
 
   let(:entry) { ldap_user_entry('john.doe') }
 
   it 'includes the EE module' do
-    expect(described_class).to include(EE::Gitlab::LDAP::Person)
+    expect(described_class).to include(EE::Gitlab::Auth::LDAP::Person)
   end
 
   describe '.ldap_attributes' do
@@ -84,7 +84,7 @@ describe Gitlab::LDAP::Person do
       )
     end
 
-    let(:config) { Gitlab::LDAP::Config.new('ldapmain') }
+    let(:config) { Gitlab::Auth::LDAP::Config.new('ldapmain') }
     let(:ldap_attributes) { described_class.ldap_attributes(config) }
     let(:expected_attributes) { %w(dn cn uid mail memberof) }
 
@@ -140,7 +140,7 @@ describe Gitlab::LDAP::Person do
     subject { described_class.new(entry, 'ldapmain') }
 
     before do
-      allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(sync_ssh_keys: ssh_key_attribute_name)
+      allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(sync_ssh_keys: ssh_key_attribute_name)
     end
 
     context 'when the SSH key is literal' do

ee/spec/lib/gitlab/ldap/user_spec.rb → ee/spec/lib/gitlab/auth/ldap/user_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::User do
+describe Gitlab::Auth::LDAP::User do
   include LdapHelpers
 
   let(:ldap_user) { described_class.new(auth_hash) }
@@ -26,7 +26,7 @@ describe Gitlab::LDAP::User do
   end
 
   it 'includes the EE module' do
-    expect(described_class).to include_module(EE::Gitlab::LDAP::User)
+    expect(described_class).to include_module(EE::Gitlab::Auth::LDAP::User)
   end
 
   describe '#initialize' do

ee/spec/lib/gitlab/o_auth/auth_hash_spec.rb → ee/spec/lib/gitlab/auth/o_auth/auth_hash_spec.rb

 require 'spec_helper'
 
-describe Gitlab::OAuth::AuthHash do
+describe Gitlab::Auth::OAuth::AuthHash do
   let(:auth_hash) do
     described_class.new(
       OmniAuth::AuthHash.new(

ee/spec/lib/gitlab/o_auth/user_spec.rb → ee/spec/lib/gitlab/auth/o_auth/user_spec.rb

 require 'spec_helper'
 
-describe Gitlab::OAuth::User do
+describe Gitlab::Auth::OAuth::User do
   include LdapHelpers
 
   describe 'login through kerberos with linkable LDAP user' do

ee/spec/models/ldap_group_link_spec.rb

@@ -58,7 +58,7 @@ describe LdapGroupLink do
       end
 
       it 'defaults to the first ldap server if empty' do
-        expect( klass.new.provider ).to eql Gitlab::LDAP::Config.providers.first
+        expect( klass.new.provider ).to eql Gitlab::Auth::LDAP::Config.providers.first
       end
     end
   end

ee/spec/requests/api/ldap_spec.rb

@@ -14,8 +14,8 @@ describe API::Ldap do
       OpenStruct.new(cn: 'students')
     ]
 
-    allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
-    allow(Gitlab::LDAP::Adapter).to receive(:new).and_return(adapter)
+    allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
+    allow(Gitlab::Auth::LDAP::Adapter).to receive(:new).and_return(adapter)
     allow(adapter).to receive_messages(groups: groups)
   end
 

ee/spec/support/ee/ldap_helpers.rb

 module EE
   module LdapHelpers
     def proxy(adapter, provider = 'ldapmain')
-      EE::Gitlab::LDAP::Sync::Proxy.new(provider, adapter)
+      EE::Gitlab::Auth::LDAP::Sync::Proxy.new(provider, adapter)
     end
 
     # Stub an LDAP group search and provide the return entry. Specify `nil` for
     # `entry` to simulate when an LDAP group is not found
     #
     # Example:
-    #  adapter = ::Gitlab::LDAP::Adapter.new('ldapmain', double(:ldap))
+    #  adapter = ::Gitlab::Auth::LDAP::Adapter.new('ldapmain', double(:ldap))
     #  ldap_group1 = ldap_group_entry('uid=user,ou=users,dc=example,dc=com')
     #
     #  stub_ldap_group_find_by_cn('ldap_group1', ldap_group1, adapter)
     def stub_ldap_group_find_by_cn(cn, entry, adapter = nil)
       if entry.present?
-        return_value = EE::Gitlab::LDAP::Group.new(entry, adapter)
+        return_value = EE::Gitlab::Auth::LDAP::Group.new(entry, adapter)
       end
 
-      allow(EE::Gitlab::LDAP::Group)
+      allow(EE::Gitlab::Auth::LDAP::Group)
         .to receive(:find_by_cn)
-          .with(cn, kind_of(::Gitlab::LDAP::Adapter)).and_return(return_value)
+          .with(cn, kind_of(::Gitlab::Auth::LDAP::Adapter)).and_return(return_value)
     end
 
     # Create an LDAP group entry with any number of members. By default, creates
@@ -94,7 +94,7 @@ module EE
     # Stub Active Directory range member retrieval.
     #
     # Example:
-    #  adapter = ::Gitlab::LDAP::Adapter.new('ldapmain', double(:ldap))
+    #  adapter = ::Gitlab::Auth::LDAP::Adapter.new('ldapmain', double(:ldap))
     #  group_entry_page1 = ldap_group_entry_with_member_range(
     #    [user_dn('user1'), user_dn('user2'), user_dn('user3')],
     #    range_start: '0',
@@ -105,7 +105,7 @@ module EE
     #    range_start: '3',
     #    range_end: '*'
     #  )
-    #  group = EE::Gitlab::LDAP::Group.new(group_entry_page1, adapter)
+    #  group = EE::Gitlab::Auth::LDAP::Group.new(group_entry_page1, adapter)
     #
     #  stub_ldap_adapter_group_members_in_range(group_entry_page2, adapter, range_start: '3')
     def stub_ldap_adapter_group_members_in_range(
@@ -118,7 +118,7 @@ module EE
     end
 
     def stub_ldap_adapter_nested_groups(parent_dn, entries = [], adapter = ldap_adapter)
-      groups = entries.map { |entry| EE::Gitlab::LDAP::Group.new(entry, adapter) }
+      groups = entries.map { |entry| EE::Gitlab::Auth::LDAP::Group.new(entry, adapter) }
 
       allow(adapter).to receive(:nested_groups).with(parent_dn).and_return(groups)
     end

ee/spec/workers/ldap_all_groups_sync_worker_spec.rb

@@ -5,13 +5,13 @@ describe LdapAllGroupsSyncWorker do
 
   before do
     allow(Sidekiq.logger).to receive(:info)
-    allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+    allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
   end
 
   describe '#perform' do
     context 'with the default license key' do
       it 'syncs all groups when group_id is nil' do
-        expect(EE::Gitlab::LDAP::Sync::Groups).to receive(:execute)
+        expect(EE::Gitlab::Auth::LDAP::Sync::Groups).to receive(:execute)
 
         subject.perform
       end
@@ -23,7 +23,7 @@ describe LdapAllGroupsSyncWorker do
       end
 
       it 'does not sync all groups' do
-        expect(EE::Gitlab::LDAP::Sync::Groups).not_to receive(:execute)
+        expect(EE::Gitlab::Auth::LDAP::Sync::Groups).not_to receive(:execute)
 
         subject.perform
       end

ee/spec/workers/ldap_group_sync_worker_spec.rb

@@ -7,14 +7,14 @@ describe LdapGroupSyncWorker do
 
   def expect_fake_proxy(provider)
     fake = double
-    expect(EE::Gitlab::LDAP::Sync::Proxy)
+    expect(EE::Gitlab::Auth::LDAP::Sync::Proxy)
       .to receive(:open).with(provider).and_yield(fake)
     fake
   end
 
   before do
     allow(Sidekiq.logger).to receive(:info)
-    allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+    allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
   end
 
   describe '#perform' do
@@ -63,16 +63,16 @@ describe LdapGroupSyncWorker do
 
   describe '#sync_group' do
     it 'syncs a single provider when a provider was given' do
-      proxy = EE::Gitlab::LDAP::Sync::Proxy.new('ldapmain', ldap_adapter)
+      proxy = EE::Gitlab::Auth::LDAP::Sync::Proxy.new('ldapmain', ldap_adapter)
 
-      expect(EE::Gitlab::LDAP::Sync::Group).to receive(:execute)
+      expect(EE::Gitlab::Auth::LDAP::Sync::Group).to receive(:execute)
                                                    .with(group, proxy)
 
       subject.sync_group(group, proxy: proxy)
     end
 
     it 'syncs all providers when no proxy was given' do
-      expect(EE::Gitlab::LDAP::Sync::Group).to receive(:execute_all_providers)
+      expect(EE::Gitlab::Auth::LDAP::Sync::Group).to receive(:execute_all_providers)
                                                    .with(group)
 
       subject.sync_group(group)

ee/spec/workers/ldap_sync_worker_spec.rb

@@ -5,7 +5,7 @@ describe LdapSyncWorker do
 
   before do
     allow(Sidekiq.logger).to receive(:info)
-    allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+    allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
 
     create(:omniauth_user, provider: 'ldapmain')
   end
@@ -13,7 +13,7 @@ describe LdapSyncWorker do
   describe '#perform' do
     context 'with the default license key' do
       it 'syncs all LDAP users' do
-        expect(Gitlab::LDAP::Access).to receive(:allowed?)
+        expect(Gitlab::Auth::LDAP::Access).to receive(:allowed?)
 
         subject.perform
       end
@@ -25,7 +25,7 @@ describe LdapSyncWorker do
       end
 
       it 'does not sync LDAP users' do
-        expect(Gitlab::LDAP::Access).not_to receive(:allowed?)
+        expect(Gitlab::Auth::LDAP::Access).not_to receive(:allowed?)
 
         subject.perform
       end

lib/api/groups.rb

@@ -275,7 +275,7 @@ module API
 
       desc 'Sync a group with LDAP.'
       post ":id/ldap_sync" do
-        not_found! unless Gitlab::LDAP::Config.group_sync_enabled?
+        not_found! unless Gitlab::Auth::LDAP::Config.group_sync_enabled?
 
         group = find_group!(params[:id])
         authorize! :admin_group, group

lib/bitbucket/connection.rb

@@ -57,7 +57,7 @@ module Bitbucket
     end
 
     def provider
-      Gitlab::OAuth::Provider.config_for('bitbucket')
+      Gitlab::Auth::OAuth::Provider.config_for('bitbucket')
     end
 
     def options

lib/gitlab/auth.rb

@@ -56,7 +56,7 @@ module Gitlab
           #   LDAP users are only authenticated via LDAP
           if user.nil? || user.ldap_user?
             # Second chance - try LDAP authentication
-            Gitlab::LDAP::Authentication.login(login, password)
+            Gitlab::Auth::LDAP::Authentication.login(login, password)
           elsif Gitlab::CurrentSettings.password_authentication_enabled_for_git?
             user if user.active? && user.valid_password?(password)
           end
@@ -87,7 +87,7 @@ module Gitlab
       private
 
       def authenticate_using_internal_or_ldap_password?
-        Gitlab::CurrentSettings.password_authentication_enabled_for_git? || Gitlab::LDAP::Config.enabled?
+        Gitlab::CurrentSettings.password_authentication_enabled_for_git? || Gitlab::Auth::LDAP::Config.enabled?
       end
 
       def service_request_check(login, password, project)

lib/gitlab/auth/ldap/access.rb

+# LDAP authorization model
+#
+# * Check if we are allowed access (not blocked)
+#
+module Gitlab
+  module Auth
+    module LDAP
+      class Access
+        attr_reader :provider, :user, :ldap_identity
+
+        def self.open(user, &block)
+          Gitlab::Auth::LDAP::Adapter.open(user.ldap_identity.provider) do |adapter|
+            block.call(self.new(user, adapter))
+          end
+        end
+
+        def self.allowed?(user, options = {})
+          self.open(user) do |access|
+            # Whether user is allowed, or not, we should update
+            # permissions to keep things clean
+            if access.allowed?
+              access.update_user
+              Users::UpdateService.new(user, user: user, last_credential_check_at: Time.now).execute
+
+              true
+            else
+              false
+            end
+          end
+        end
+
+        def initialize(user, adapter = nil)
+          @adapter = adapter
+          @user = user
+          @ldap_identity = user.ldap_identity
+          @provider = adapter&.provider || @ldap_identity&.provider
+        end
+
+        def allowed?
+          if ldap_user
+            unless ldap_config.active_directory
+              unblock_user(user, 'is available again') if user.ldap_blocked?
+              return true
+            end
+
+            # Block user in GitLab if he/she was blocked in AD
+            if Gitlab::Auth::LDAP::Person.disabled_via_active_directory?(ldap_identity.extern_uid, adapter)
+              block_user(user, 'is disabled in Active Directory')
+              false
+            else
+              unblock_user(user, 'is not disabled anymore') if user.ldap_blocked?
+              true
+            end
+          else
+            # Block the user if they no longer exist in LDAP/AD
+            block_user(user, 'does not exist anymore')
+            false
+          end
+        end
+
+        def adapter
+          @adapter ||= Gitlab::Auth::LDAP::Adapter.new(provider)
+        end
+
+        def ldap_config
+          Gitlab::Auth::LDAP::Config.new(provider)
+        end
+
+        def find_ldap_user
+          return unless provider
+
+          found_user = Gitlab::Auth::LDAP::Person.find_by_dn(ldap_identity.extern_uid, adapter)
+          return found_user if found_user
+
+          if ldap_identity
+            Gitlab::Auth::LDAP::Person.find_by_email(user.email, adapter)
+          end
+        end
+
+        def ldap_user
+          @ldap_user ||= find_ldap_user
+        end
+
+        def block_user(user, reason)
+          user.ldap_block
+
+          if provider
+            Gitlab::AppLogger.info(
+              "LDAP account \"#{ldap_identity.extern_uid}\" #{reason}, " \
+              "blocking Gitlab user \"#{user.name}\" (#{user.email})"
+            )
+          else
+            Gitlab::AppLogger.info(
+              "Account is not provided by LDAP, " \
+              "blocking Gitlab user \"#{user.name}\" (#{user.email})"
+            )
+          end
+        end
+
+        def unblock_user(user, reason)
+          user.activate
+
+          Gitlab::AppLogger.info(
+            "LDAP account \"#{ldap_identity.extern_uid}\" #{reason}, " \
+            "unblocking Gitlab user \"#{user.name}\" (#{user.email})"
+          )
+        end
+
+        def update_user
+          update_email
+          update_memberships
+          update_identity
+          update_ssh_keys if sync_ssh_keys?
+          update_kerberos_identity if import_kerberos_identities?
+        end
+
+        # Update user ssh keys if they changed in LDAP
+        def update_ssh_keys
+          remove_old_ssh_keys
+          add_new_ssh_keys
+        end
+
+        # Add ssh keys that are in LDAP but not in GitLab
+        def add_new_ssh_keys
+          keys = ldap_user.ssh_keys - user.keys.ldap.pluck(:key)
+
+          keys.each do |key|
+            logger.info "#{self.class.name}: adding LDAP SSH key #{key.inspect} to #{user.name} (#{user.id})"
+            new_key = LDAPKey.new(title: "LDAP - #{ldap_config.sync_ssh_keys}", key: key)
+            new_key.user = user
+
+            unless new_key.save
+              logger.error "#{self.class.name}: failed to add LDAP SSH key #{key.inspect} to #{user.name} (#{user.id})\n"\
+                "error messages: #{new_key.errors.messages}"
+            end
+          end
+        end
+
+        # Remove ssh keys that do not exist in LDAP any more
+        def remove_old_ssh_keys
+          keys = user.keys.ldap.where.not(key: ldap_user.ssh_keys)
+
+          keys.each do |deleted_key|
+            logger.info "#{self.class.name}: removing LDAP SSH key #{deleted_key.key} from #{user.name} (#{user.id})"
+
+            unless deleted_key.destroy
+              logger.error "#{self.class.name}: failed to remove LDAP SSH key #{key.inspect} from #{user.name} (#{user.id})"
+            end
+          end
+        end
+
+        # Update user Kerberos identity with Kerberos principal name from Active Directory
+        def update_kerberos_identity
+          # there can be only one Kerberos identity in GitLab; if the user has a Kerberos identity in AD,
+          # replace any existing Kerberos identity for the user
+          return unless ldap_user.kerberos_principal.present?
+
+          kerberos_identity = user.identities.where(provider: :kerberos).first
+          return if kerberos_identity && kerberos_identity.extern_uid == ldap_user.kerberos_principal
+
+          kerberos_identity ||= Identity.new(provider: :kerberos, user: user)
+          kerberos_identity.extern_uid = ldap_user.kerberos_principal
+          unless kerberos_identity.save
+            Rails.logger.error "#{self.class.name}: failed to add Kerberos principal #{principal} to #{user.name} (#{user.id})\n"\
+              "error messages: #{new_identity.errors.messages}"
+          end
+        end
+
+        # Update user email if it changed in LDAP
+        def update_email
+          return false unless ldap_user.try(:email)
+
+          ldap_email = ldap_user.email.last.to_s.downcase
+
+          return false if user.email == ldap_email
+
+          Users::UpdateService.new(user, user: user, email: ldap_email).execute do |user|
+            user.skip_reconfirmation!
+          end
+        end
+
+        def update_identity
+          return if ldap_user.dn.empty? || ldap_user.dn == ldap_identity.extern_uid
+
+          unless ldap_identity.update(extern_uid: ldap_user.dn)
+            Rails.logger.error "Could not update DN for #{user.name} (#{user.id})\n"\
+                               "error messages: #{user.ldap_identity.errors.messages}"
+          end
+        end
+
+        delegate :sync_ssh_keys?, to: :ldap_config
+
+        def import_kerberos_identities?
+          # Kerberos may be enabled for Git HTTP access and/or as an Omniauth provider
+          ldap_config.active_directory && (Gitlab.config.kerberos.enabled || AuthHelper.kerberos_enabled? )
+        end
+
+        def update_memberships
+          return if ldap_user.nil? || ldap_user.group_cns.empty?
+
+          group_ids = LdapGroupLink.where(cn: ldap_user.group_cns, provider: provider)
+                        .distinct(:group_id)
+                        .pluck(:group_id)
+
+          LdapGroupSyncWorker.perform_async(group_ids, provider) if group_ids.any?
+        end
+
+        private
+
+        def logger
+          Rails.logger
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/ldap/adapter.rb

+module Gitlab
+  module Auth
+    module LDAP
+      class Adapter
+        prepend ::EE::Gitlab::Auth::LDAP::Adapter
+
+        attr_reader :provider, :ldap
+
+        def self.open(provider, &block)
+          Net::LDAP.open(config(provider).adapter_options) do |ldap|
+            block.call(self.new(provider, ldap))
+          end
+        end
+
+        def self.config(provider)
+          Gitlab::Auth::LDAP::Config.new(provider)
+        end
+
+        def initialize(provider, ldap = nil)
+          @provider = provider
+          @ldap = ldap || Net::LDAP.new(config.adapter_options)
+        end
+
+        def config
+          Gitlab::Auth::LDAP::Config.new(provider)
+        end
+
+        def users(fields, value, limit = nil)
+          options = user_options(Array(fields), value, limit)
+
+          entries = ldap_search(options).select do |entry|
+            entry.respond_to? config.uid
+          end
+
+          entries.map do |entry|
+            Gitlab::Auth::LDAP::Person.new(entry, provider)
+          end
+        end
+
+        def user(*args)
+          users(*args).first
+        end
+
+        def dn_matches_filter?(dn, filter)
+          ldap_search(base: dn,
+                      filter: filter,
+                      scope: Net::LDAP::SearchScope_BaseObject,
+                      attributes: %w{dn}).any?
+        end
+
+        def ldap_search(*args)
+          # Net::LDAP's `time` argument doesn't work. Use Ruby `Timeout` instead.
+          Timeout.timeout(config.timeout) do
+            results = ldap.search(*args)
+
+            if results.nil?
+              response = ldap.get_operation_result
+
+              unless response.code.zero?
+                Rails.logger.warn("LDAP search error: #{response.message}")
+              end
+
+              []
+            else
+              results
+            end
+          end
+        rescue Net::LDAP::Error => error
+          Rails.logger.warn("LDAP search raised exception #{error.class}: #{error.message}")
+          []
+        rescue Timeout::Error
+          Rails.logger.warn("LDAP search timed out after #{config.timeout} seconds")
+          []
+        end
+
+        private
+
+        def user_options(fields, value, limit)
+          options = {
+            attributes: Gitlab::Auth::LDAP::Person.ldap_attributes(config),
+            base: config.base
+          }
+
+          options[:size] = limit if limit
+
+          if fields.include?('dn')
+            raise ArgumentError, 'It is not currently possible to search the DN and other fields at the same time.' if fields.size > 1
+
+            options[:base] = value
+            options[:scope] = Net::LDAP::SearchScope_BaseObject
+          else
+            filter = fields.map { |field| Net::LDAP::Filter.eq(field, value) }.inject(:|)
+          end
+
+          options.merge(filter: user_filter(filter))
+        end
+
+        def user_filter(filter = nil)
+          user_filter = config.constructed_user_filter if config.user_filter.present?
+
+          if user_filter && filter
+            Net::LDAP::Filter.join(filter, user_filter)
+          elsif user_filter
+            user_filter
+          else
+            filter
+          end
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/ldap/auth_hash.rb

+# Class to parse and transform the info provided by omniauth
+#
+module Gitlab
+  module Auth
+    module LDAP
+      class AuthHash < Gitlab::Auth::OAuth::AuthHash
+        def uid
+          @uid ||= Gitlab::Auth::LDAP::Person.normalize_dn(super)
+        end
+
+        def username
+          super.tap do |username|
+            username.downcase! if ldap_config.lowercase_usernames
+          end
+        end
+
+        private
+
+        def get_info(key)
+          attributes = ldap_config.attributes[key.to_s]
+          return super unless attributes
+
+          attributes = Array(attributes)
+
+          value = nil
+          attributes.each do |attribute|
+            value = get_raw(attribute)
+            value = value.first if value
+            break if value.present?
+          end
+
+          return super unless value
+
+          Gitlab::Utils.force_utf8(value)
+          value
+        end
+
+        def get_raw(key)
+          auth_hash.extra[:raw_info][key] if auth_hash.extra
+        end
+
+        def ldap_config
+          @ldap_config ||= Gitlab::Auth::LDAP::Config.new(self.provider)
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/ldap/authentication.rb

+# These calls help to authenticate to LDAP by providing username and password
+#
+# Since multiple LDAP servers are supported, it will loop through all of them
+# until a valid bind is found
+#
+
+module Gitlab
+  module Auth
+    module LDAP
+      class Authentication
+        def self.login(login, password)
+          return unless Gitlab::Auth::LDAP::Config.enabled?
+          return unless login.present? && password.present?
+
+          auth = nil
+          # loop through providers until valid bind
+          providers.find do |provider|
+            auth = new(provider)
+            auth.login(login, password) # true will exit the loop
+          end
+
+          # If (login, password) was invalid for all providers, the value of auth is now the last
+          # Gitlab::Auth::LDAP::Authentication instance we tried.
+          auth.user
+        end
+
+        def self.providers
+          Gitlab::Auth::LDAP::Config.providers
+        end
+
+        attr_accessor :provider, :ldap_user
+
+        def initialize(provider)
+          @provider = provider
+        end
+
+        def login(login, password)
+          @ldap_user = adapter.bind_as(
+            filter: user_filter(login),
+            size: 1,
+            password: password
+          )
+        end
+
+        def adapter
+          OmniAuth::LDAP::Adaptor.new(config.omniauth_options)
+        end
+
+        def config
+          Gitlab::Auth::LDAP::Config.new(provider)
+        end
+
+        def user_filter(login)
+          filter = Net::LDAP::Filter.equals(config.uid, login)
+
+          # Apply LDAP user filter if present
+          if config.user_filter.present?
+            filter = Net::LDAP::Filter.join(filter, config.constructed_user_filter)
+          end
+
+          filter
+        end
+
+        def user
+          return nil unless ldap_user
+
+          Gitlab::Auth::LDAP::User.find_by_uid_and_provider(ldap_user.dn, provider)
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/ldap/config.rb

+# Load a specific server configuration
+module Gitlab
+  module Auth
+    module LDAP
+      class Config
+        include ::EE::Gitlab::Auth::LDAP::Config
+
+        NET_LDAP_ENCRYPTION_METHOD = {
+          simple_tls: :simple_tls,
+          start_tls:  :start_tls,
+          plain:      nil
+        }.freeze
+
+        attr_accessor :provider, :options
+
+        InvalidProvider = Class.new(StandardError)
+
+        def self.enabled?
+          Gitlab.config.ldap.enabled
+        end
+
+        def self.servers
+          Gitlab.config.ldap['servers']&.values || []
+        end
+
+        def self.available_servers
+          return [] unless enabled?
+
+          ::License.feature_available?(:multiple_ldap_servers) ? servers : Array.wrap(servers.first)
+        end
+
+        def self.providers
+          servers.map { |server| server['provider_name'] }
+        end
+
+        def self.valid_provider?(provider)
+          providers.include?(provider)
+        end
+
+        def self.invalid_provider(provider)
+          raise InvalidProvider.new("Unknown provider (#{provider}). Available providers: #{providers}")
+        end
+
+        def initialize(provider)
+          if self.class.valid_provider?(provider)
+            @provider = provider
+          else
+            self.class.invalid_provider(provider)
+          end
+
+          @options = config_for(@provider) # Use @provider, not provider
+        end
+
+        def enabled?
+          base_config.enabled
+        end
+
+        def adapter_options
+          opts = base_options.merge(
+            encryption: encryption_options
+          )
+
+          opts.merge!(auth_options) if has_auth?
+
+          opts
+        end
+
+        def omniauth_options
+          opts = base_options.merge(
+            base: base,
+            encryption: options['encryption'],
+            filter: omniauth_user_filter,
+            name_proc: name_proc,
+            disable_verify_certificates: !options['verify_certificates']
+          )
+
+          if has_auth?
+            opts.merge!(
+              bind_dn: options['bind_dn'],
+              password: options['password']
+            )
+          end
+
+          opts[:ca_file] = options['ca_file'] if options['ca_file'].present?
+          opts[:ssl_version] = options['ssl_version'] if options['ssl_version'].present?
+
+          opts
+        end
+
+        def base
+          @base ||= Person.normalize_dn(options['base'])
+        end
+
+        def uid
+          options['uid']
+        end
+
+        def label
+          options['label']
+        end
+
+        def sync_ssh_keys?
+          sync_ssh_keys.present?
+        end
+
+        # The LDAP attribute in which the ssh keys are stored
+        def sync_ssh_keys
+          options['sync_ssh_keys']
+        end
+
+        def user_filter
+          options['user_filter']
+        end
+
+        def constructed_user_filter
+          @constructed_user_filter ||= Net::LDAP::Filter.construct(user_filter)
+        end
+
+        def group_base
+          options['group_base']
+        end
+
+        def admin_group
+          options['admin_group']
+        end
+
+        def active_directory
+          options['active_directory']
+        end
+
+        def block_auto_created_users
+          options['block_auto_created_users']
+        end
+
+        def attributes
+          default_attributes.merge(options['attributes'])
+        end
+
+        def timeout
+          options['timeout'].to_i
+        end
+
+        def external_groups
+          options['external_groups']
+        end
+
+        def has_auth?
+          options['password'] || options['bind_dn']
+        end
+
+        def allow_username_or_email_login
+          options['allow_username_or_email_login']
+        end
+
+        def lowercase_usernames
+          options['lowercase_usernames']
+        end
+
+        def name_proc
+          if allow_username_or_email_login
+            proc { |name| name.gsub(/@.*\z/, '') }
+          else
+            proc { |name| name }
+          end
+        end
+
+        def default_attributes
+          {
+            'username'    => %w(uid sAMAccountName userid),
+            'email'       => %w(mail email userPrincipalName),
+            'name'        => 'cn',
+            'first_name'  => 'givenName',
+            'last_name'   => 'sn'
+          }
+        end
+
+        protected
+
+        def base_options
+          {
+            host: options['host'],
+            port: options['port']
+          }
+        end
+
+        def base_config
+          Gitlab.config.ldap
+        end
+
+        def config_for(provider)
+          base_config.servers.values.find { |server| server['provider_name'] == provider }
+        end
+
+        def encryption_options
+          method = translate_method(options['encryption'])
+          return nil unless method
+
+          {
+            method: method,
+            tls_options: tls_options(method)
+          }
+        end
+
+        def translate_method(method_from_config)
+          NET_LDAP_ENCRYPTION_METHOD[method_from_config.to_sym]
+        end
+
+        def tls_options(method)
+          return { verify_mode: OpenSSL::SSL::VERIFY_NONE } unless method
+
+          opts = if options['verify_certificates']
+                   OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
+                 else
+                   # It is important to explicitly set verify_mode for two reasons:
+                   # 1. The behavior of OpenSSL is undefined when verify_mode is not set.
+                   # 2. The net-ldap gem implementation verifies the certificate hostname
+                   #    unless verify_mode is set to VERIFY_NONE.
+                   { verify_mode: OpenSSL::SSL::VERIFY_NONE }
+                 end
+
+          opts[:ca_file] = options['ca_file'] if options['ca_file'].present?
+          opts[:ssl_version] = options['ssl_version'] if options['ssl_version'].present?
+
+          opts
+        end
+
+        def auth_options
+          {
+            auth: {
+              method: :simple,
+              username: options['bind_dn'],
+              password: options['password']
+            }
+          }
+        end
+
+        def omniauth_user_filter
+          uid_filter = Net::LDAP::Filter.eq(uid, '%{username}')
+
+          if user_filter.present?
+            Net::LDAP::Filter.join(uid_filter, constructed_user_filter).to_s
+          else
+            uid_filter.to_s
+          end
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/ldap/dn.rb

+# -*- ruby encoding: utf-8 -*-
+
+# Based on the `ruby-net-ldap` gem's `Net::LDAP::DN`
+#
+# For our purposes, this class is used to normalize DNs in order to allow proper
+# comparison.
+#
+# E.g. DNs should be compared case-insensitively (in basically all LDAP
+# implementations or setups), therefore we downcase every DN.
+
+##
+# Objects of this class represent an LDAP DN ("Distinguished Name"). A DN
+# ("Distinguished Name") is a unique identifier for an entry within an LDAP
+# directory. It is made up of a number of other attributes strung together,
+# to identify the entry in the tree.
+#
+# Each attribute that makes up a DN needs to have its value escaped so that
+# the DN is valid. This class helps take care of that.
+#
+# A fully escaped DN needs to be unescaped when analysing its contents. This
+# class also helps take care of that.
+module Gitlab
+  module Auth
+    module LDAP
+      class DN
+        FormatError = Class.new(StandardError)
+        MalformedError = Class.new(FormatError)
+        UnsupportedError = Class.new(FormatError)
+
+        def self.normalize_value(given_value)
+          dummy_dn = "placeholder=#{given_value}"
+          normalized_dn = new(*dummy_dn).to_normalized_s
+          normalized_dn.sub(/\Aplaceholder=/, '')
+        end
+
+        ##
+        # Initialize a DN, escaping as required. Pass in attributes in name/value
+        # pairs. If there is a left over argument, it will be appended to the dn
+        # without escaping (useful for a base string).
+        #
+        # Most uses of this class will be to escape a DN, rather than to parse it,
+        # so storing the dn as an escaped String and parsing parts as required
+        # with a state machine seems sensible.
+        def initialize(*args)
+          if args.length > 1
+            initialize_array(args)
+          else
+            initialize_string(args[0])
+          end
+        end
+
+        ##
+        # Parse a DN into key value pairs using ASN from
+        # http://tools.ietf.org/html/rfc2253 section 3.
+        # rubocop:disable Metrics/AbcSize
+        # rubocop:disable Metrics/CyclomaticComplexity
+        # rubocop:disable Metrics/PerceivedComplexity
+        def each_pair
+          state = :key
+          key = StringIO.new
+          value = StringIO.new
+          hex_buffer = ""
+
+          @dn.each_char.with_index do |char, dn_index|
+            case state
+            when :key then
+              case char
+              when 'a'..'z', 'A'..'Z' then
+                state = :key_normal
+                key << char
+              when '0'..'9' then
+                state = :key_oid
+                key << char
+              when ' ' then state = :key
+              else raise(MalformedError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
+              end
+            when :key_normal then
+              case char
+              when '=' then state = :value
+              when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
+              else raise(MalformedError, "Unrecognized RDN attribute type name character \"#{char}\"")
+              end
+            when :key_oid then
+              case char
+              when '=' then state = :value
+              when '0'..'9', '.', ' ' then key << char
+              else raise(MalformedError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
+              end
+            when :value then
+              case char
+              when '\\' then state = :value_normal_escape
+              when '"' then state = :value_quoted
+              when ' ' then state = :value
+              when '#' then
+                state = :value_hexstring
+                value << char
+              when ',' then
+                state = :key
+                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
+                key = StringIO.new
+                value = StringIO.new
+              else
+                state = :value_normal
+                value << char
+              end
+            when :value_normal then
+              case char
+              when '\\' then state = :value_normal_escape
+              when ',' then
+                state = :key
+                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
+                key = StringIO.new
+                value = StringIO.new
+              when '+' then raise(UnsupportedError, "Multivalued RDNs are not supported")
+              else value << char
+              end
+            when :value_normal_escape then
+              case char
+              when '0'..'9', 'a'..'f', 'A'..'F' then
+                state = :value_normal_escape_hex
+                hex_buffer = char
+              else
+                state = :value_normal
+                value << char
+              end
+            when :value_normal_escape_hex then
+              case char
+              when '0'..'9', 'a'..'f', 'A'..'F' then
+                state = :value_normal
+                value << "#{hex_buffer}#{char}".to_i(16).chr
+              else raise(MalformedError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
+              end
+            when :value_quoted then
+              case char
+              when '\\' then state = :value_quoted_escape
+              when '"' then state = :value_end
+              else value << char
+              end
+            when :value_quoted_escape then
+              case char
+              when '0'..'9', 'a'..'f', 'A'..'F' then
+                state = :value_quoted_escape_hex
+                hex_buffer = char
+              else
+                state = :value_quoted
+                value << char
+              end
+            when :value_quoted_escape_hex then
+              case char
+              when '0'..'9', 'a'..'f', 'A'..'F' then
+                state = :value_quoted
+                value << "#{hex_buffer}#{char}".to_i(16).chr
+              else raise(MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
+              end
+            when :value_hexstring then
+              case char
+              when '0'..'9', 'a'..'f', 'A'..'F' then
+                state = :value_hexstring_hex
+                value << char
+              when ' ' then state = :value_end
+              when ',' then
+                state = :key
+                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
+                key = StringIO.new
+                value = StringIO.new
+              else raise(MalformedError, "Expected the first character of a hex pair, but got \"#{char}\"")
+              end
+            when :value_hexstring_hex then
+              case char
+              when '0'..'9', 'a'..'f', 'A'..'F' then
+                state = :value_hexstring
+                value << char
+              else raise(MalformedError, "Expected the second character of a hex pair, but got \"#{char}\"")
+              end
+            when :value_end then
+              case char
+              when ' ' then state = :value_end
+              when ',' then
+                state = :key
+                yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
+                key = StringIO.new
+                value = StringIO.new
+              else raise(MalformedError, "Expected the end of an attribute value, but got \"#{char}\"")
+              end
+            else raise "Fell out of state machine"
+            end
+          end
+
+          # Last pair
+          raise(MalformedError, 'DN string ended unexpectedly') unless
+            [:value, :value_normal, :value_hexstring, :value_end].include? state
+
+          yield key.string.strip, rstrip_except_escaped(value.string, @dn.length)
+        end
+
+        def rstrip_except_escaped(str, dn_index)
+          str_ends_with_whitespace = str.match(/\s\z/)
+
+          if str_ends_with_whitespace
+            dn_part_ends_with_escaped_whitespace = @dn[0, dn_index].match(/\\(\s+)\z/)
+
+            if dn_part_ends_with_escaped_whitespace
+              dn_part_rwhitespace = dn_part_ends_with_escaped_whitespace[1]
+              num_chars_to_remove = dn_part_rwhitespace.length - 1
+              str = str[0, str.length - num_chars_to_remove]
+            else
+              str.rstrip!
+            end
+          end
+
+          str
+        end
+
+        ##
+        # Returns the DN as an array in the form expected by the constructor.
+        def to_a
+          a = []
+          self.each_pair { |key, value| a << key << value } unless @dn.empty?
+          a
+        end
+
+        ##
+        # Return the DN as an escaped string.
+        def to_s
+          @dn
+        end
+
+        ##
+        # Return the DN as an escaped and normalized string.
+        def to_normalized_s
+          self.class.new(*to_a).to_s.downcase
+        end
+
+        # https://tools.ietf.org/html/rfc4514 section 2.4 lists these exceptions
+        # for DN values. All of the following must be escaped in any normal string
+        # using a single backslash ('\') as escape. The space character is left
+        # out here because in a "normalized" string, spaces should only be escaped
+        # if necessary (i.e. leading or trailing space).
+        NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '='].freeze
+
+        # The following must be represented as escaped hex
+        HEX_ESCAPES = {
+          "\n" => '\0a',
+          "\r" => '\0d'
+        }.freeze
+
+        # Compiled character class regexp using the keys from the above hash, and
+        # checking for a space or # at the start, or space at the end, of the
+        # string.
+        ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
+                              NORMAL_ESCAPES.map { |e| Regexp.escape(e) }.join +
+                              "])")
+
+        HEX_ESCAPE_RE = Regexp.new("([" +
+                              HEX_ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
+                              "])")
+
+        ##
+        # Escape a string for use in a DN value
+        def self.escape(string)
+          escaped = string.gsub(ESCAPE_RE) { |char| "\\" + char }
+          escaped.gsub(HEX_ESCAPE_RE) { |char| HEX_ESCAPES[char] }
+        end
+
+        private
+
+        def initialize_array(args)
+          buffer = StringIO.new
+
+          args.each_with_index do |arg, index|
+            if index.even? # key
+              buffer << "," if index > 0
+              buffer << arg
+            else # value
+              buffer << "="
+              buffer << self.class.escape(arg)
+            end
+          end
+
+          @dn = buffer.string
+        end
+
+        def initialize_string(arg)
+          @dn = arg.to_s
+        end
+
+        ##
+        # Proxy all other requests to the string object, because a DN is mainly
+        # used within the library as a string
+        # rubocop:disable GitlabSecurity/PublicSend
+        def method_missing(method, *args, &block)
+          @dn.send(method, *args, &block)
+        end
+
+        ##
+        # Redefined to be consistent with redefined `method_missing` behavior
+        def respond_to?(sym, include_private = false)
+          @dn.respond_to?(sym, include_private)
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/ldap/person.rb

+# Contains methods common to both GitLab CE and EE.
+# All EE methods should be in `EE::Gitlab::Auth::LDAP::Person` only.
+module Gitlab
+  module Auth
+    module LDAP
+      class Person
+        prepend ::EE::Gitlab::Auth::LDAP::Person
+
+        # Active Directory-specific LDAP filter that checks if bit 2 of the
+        # userAccountControl attribute is set.
+        # Source: http://ctogonewild.com/2009/09/03/bitmask-searches-in-ldap/
+        AD_USER_DISABLED = Net::LDAP::Filter.ex("userAccountControl:1.2.840.113556.1.4.803", "2")
+
+        InvalidEntryError = Class.new(StandardError)
+
+        attr_accessor :entry, :provider
+
+        def self.find_by_uid(uid, adapter)
+          uid = Net::LDAP::Filter.escape(uid)
+          adapter.user(adapter.config.uid, uid)
+        end
+
+        def self.find_by_dn(dn, adapter)
+          adapter.user('dn', dn)
+        end
+
+        def self.find_by_email(email, adapter)
+          email_fields = adapter.config.attributes['email']
+
+          adapter.user(email_fields, email)
+        end
+
+        def self.disabled_via_active_directory?(dn, adapter)
+          adapter.dn_matches_filter?(dn, AD_USER_DISABLED)
+        end
+
+        def self.ldap_attributes(config)
+          [
+            'dn',
+            config.uid,
+            *config.attributes['name'],
+            *config.attributes['email'],
+            *config.attributes['username']
+          ].compact.uniq
+        end
+
+        def self.normalize_dn(dn)
+          ::Gitlab::Auth::LDAP::DN.new(dn).to_normalized_s
+        rescue ::Gitlab::Auth::LDAP::DN::FormatError => e
+          Rails.logger.info("Returning original DN \"#{dn}\" due to error during normalization attempt: #{e.message}")
+
+          dn
+        end
+
+        # Returns the UID in a normalized form.
+        #
+        # 1. Excess spaces are stripped
+        # 2. The string is downcased (for case-insensitivity)
+        def self.normalize_uid(uid)
+          ::Gitlab::Auth::LDAP::DN.normalize_value(uid)
+        rescue ::Gitlab::Auth::LDAP::DN::FormatError => e
+          Rails.logger.info("Returning original UID \"#{uid}\" due to error during normalization attempt: #{e.message}")
+
+          uid
+        end
+
+        def initialize(entry, provider)
+          Rails.logger.debug { "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}" }
+          @entry = entry
+          @provider = provider
+        end
+
+        def name
+          attribute_value(:name).first
+        end
+
+        def uid
+          entry.public_send(config.uid).first # rubocop:disable GitlabSecurity/PublicSend
+        end
+
+        def username
+          username = attribute_value(:username)
+
+          # Depending on the attribute, multiple values may
+          # be returned. We need only one for username.
+          # Ex. `uid` returns only one value but `mail` may
+          # return an array of multiple email addresses.
+          [username].flatten.first.tap do |username|
+            username.downcase! if config.lowercase_usernames
+          end
+        end
+
+        def email
+          attribute_value(:email)
+        end
+
+        def dn
+          self.class.normalize_dn(entry.dn)
+        end
+
+        private
+
+        def entry
+          @entry
+        end
+
+        def config
+          @config ||= Gitlab::Auth::LDAP::Config.new(provider)
+        end
+
+        # Using the LDAP attributes configuration, find and return the first
+        # attribute with a value. For example, by default, when given 'email',
+        # this method looks for 'mail', 'email' and 'userPrincipalName' and
+        # returns the first with a value.
+        def attribute_value(attribute)
+          attributes = Array(config.attributes[attribute.to_s])
+          selected_attr = attributes.find { |attr| entry.respond_to?(attr) }
+
+          return nil unless selected_attr
+
+          entry.public_send(selected_attr) # rubocop:disable GitlabSecurity/PublicSend
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/ldap/user.rb

+# LDAP extension for User model
+#
+# * Find or create user from omniauth.auth data
+# * Links LDAP account with existing user
+# * Auth LDAP user with login and password
+#
+module Gitlab
+  module Auth
+    module LDAP
+      class User < Gitlab::Auth::OAuth::User
+        prepend ::EE::Gitlab::Auth::LDAP::User
+
+        class << self
+          def find_by_uid_and_provider(uid, provider)
+            identity = ::Identity.with_extern_uid(provider, uid).take
+
+            identity && identity.user
+          end
+        end
+
+        def save
+          super('LDAP')
+        end
+
+        # instance methods
+        def find_user
+          find_by_uid_and_provider || find_by_email || build_new_user
+        end
+
+        def find_by_uid_and_provider
+          self.class.find_by_uid_and_provider(auth_hash.uid, auth_hash.provider)
+        end
+
+        def changed?
+          gl_user.changed? || gl_user.identities.any?(&:changed?)
+        end
+
+        def block_after_signup?
+          ldap_config.block_auto_created_users
+        end
+
+        def allowed?
+          Gitlab::Auth::LDAP::Access.allowed?(gl_user)
+        end
+
+        def ldap_config
+          Gitlab::Auth::LDAP::Config.new(auth_hash.provider)
+        end
+
+        def auth_hash=(auth_hash)
+          @auth_hash = Gitlab::Auth::LDAP::AuthHash.new(auth_hash)
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/o_auth/auth_hash.rb

+# Class to parse and transform the info provided by omniauth
+#
+module Gitlab
+  module Auth
+    module OAuth
+      class AuthHash
+        prepend ::EE::Gitlab::Auth::OAuth::AuthHash
+
+        attr_reader :auth_hash
+        def initialize(auth_hash)
+          @auth_hash = auth_hash
+        end
+
+        def uid
+          @uid ||= Gitlab::Utils.force_utf8(auth_hash.uid.to_s)
+        end
+
+        def provider
+          @provider ||= auth_hash.provider.to_s
+        end
+
+        def name
+          @name ||= get_info(:name) || "#{get_info(:first_name)} #{get_info(:last_name)}"
+        end
+
+        def username
+          @username ||= username_and_email[:username].to_s
+        end
+
+        def email
+          @email ||= username_and_email[:email].to_s
+        end
+
+        def password
+          @password ||= Gitlab::Utils.force_utf8(Devise.friendly_token[0, 8].downcase)
+        end
+
+        def location
+          location = get_info(:address)
+          if location.is_a?(Hash)
+            [location.locality.presence, location.country.presence].compact.join(', ')
+          else
+            location
+          end
+        end
+
+        def has_attribute?(attribute)
+          if attribute == :location
+            get_info(:address).present?
+          else
+            get_info(attribute).present?
+          end
+        end
+
+        private
+
+        def info
+          auth_hash.info
+        end
+
+        def get_info(key)
+          value = info[key]
+          Gitlab::Utils.force_utf8(value) if value
+          value
+        end
+
+        def username_and_email
+          @username_and_email ||= begin
+            username  = get_info(:username).presence || get_info(:nickname).presence
+            email     = get_info(:email).presence
+
+            username ||= generate_username(email)             if email
+            email    ||= generate_temporarily_email(username) if username
+
+            {
+              username: username,
+              email:    email
+            }
+          end
+        end
+
+        # Get the first part of the email address (before @)
+        # In addtion in removes illegal characters
+        def generate_username(email)
+          email.match(/^[^@]*/)[0].mb_chars.normalize(:kd).gsub(/[^\x00-\x7F]/, '').to_s
+        end
+
+        def generate_temporarily_email(username)
+          "temp-email-for-oauth-#{username}@gitlab.localhost"
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/o_auth/provider.rb

+module Gitlab
+  module Auth
+    module OAuth
+      class Provider
+        LABELS = {
+          "github"         => "GitHub",
+          "gitlab"         => "GitLab.com",
+          "google_oauth2"  => "Google"
+        }.freeze
+
+        def self.providers
+          Devise.omniauth_providers
+        end
+
+        def self.enabled?(name)
+          providers.include?(name.to_sym)
+        end
+
+        def self.ldap_provider?(name)
+          name.to_s.start_with?('ldap')
+        end
+
+        def self.sync_profile_from_provider?(provider)
+          return true if ldap_provider?(provider)
+
+          providers = Gitlab.config.omniauth.sync_profile_from_provider
+
+          if providers.is_a?(Array)
+            providers.include?(provider)
+          else
+            providers
+          end
+        end
+
+        def self.config_for(name)
+          name = name.to_s
+          if ldap_provider?(name)
+            if Gitlab::Auth::LDAP::Config.valid_provider?(name)
+              Gitlab::Auth::LDAP::Config.new(name).options
+            else
+              nil
+            end
+          else
+            Gitlab.config.omniauth.providers.find { |provider| provider.name == name }
+          end
+        end
+
+        def self.label_for(name)
+          name = name.to_s
+          config = config_for(name)
+          (config && config['label']) || LABELS[name] || name.titleize
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/o_auth/session.rb

+# :nocov:
+module Gitlab
+  module Auth
+    module OAuth
+      module Session
+        def self.create(provider, ticket)
+          Rails.cache.write("gitlab:#{provider}:#{ticket}", ticket, expires_in: Gitlab.config.omniauth.cas3.session_duration)
+        end
+
+        def self.destroy(provider, ticket)
+          Rails.cache.delete("gitlab:#{provider}:#{ticket}")
+        end
+
+        def self.valid?(provider, ticket)
+          Rails.cache.read("gitlab:#{provider}:#{ticket}").present?
+        end
+      end
+    end
+  end
+end
+# :nocov:

lib/gitlab/auth/o_auth/user.rb

+# OAuth extension for User model
+#
+# * Find GitLab user based on omniauth uid and provider
+# * Create new user from omniauth data
+#
+module Gitlab
+  module Auth
+    module OAuth
+      class User
+        prepend ::EE::Gitlab::Auth::OAuth::User
+
+        SignupDisabledError = Class.new(StandardError)
+        SigninDisabledForProviderError = Class.new(StandardError)
+
+        attr_accessor :auth_hash, :gl_user
+
+        def initialize(auth_hash)
+          self.auth_hash = auth_hash
+          update_profile
+          add_or_update_user_identities
+        end
+
+        def persisted?
+          gl_user.try(:persisted?)
+        end
+
+        def new?
+          !persisted?
+        end
+
+        def valid?
+          gl_user.try(:valid?)
+        end
+
+        def save(provider = 'OAuth')
+          raise SigninDisabledForProviderError if oauth_provider_disabled?
+          raise SignupDisabledError unless gl_user
+
+          block_after_save = needs_blocking?
+
+          Users::UpdateService.new(gl_user, user: gl_user).execute!
+
+          gl_user.block if block_after_save
+
+          log.info "(#{provider}) saving user #{auth_hash.email} from login with extern_uid => #{auth_hash.uid}"
+          gl_user
+        rescue ActiveRecord::RecordInvalid => e
+          log.info "(#{provider}) Error saving user #{auth_hash.uid} (#{auth_hash.email}): #{gl_user.errors.full_messages}"
+          return self, e.record.errors
+        end
+
+        def gl_user
+          return @gl_user if defined?(@gl_user)
+
+          @gl_user = find_user
+        end
+
+        def find_user
+          user = find_by_uid_and_provider
+
+          user ||= find_or_build_ldap_user if auto_link_ldap_user?
+          user ||= build_new_user if signup_enabled?
+
+          user.external = true if external_provider? && user&.new_record?
+
+          user
+        end
+
+        protected
+
+        def add_or_update_user_identities
+          return unless gl_user
+
+          # find_or_initialize_by doesn't update `gl_user.identities`, and isn't autosaved.
+          identity = gl_user.identities.find { |identity| identity.provider == auth_hash.provider }
+
+          identity ||= gl_user.identities.build(provider: auth_hash.provider)
+          identity.extern_uid = auth_hash.uid
+
+          if auto_link_ldap_user? && !gl_user.ldap_user? && ldap_person
+            log.info "Correct LDAP account has been found. identity to user: #{gl_user.username}."
+            gl_user.identities.build(provider: ldap_person.provider, extern_uid: ldap_person.dn)
+          end
+        end
+
+        def find_or_build_ldap_user
+          return unless ldap_person
+
+          user = Gitlab::Auth::LDAP::User.find_by_uid_and_provider(ldap_person.dn, ldap_person.provider)
+          if user
+            log.info "LDAP account found for user #{user.username}. Building new #{auth_hash.provider} identity."
+            return user
+          end
+
+          log.info "No user found using #{auth_hash.provider} provider. Creating a new one."
+          build_new_user
+        end
+
+        def find_by_email
+          return unless auth_hash.has_attribute?(:email)
+
+          ::User.find_by(email: auth_hash.email.downcase)
+        end
+
+        def auto_link_ldap_user?
+          Gitlab.config.omniauth.auto_link_ldap_user
+        end
+
+        def creating_linked_ldap_user?
+          auto_link_ldap_user? && ldap_person
+        end
+
+        def ldap_person
+          return @ldap_person if defined?(@ldap_person)
+
+          # Look for a corresponding person with same uid in any of the configured LDAP providers
+          Gitlab::Auth::LDAP::Config.providers.each do |provider|
+            adapter = Gitlab::Auth::LDAP::Adapter.new(provider)
+            @ldap_person = find_ldap_person(auth_hash, adapter)
+            break if @ldap_person
+          end
+          @ldap_person
+        end
+
+        def find_ldap_person(auth_hash, adapter)
+          Gitlab::Auth::LDAP::Person.find_by_uid(auth_hash.uid, adapter) ||
+            Gitlab::Auth::LDAP::Person.find_by_email(auth_hash.uid, adapter) ||
+            Gitlab::Auth::LDAP::Person.find_by_dn(auth_hash.uid, adapter)
+        end
+
+        def ldap_config
+          Gitlab::Auth::LDAP::Config.new(ldap_person.provider) if ldap_person
+        end
+
+        def needs_blocking?
+          new? && block_after_signup?
+        end
+
+        def signup_enabled?
+          providers = Gitlab.config.omniauth.allow_single_sign_on
+          if providers.is_a?(Array)
+            providers.include?(auth_hash.provider)
+          else
+            providers
+          end
+        end
+
+        def external_provider?
+          Gitlab.config.omniauth.external_providers.include?(auth_hash.provider)
+        end
+
+        def block_after_signup?
+          if creating_linked_ldap_user?
+            ldap_config.block_auto_created_users
+          else
+            Gitlab.config.omniauth.block_auto_created_users
+          end
+        end
+
+        def auth_hash=(auth_hash)
+          @auth_hash = AuthHash.new(auth_hash)
+        end
+
+        def find_by_uid_and_provider
+          identity = Identity.with_extern_uid(auth_hash.provider, auth_hash.uid).take
+          identity && identity.user
+        end
+
+        def build_new_user
+          user_params = user_attributes.merge(skip_confirmation: true)
+          Users::BuildService.new(nil, user_params).execute(skip_authorization: true)
+        end
+
+        def user_attributes
+          # Give preference to LDAP for sensitive information when creating a linked account
+          if creating_linked_ldap_user?
+            username = ldap_person.username.presence
+            email = ldap_person.email.first.presence
+          end
+
+          username ||= auth_hash.username
+          email ||= auth_hash.email
+
+          valid_username = ::Namespace.clean_path(username)
+
+          uniquify = Uniquify.new
+          valid_username = uniquify.string(valid_username) { |s| !NamespacePathValidator.valid_path?(s) }
+
+          name = auth_hash.name
+          name = valid_username if name.strip.empty?
+
+          {
+            name:                       name,
+            username:                   valid_username,
+            email:                      email,
+            password:                   auth_hash.password,
+            password_confirmation:      auth_hash.password,
+            password_automatically_set: true
+          }
+        end
+
+        def sync_profile_from_provider?
+          Gitlab::Auth::OAuth::Provider.sync_profile_from_provider?(auth_hash.provider)
+        end
+
+        def update_profile
+          clear_user_synced_attributes_metadata
+
+          return unless sync_profile_from_provider? || creating_linked_ldap_user?
+
+          metadata = gl_user.build_user_synced_attributes_metadata
+
+          if sync_profile_from_provider?
+            UserSyncedAttributesMetadata::SYNCABLE_ATTRIBUTES.each do |key|
+              if auth_hash.has_attribute?(key) && gl_user.sync_attribute?(key)
+                gl_user[key] = auth_hash.public_send(key) # rubocop:disable GitlabSecurity/PublicSend
+                metadata.set_attribute_synced(key, true)
+              else
+                metadata.set_attribute_synced(key, false)
+              end
+            end
+
+            metadata.provider = auth_hash.provider
+          end
+
+          if creating_linked_ldap_user? && gl_user.email == ldap_person.email.first
+            metadata.set_attribute_synced(:email, true)
+            metadata.provider = ldap_person.provider
+          end
+        end
+
+        def clear_user_synced_attributes_metadata
+          gl_user&.user_synced_attributes_metadata&.destroy
+        end
+
+        def log
+          Gitlab::AppLogger
+        end
+
+        def oauth_provider_disabled?
+          Gitlab::CurrentSettings.current_application_settings
+                                .disabled_oauth_sign_in_sources
+                                .include?(auth_hash.provider)
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/saml/auth_hash.rb

+module Gitlab
+  module Auth
+    module Saml
+      class AuthHash < Gitlab::Auth::OAuth::AuthHash
+        def groups
+          Array.wrap(get_raw(Gitlab::Auth::Saml::Config.groups))
+        end
+
+        private
+
+        def get_raw(key)
+          # Needs to call `all` because of https://git.io/vVo4u
+          # otherwise just the first value is returned
+          auth_hash.extra[:raw_info].all[key]
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/saml/config.rb

+module Gitlab
+  module Auth
+    module Saml
+      class Config
+        class << self
+          def options
+            Gitlab.config.omniauth.providers.find { |provider| provider.name == 'saml' }
+          end
+
+          def groups
+            options[:groups_attribute]
+          end
+
+          def external_groups
+            options[:external_groups]
+          end
+
+          def required_groups
+            Array(options[:required_groups])
+          end
+
+          def admin_groups
+            options[:admin_groups]
+          end
+        end
+      end
+    end
+  end
+end

lib/gitlab/auth/saml/user.rb

+# SAML extension for User model
+#
+# * Find GitLab user based on SAML uid and provider
+# * Create new user from SAML data
+#
+module Gitlab
+  module Auth
+    module Saml
+      class User < Gitlab::Auth::OAuth::User
+        def save
+          super('SAML')
+        end
+
+        def find_user
+          user = find_by_uid_and_provider
+
+          user ||= find_by_email if auto_link_saml_user?
+          user ||= find_or_build_ldap_user if auto_link_ldap_user?
+          user ||= build_new_user if signup_enabled?
+
+          if user_in_required_group?
+            unblock_user(user, "in required group") if user.persisted? && user.blocked?
+          elsif user.persisted?
+            block_user(user, "not in required group") unless user.blocked?
+          else
+            user = nil
+          end
+
+          if user
+            user.external = !(auth_hash.groups & Gitlab::Auth::Saml::Config.external_groups).empty? if external_users_enabled?
+            user.admin = !(auth_hash.groups & Gitlab::Auth::Saml::Config.admin_groups).empty? if admin_groups_enabled?
+          end
+
+          user
+        end
+
+        def changed?
+          return true unless gl_user
+
+          gl_user.changed? || gl_user.identities.any?(&:changed?)
+        end
+
+        protected
+
+        def block_user(user, reason)
+          user.ldap_block
+          log_user_changes(user, "#{reason}, blocking")
+        end
+
+        def unblock_user(user, reason)
+          user.activate
+          log_user_changes(user, "#{reason}, unblocking")
+        end
+
+        def log_user_changes(user, message)
+          Gitlab::AppLogger.info(
+            "SAML(#{auth_hash.provider}) account \"#{auth_hash.uid}\" #{message} " \
+            "Gitlab user \"#{user.name}\" (#{user.email})"
+          )
+        end
+
+        def user_in_required_group?
+          required_groups = Gitlab::Auth::Saml::Config.required_groups
+          required_groups.empty? || !(auth_hash.groups & required_groups).empty?
+        end
+
+        def auto_link_saml_user?
+          Gitlab.config.omniauth.auto_link_saml_user
+        end
+
+        def external_users_enabled?
+          !Gitlab::Auth::Saml::Config.external_groups.nil?
+        end
+
+        def auth_hash=(auth_hash)
+          @auth_hash = Gitlab::Auth::Saml::AuthHash.new(auth_hash)
+        end
+
+        def admin_groups_enabled?
+          !Gitlab::Auth::Saml::Config.admin_groups.nil?
+        end
+      end
+    end
+  end
+end

lib/gitlab/background_migration/normalize_ldap_extern_uids_range.rb

@@ -16,6 +16,7 @@ module Gitlab
       # And if the normalize behavior is changed in the future, it must be
       # accompanied by another migration.
       module Gitlab
+        module Auth
           module LDAP
             class DN
               FormatError = Class.new(StandardError)
@@ -295,6 +296,7 @@ module Gitlab
             end
           end
         end
+      end
 
       def perform(start_id, end_id)
         return unless migrate?
@@ -302,11 +304,11 @@ module Gitlab
         ldap_identities = Identity.where("provider like 'ldap%'").where(id: start_id..end_id)
         ldap_identities.each do |identity|
           begin
-            identity.extern_uid = Gitlab::LDAP::DN.new(identity.extern_uid).to_normalized_s
+            identity.extern_uid = Gitlab::Auth::LDAP::DN.new(identity.extern_uid).to_normalized_s
             unless identity.save
               Rails.logger.info "Unable to normalize \"#{identity.extern_uid}\". Skipping."
             end
-          rescue Gitlab::LDAP::DN::FormatError => e
+          rescue Gitlab::Auth::LDAP::DN::FormatError => e
             Rails.logger.info "Unable to normalize \"#{identity.extern_uid}\" due to \"#{e.message}\". Skipping."
           end
         end

lib/gitlab/ldap/access.rb

-# LDAP authorization model
-#
-# * Check if we are allowed access (not blocked)
-# * Update authorizations and associations
-#
-module Gitlab
-  module LDAP
-    class Access
-      attr_reader :provider, :user, :ldap_identity
-
-      def self.open(user, &block)
-        Gitlab::LDAP::Adapter.open(user.ldap_identity.provider) do |adapter|
-          block.call(self.new(user, adapter))
-        end
-      end
-
-      def self.allowed?(user, options = {})
-        self.open(user) do |access|
-          # Whether user is allowed, or not, we should update
-          # permissions to keep things clean
-          if access.allowed?
-            access.update_user
-            Users::UpdateService.new(user, user: user, last_credential_check_at: Time.now).execute
-
-            true
-          else
-            false
-          end
-        end
-      end
-
-      def initialize(user, adapter = nil)
-        @adapter = adapter
-        @user = user
-        @ldap_identity = user.ldap_identity
-        @provider = adapter&.provider || @ldap_identity&.provider
-      end
-
-      def allowed?
-        if ldap_user
-          unless ldap_config.active_directory
-            unblock_user(user, 'is available again') if user.ldap_blocked?
-            return true
-          end
-
-          # Block user in GitLab if he/she was blocked in AD
-          if Gitlab::LDAP::Person.disabled_via_active_directory?(ldap_identity.extern_uid, adapter)
-            block_user(user, 'is disabled in Active Directory')
-            false
-          else
-            unblock_user(user, 'is not disabled anymore') if user.ldap_blocked?
-            true
-          end
-        else
-          # Block the user if they no longer exist in LDAP/AD
-          block_user(user, 'does not exist anymore')
-          false
-        end
-      end
-
-      def adapter
-        @adapter ||= Gitlab::LDAP::Adapter.new(provider)
-      end
-
-      def ldap_config
-        Gitlab::LDAP::Config.new(provider)
-      end
-
-      def find_ldap_user
-        return unless provider
-
-        found_user = Gitlab::LDAP::Person.find_by_dn(ldap_identity.extern_uid, adapter)
-        return found_user if found_user
-
-        if ldap_identity
-          Gitlab::LDAP::Person.find_by_email(user.email, adapter)
-        end
-      end
-
-      def ldap_user
-        @ldap_user ||= find_ldap_user
-      end
-
-      def block_user(user, reason)
-        user.ldap_block
-
-        if provider
-          Gitlab::AppLogger.info(
-            "LDAP account \"#{ldap_identity.extern_uid}\" #{reason}, " \
-            "blocking Gitlab user \"#{user.name}\" (#{user.email})"
-          )
-        else
-          Gitlab::AppLogger.info(
-            "Account is not provided by LDAP, " \
-            "blocking Gitlab user \"#{user.name}\" (#{user.email})"
-          )
-        end
-      end
-
-      def unblock_user(user, reason)
-        user.activate
-
-        Gitlab::AppLogger.info(
-          "LDAP account \"#{ldap_identity.extern_uid}\" #{reason}, " \
-          "unblocking Gitlab user \"#{user.name}\" (#{user.email})"
-        )
-      end
-
-      def update_user
-        update_email
-        update_memberships
-        update_identity
-        update_ssh_keys if sync_ssh_keys?
-        update_kerberos_identity if import_kerberos_identities?
-      end
-
-      # Update user ssh keys if they changed in LDAP
-      def update_ssh_keys
-        remove_old_ssh_keys
-        add_new_ssh_keys
-      end
-
-      # Add ssh keys that are in LDAP but not in GitLab
-      def add_new_ssh_keys
-        keys = ldap_user.ssh_keys - user.keys.ldap.pluck(:key)
-
-        keys.each do |key|
-          logger.info "#{self.class.name}: adding LDAP SSH key #{key.inspect} to #{user.name} (#{user.id})"
-          new_key = LDAPKey.new(title: "LDAP - #{ldap_config.sync_ssh_keys}", key: key)
-          new_key.user = user
-
-          unless new_key.save
-            logger.error "#{self.class.name}: failed to add LDAP SSH key #{key.inspect} to #{user.name} (#{user.id})\n"\
-              "error messages: #{new_key.errors.messages}"
-          end
-        end
-      end
-
-      # Remove ssh keys that do not exist in LDAP any more
-      def remove_old_ssh_keys
-        keys = user.keys.ldap.where.not(key: ldap_user.ssh_keys)
-
-        keys.each do |deleted_key|
-          logger.info "#{self.class.name}: removing LDAP SSH key #{deleted_key.key} from #{user.name} (#{user.id})"
-
-          unless deleted_key.destroy
-            logger.error "#{self.class.name}: failed to remove LDAP SSH key #{key.inspect} from #{user.name} (#{user.id})"
-          end
-        end
-      end
-
-      # Update user Kerberos identity with Kerberos principal name from Active Directory
-      def update_kerberos_identity
-        # there can be only one Kerberos identity in GitLab; if the user has a Kerberos identity in AD,
-        # replace any existing Kerberos identity for the user
-        return unless ldap_user.kerberos_principal.present?
-
-        kerberos_identity = user.identities.where(provider: :kerberos).first
-        return if kerberos_identity && kerberos_identity.extern_uid == ldap_user.kerberos_principal
-
-        kerberos_identity ||= Identity.new(provider: :kerberos, user: user)
-        kerberos_identity.extern_uid = ldap_user.kerberos_principal
-        unless kerberos_identity.save
-          Rails.logger.error "#{self.class.name}: failed to add Kerberos principal #{principal} to #{user.name} (#{user.id})\n"\
-            "error messages: #{new_identity.errors.messages}"
-        end
-      end
-
-      # Update user email if it changed in LDAP
-      def update_email
-        return false unless ldap_user.try(:email)
-
-        ldap_email = ldap_user.email.last.to_s.downcase
-
-        return false if user.email == ldap_email
-
-        Users::UpdateService.new(user, user: user, email: ldap_email).execute do |user|
-          user.skip_reconfirmation!
-        end
-      end
-
-      def update_identity
-        return if ldap_user.dn.empty? || ldap_user.dn == ldap_identity.extern_uid
-
-        unless ldap_identity.update(extern_uid: ldap_user.dn)
-          Rails.logger.error "Could not update DN for #{user.name} (#{user.id})\n"\
-                             "error messages: #{user.ldap_identity.errors.messages}"
-        end
-      end
-
-      delegate :sync_ssh_keys?, to: :ldap_config
-
-      def import_kerberos_identities?
-        # Kerberos may be enabled for Git HTTP access and/or as an Omniauth provider
-        ldap_config.active_directory && (Gitlab.config.kerberos.enabled || AuthHelper.kerberos_enabled? )
-      end
-
-      def update_memberships
-        return if ldap_user.nil? || ldap_user.group_cns.empty?
-
-        group_ids = LdapGroupLink.where(cn: ldap_user.group_cns, provider: provider)
-                      .distinct(:group_id)
-                      .pluck(:group_id)
-
-        LdapGroupSyncWorker.perform_async(group_ids, provider) if group_ids.any?
-      end
-
-      private
-
-      def logger
-        Rails.logger
-      end
-    end
-  end
-end

lib/gitlab/ldap/adapter.rb

-# LDAP connection adapter
-#
-# Contains methods common to both GitLab CE and EE.
-# All EE methods should be in `EE::Gitlab::LDAP::Adapter` only.
-module Gitlab
-  module LDAP
-    class Adapter
-      prepend ::EE::Gitlab::LDAP::Adapter
-
-      attr_reader :provider, :ldap
-
-      def self.open(provider, &block)
-        Net::LDAP.open(config(provider).adapter_options) do |ldap|
-          block.call(self.new(provider, ldap))
-        end
-      end
-
-      def self.config(provider)
-        Gitlab::LDAP::Config.new(provider)
-      end
-
-      def initialize(provider, ldap = nil)
-        @provider = provider
-        @ldap = ldap || Net::LDAP.new(config.adapter_options)
-      end
-
-      def config
-        Gitlab::LDAP::Config.new(provider)
-      end
-
-      def users(fields, value, limit = nil)
-        options = user_options(Array(fields), value, limit)
-
-        entries = ldap_search(options).select do |entry|
-          entry.respond_to? config.uid
-        end
-
-        entries.map do |entry|
-          Gitlab::LDAP::Person.new(entry, provider)
-        end
-      end
-
-      def user(*args)
-        users(*args).first
-      end
-
-      def dn_matches_filter?(dn, filter)
-        ldap_search(base: dn,
-                    filter: filter,
-                    scope: Net::LDAP::SearchScope_BaseObject,
-                    attributes: %w{dn}).any?
-      end
-
-      def ldap_search(*args)
-        # Net::LDAP's `time` argument doesn't work. Use Ruby `Timeout` instead.
-        Timeout.timeout(config.timeout) do
-          results = ldap.search(*args)
-
-          if results.nil?
-            response = ldap.get_operation_result
-
-            unless response.code.zero?
-              Rails.logger.warn("LDAP search error: #{response.message}")
-            end
-
-            []
-          else
-            results
-          end
-        end
-      rescue Net::LDAP::Error => error
-        Rails.logger.warn("LDAP search raised exception #{error.class}: #{error.message}")
-        []
-      rescue Timeout::Error
-        Rails.logger.warn("LDAP search timed out after #{config.timeout} seconds")
-        []
-      end
-
-      private
-
-      def user_options(fields, value, limit)
-        options = {
-          attributes: Gitlab::LDAP::Person.ldap_attributes(config),
-          base: config.base
-        }
-
-        options[:size] = limit if limit
-
-        if fields.include?('dn')
-          raise ArgumentError, 'It is not currently possible to search the DN and other fields at the same time.' if fields.size > 1
-
-          options[:base] = value
-          options[:scope] = Net::LDAP::SearchScope_BaseObject
-        else
-          filter = fields.map { |field| Net::LDAP::Filter.eq(field, value) }.inject(:|)
-        end
-
-        options.merge(filter: user_filter(filter))
-      end
-
-      def user_filter(filter = nil)
-        user_filter = config.constructed_user_filter if config.user_filter.present?
-
-        if user_filter && filter
-          Net::LDAP::Filter.join(filter, user_filter)
-        elsif user_filter
-          user_filter
-        else
-          filter
-        end
-      end
-    end
-  end
-end

lib/gitlab/ldap/auth_hash.rb

-# Class to parse and transform the info provided by omniauth
-#
-module Gitlab
-  module LDAP
-    class AuthHash < Gitlab::OAuth::AuthHash
-      def uid
-        @uid ||= Gitlab::LDAP::Person.normalize_dn(super)
-      end
-
-      def username
-        super.tap do |username|
-          username.downcase! if ldap_config.lowercase_usernames
-        end
-      end
-
-      private
-
-      def get_info(key)
-        attributes = ldap_config.attributes[key.to_s]
-        return super unless attributes
-
-        attributes = Array(attributes)
-
-        value = nil
-        attributes.each do |attribute|
-          value = get_raw(attribute)
-          value = value.first if value
-          break if value.present?
-        end
-
-        return super unless value
-
-        Gitlab::Utils.force_utf8(value)
-        value
-      end
-
-      def get_raw(key)
-        auth_hash.extra[:raw_info][key] if auth_hash.extra
-      end
-
-      def ldap_config
-        @ldap_config ||= Gitlab::LDAP::Config.new(self.provider)
-      end
-    end
-  end
-end

lib/gitlab/ldap/authentication.rb

-# These calls help to authenticate to LDAP by providing username and password
-#
-# Since multiple LDAP servers are supported, it will loop through all of them
-# until a valid bind is found
-#
-
-module Gitlab
-  module LDAP
-    class Authentication
-      def self.login(login, password)
-        return unless Gitlab::LDAP::Config.enabled?
-        return unless login.present? && password.present?
-
-        auth = nil
-        # loop through providers until valid bind
-        providers.find do |provider|
-          auth = new(provider)
-          auth.login(login, password) # true will exit the loop
-        end
-
-        # If (login, password) was invalid for all providers, the value of auth is now the last
-        # Gitlab::LDAP::Authentication instance we tried.
-        auth.user
-      end
-
-      def self.providers
-        Gitlab::LDAP::Config.providers
-      end
-
-      attr_accessor :provider, :ldap_user
-
-      def initialize(provider)
-        @provider = provider
-      end
-
-      def login(login, password)
-        @ldap_user = adapter.bind_as(
-          filter: user_filter(login),
-          size: 1,
-          password: password
-        )
-      end
-
-      def adapter
-        OmniAuth::LDAP::Adaptor.new(config.omniauth_options)
-      end
-
-      def config
-        Gitlab::LDAP::Config.new(provider)
-      end
-
-      def user_filter(login)
-        filter = Net::LDAP::Filter.equals(config.uid, login)
-
-        # Apply LDAP user filter if present
-        if config.user_filter.present?
-          filter = Net::LDAP::Filter.join(filter, config.constructed_user_filter)
-        end
-
-        filter
-      end
-
-      def user
-        return nil unless ldap_user
-
-        Gitlab::LDAP::User.find_by_uid_and_provider(ldap_user.dn, provider)
-      end
-    end
-  end
-end

lib/gitlab/ldap/config.rb

-# Load a specific server configuration
-module Gitlab
-  module LDAP
-    class Config
-      include ::EE::Gitlab::LDAP::Config
-
-      NET_LDAP_ENCRYPTION_METHOD = {
-        simple_tls: :simple_tls,
-        start_tls:  :start_tls,
-        plain:      nil
-      }.freeze
-
-      attr_accessor :provider, :options
-
-      InvalidProvider = Class.new(StandardError)
-
-      def self.enabled?
-        Gitlab.config.ldap.enabled
-      end
-
-      def self.servers
-        Gitlab.config.ldap['servers']&.values || []
-      end
-
-      def self.available_servers
-        return [] unless enabled?
-
-        ::License.feature_available?(:multiple_ldap_servers) ? servers : Array.wrap(servers.first)
-      end
-
-      def self.providers
-        servers.map { |server| server['provider_name'] }
-      end
-
-      def self.valid_provider?(provider)
-        providers.include?(provider)
-      end
-
-      def self.invalid_provider(provider)
-        raise InvalidProvider.new("Unknown provider (#{provider}). Available providers: #{providers}")
-      end
-
-      def initialize(provider)
-        if self.class.valid_provider?(provider)
-          @provider = provider
-        else
-          self.class.invalid_provider(provider)
-        end
-
-        @options = config_for(@provider) # Use @provider, not provider
-      end
-
-      def enabled?
-        base_config.enabled
-      end
-
-      def adapter_options
-        opts = base_options.merge(
-          encryption: encryption_options
-        )
-
-        opts.merge!(auth_options) if has_auth?
-
-        opts
-      end
-
-      def omniauth_options
-        opts = base_options.merge(
-          base: base,
-          encryption: options['encryption'],
-          filter: omniauth_user_filter,
-          name_proc: name_proc,
-          disable_verify_certificates: !options['verify_certificates']
-        )
-
-        if has_auth?
-          opts.merge!(
-            bind_dn: options['bind_dn'],
-            password: options['password']
-          )
-        end
-
-        opts[:ca_file] = options['ca_file'] if options['ca_file'].present?
-        opts[:ssl_version] = options['ssl_version'] if options['ssl_version'].present?
-
-        opts
-      end
-
-      def base
-        @base ||= Person.normalize_dn(options['base'])
-      end
-
-      def uid
-        options['uid']
-      end
-
-      def label
-        options['label']
-      end
-
-      def sync_ssh_keys?
-        sync_ssh_keys.present?
-      end
-
-      # The LDAP attribute in which the ssh keys are stored
-      def sync_ssh_keys
-        options['sync_ssh_keys']
-      end
-
-      def user_filter
-        options['user_filter']
-      end
-
-      def constructed_user_filter
-        @constructed_user_filter ||= Net::LDAP::Filter.construct(user_filter)
-      end
-
-      def group_base
-        options['group_base']
-      end
-
-      def admin_group
-        options['admin_group']
-      end
-
-      def active_directory
-        options['active_directory']
-      end
-
-      def block_auto_created_users
-        options['block_auto_created_users']
-      end
-
-      def attributes
-        default_attributes.merge(options['attributes'])
-      end
-
-      def timeout
-        options['timeout'].to_i
-      end
-
-      def external_groups
-        options['external_groups']
-      end
-
-      def has_auth?
-        options['password'] || options['bind_dn']
-      end
-
-      def allow_username_or_email_login
-        options['allow_username_or_email_login']
-      end
-
-      def lowercase_usernames
-        options['lowercase_usernames']
-      end
-
-      def name_proc
-        if allow_username_or_email_login
-          proc { |name| name.gsub(/@.*\z/, '') }
-        else
-          proc { |name| name }
-        end
-      end
-
-      def default_attributes
-        {
-          'username'    => %w(uid sAMAccountName userid),
-          'email'       => %w(mail email userPrincipalName),
-          'name'        => 'cn',
-          'first_name'  => 'givenName',
-          'last_name'   => 'sn'
-        }
-      end
-
-      protected
-
-      def base_options
-        {
-          host: options['host'],
-          port: options['port']
-        }
-      end
-
-      def base_config
-        Gitlab.config.ldap
-      end
-
-      def config_for(provider)
-        base_config.servers.values.find { |server| server['provider_name'] == provider }
-      end
-
-      def encryption_options
-        method = translate_method(options['encryption'])
-        return nil unless method
-
-        {
-          method: method,
-          tls_options: tls_options(method)
-        }
-      end
-
-      def translate_method(method_from_config)
-        NET_LDAP_ENCRYPTION_METHOD[method_from_config.to_sym]
-      end
-
-      def tls_options(method)
-        return { verify_mode: OpenSSL::SSL::VERIFY_NONE } unless method
-
-        opts = if options['verify_certificates']
-                 OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
-               else
-                 # It is important to explicitly set verify_mode for two reasons:
-                 # 1. The behavior of OpenSSL is undefined when verify_mode is not set.
-                 # 2. The net-ldap gem implementation verifies the certificate hostname
-                 #    unless verify_mode is set to VERIFY_NONE.
-                 { verify_mode: OpenSSL::SSL::VERIFY_NONE }
-               end
-
-        opts[:ca_file] = options['ca_file'] if options['ca_file'].present?
-        opts[:ssl_version] = options['ssl_version'] if options['ssl_version'].present?
-
-        opts
-      end
-
-      def auth_options
-        {
-          auth: {
-            method: :simple,
-            username: options['bind_dn'],
-            password: options['password']
-          }
-        }
-      end
-
-      def omniauth_user_filter
-        uid_filter = Net::LDAP::Filter.eq(uid, '%{username}')
-
-        if user_filter.present?
-          Net::LDAP::Filter.join(uid_filter, constructed_user_filter).to_s
-        else
-          uid_filter.to_s
-        end
-      end
-    end
-  end
-end

lib/gitlab/ldap/dn.rb

-# -*- ruby encoding: utf-8 -*-
-
-# Based on the `ruby-net-ldap` gem's `Net::LDAP::DN`
-#
-# For our purposes, this class is used to normalize DNs in order to allow proper
-# comparison.
-#
-# E.g. DNs should be compared case-insensitively (in basically all LDAP
-# implementations or setups), therefore we downcase every DN.
-
-##
-# Objects of this class represent an LDAP DN ("Distinguished Name"). A DN
-# ("Distinguished Name") is a unique identifier for an entry within an LDAP
-# directory. It is made up of a number of other attributes strung together,
-# to identify the entry in the tree.
-#
-# Each attribute that makes up a DN needs to have its value escaped so that
-# the DN is valid. This class helps take care of that.
-#
-# A fully escaped DN needs to be unescaped when analysing its contents. This
-# class also helps take care of that.
-module Gitlab
-  module LDAP
-    class DN
-      FormatError = Class.new(StandardError)
-      MalformedError = Class.new(FormatError)
-      UnsupportedError = Class.new(FormatError)
-
-      def self.normalize_value(given_value)
-        dummy_dn = "placeholder=#{given_value}"
-        normalized_dn = new(*dummy_dn).to_normalized_s
-        normalized_dn.sub(/\Aplaceholder=/, '')
-      end
-
-      ##
-      # Initialize a DN, escaping as required. Pass in attributes in name/value
-      # pairs. If there is a left over argument, it will be appended to the dn
-      # without escaping (useful for a base string).
-      #
-      # Most uses of this class will be to escape a DN, rather than to parse it,
-      # so storing the dn as an escaped String and parsing parts as required
-      # with a state machine seems sensible.
-      def initialize(*args)
-        if args.length > 1
-          initialize_array(args)
-        else
-          initialize_string(args[0])
-        end
-      end
-
-      ##
-      # Parse a DN into key value pairs using ASN from
-      # http://tools.ietf.org/html/rfc2253 section 3.
-      # rubocop:disable Metrics/AbcSize
-      # rubocop:disable Metrics/CyclomaticComplexity
-      # rubocop:disable Metrics/PerceivedComplexity
-      def each_pair
-        state = :key
-        key = StringIO.new
-        value = StringIO.new
-        hex_buffer = ""
-
-        @dn.each_char.with_index do |char, dn_index|
-          case state
-          when :key then
-            case char
-            when 'a'..'z', 'A'..'Z' then
-              state = :key_normal
-              key << char
-            when '0'..'9' then
-              state = :key_oid
-              key << char
-            when ' ' then state = :key
-            else raise(MalformedError, "Unrecognized first character of an RDN attribute type name \"#{char}\"")
-            end
-          when :key_normal then
-            case char
-            when '=' then state = :value
-            when 'a'..'z', 'A'..'Z', '0'..'9', '-', ' ' then key << char
-            else raise(MalformedError, "Unrecognized RDN attribute type name character \"#{char}\"")
-            end
-          when :key_oid then
-            case char
-            when '=' then state = :value
-            when '0'..'9', '.', ' ' then key << char
-            else raise(MalformedError, "Unrecognized RDN OID attribute type name character \"#{char}\"")
-            end
-          when :value then
-            case char
-            when '\\' then state = :value_normal_escape
-            when '"' then state = :value_quoted
-            when ' ' then state = :value
-            when '#' then
-              state = :value_hexstring
-              value << char
-            when ',' then
-              state = :key
-              yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
-              key = StringIO.new
-              value = StringIO.new
-            else
-              state = :value_normal
-              value << char
-            end
-          when :value_normal then
-            case char
-            when '\\' then state = :value_normal_escape
-            when ',' then
-              state = :key
-              yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
-              key = StringIO.new
-              value = StringIO.new
-            when '+' then raise(UnsupportedError, "Multivalued RDNs are not supported")
-            else value << char
-            end
-          when :value_normal_escape then
-            case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
-              state = :value_normal_escape_hex
-              hex_buffer = char
-            else
-              state = :value_normal
-              value << char
-            end
-          when :value_normal_escape_hex then
-            case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
-              state = :value_normal
-              value << "#{hex_buffer}#{char}".to_i(16).chr
-            else raise(MalformedError, "Invalid escaped hex code \"\\#{hex_buffer}#{char}\"")
-            end
-          when :value_quoted then
-            case char
-            when '\\' then state = :value_quoted_escape
-            when '"' then state = :value_end
-            else value << char
-            end
-          when :value_quoted_escape then
-            case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
-              state = :value_quoted_escape_hex
-              hex_buffer = char
-            else
-              state = :value_quoted
-              value << char
-            end
-          when :value_quoted_escape_hex then
-            case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
-              state = :value_quoted
-              value << "#{hex_buffer}#{char}".to_i(16).chr
-            else raise(MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"#{char}\"")
-            end
-          when :value_hexstring then
-            case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
-              state = :value_hexstring_hex
-              value << char
-            when ' ' then state = :value_end
-            when ',' then
-              state = :key
-              yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
-              key = StringIO.new
-              value = StringIO.new
-            else raise(MalformedError, "Expected the first character of a hex pair, but got \"#{char}\"")
-            end
-          when :value_hexstring_hex then
-            case char
-            when '0'..'9', 'a'..'f', 'A'..'F' then
-              state = :value_hexstring
-              value << char
-            else raise(MalformedError, "Expected the second character of a hex pair, but got \"#{char}\"")
-            end
-          when :value_end then
-            case char
-            when ' ' then state = :value_end
-            when ',' then
-              state = :key
-              yield key.string.strip, rstrip_except_escaped(value.string, dn_index)
-              key = StringIO.new
-              value = StringIO.new
-            else raise(MalformedError, "Expected the end of an attribute value, but got \"#{char}\"")
-            end
-          else raise "Fell out of state machine"
-          end
-        end
-
-        # Last pair
-        raise(MalformedError, 'DN string ended unexpectedly') unless
-          [:value, :value_normal, :value_hexstring, :value_end].include? state
-
-        yield key.string.strip, rstrip_except_escaped(value.string, @dn.length)
-      end
-
-      def rstrip_except_escaped(str, dn_index)
-        str_ends_with_whitespace = str.match(/\s\z/)
-
-        if str_ends_with_whitespace
-          dn_part_ends_with_escaped_whitespace = @dn[0, dn_index].match(/\\(\s+)\z/)
-
-          if dn_part_ends_with_escaped_whitespace
-            dn_part_rwhitespace = dn_part_ends_with_escaped_whitespace[1]
-            num_chars_to_remove = dn_part_rwhitespace.length - 1
-            str = str[0, str.length - num_chars_to_remove]
-          else
-            str.rstrip!
-          end
-        end
-
-        str
-      end
-
-      ##
-      # Returns the DN as an array in the form expected by the constructor.
-      def to_a
-        a = []
-        self.each_pair { |key, value| a << key << value } unless @dn.empty?
-        a
-      end
-
-      ##
-      # Return the DN as an escaped string.
-      def to_s
-        @dn
-      end
-
-      ##
-      # Return the DN as an escaped and normalized string.
-      def to_normalized_s
-        self.class.new(*to_a).to_s.downcase
-      end
-
-      # https://tools.ietf.org/html/rfc4514 section 2.4 lists these exceptions
-      # for DN values. All of the following must be escaped in any normal string
-      # using a single backslash ('\') as escape. The space character is left
-      # out here because in a "normalized" string, spaces should only be escaped
-      # if necessary (i.e. leading or trailing space).
-      NORMAL_ESCAPES = [',', '+', '"', '\\', '<', '>', ';', '='].freeze
-
-      # The following must be represented as escaped hex
-      HEX_ESCAPES = {
-        "\n" => '\0a',
-        "\r" => '\0d'
-      }.freeze
-
-      # Compiled character class regexp using the keys from the above hash, and
-      # checking for a space or # at the start, or space at the end, of the
-      # string.
-      ESCAPE_RE = Regexp.new("(^ |^#| $|[" +
-                             NORMAL_ESCAPES.map { |e| Regexp.escape(e) }.join +
-                             "])")
-
-      HEX_ESCAPE_RE = Regexp.new("([" +
-                             HEX_ESCAPES.keys.map { |e| Regexp.escape(e) }.join +
-                             "])")
-
-      ##
-      # Escape a string for use in a DN value
-      def self.escape(string)
-        escaped = string.gsub(ESCAPE_RE) { |char| "\\" + char }
-        escaped.gsub(HEX_ESCAPE_RE) { |char| HEX_ESCAPES[char] }
-      end
-
-      private
-
-      def initialize_array(args)
-        buffer = StringIO.new
-
-        args.each_with_index do |arg, index|
-          if index.even? # key
-            buffer << "," if index > 0
-            buffer << arg
-          else # value
-            buffer << "="
-            buffer << self.class.escape(arg)
-          end
-        end
-
-        @dn = buffer.string
-      end
-
-      def initialize_string(arg)
-        @dn = arg.to_s
-      end
-
-      ##
-      # Proxy all other requests to the string object, because a DN is mainly
-      # used within the library as a string
-      # rubocop:disable GitlabSecurity/PublicSend
-      def method_missing(method, *args, &block)
-        @dn.send(method, *args, &block)
-      end
-
-      ##
-      # Redefined to be consistent with redefined `method_missing` behavior
-      def respond_to?(sym, include_private = false)
-        @dn.respond_to?(sym, include_private)
-      end
-    end
-  end
-end

lib/gitlab/ldap/person.rb

-# Contains methods common to both GitLab CE and EE.
-# All EE methods should be in `EE::Gitlab::LDAP::Person` only.
-module Gitlab
-  module LDAP
-    class Person
-      prepend ::EE::Gitlab::LDAP::Person
-
-      # Active Directory-specific LDAP filter that checks if bit 2 of the
-      # userAccountControl attribute is set.
-      # Source: http://ctogonewild.com/2009/09/03/bitmask-searches-in-ldap/
-      AD_USER_DISABLED = Net::LDAP::Filter.ex("userAccountControl:1.2.840.113556.1.4.803", "2")
-
-      InvalidEntryError = Class.new(StandardError)
-
-      attr_accessor :entry, :provider
-
-      def self.find_by_uid(uid, adapter)
-        uid = Net::LDAP::Filter.escape(uid)
-        adapter.user(adapter.config.uid, uid)
-      end
-
-      def self.find_by_dn(dn, adapter)
-        adapter.user('dn', dn)
-      end
-
-      def self.find_by_email(email, adapter)
-        email_fields = adapter.config.attributes['email']
-
-        adapter.user(email_fields, email)
-      end
-
-      def self.disabled_via_active_directory?(dn, adapter)
-        adapter.dn_matches_filter?(dn, AD_USER_DISABLED)
-      end
-
-      def self.ldap_attributes(config)
-        [
-          'dn',
-          config.uid,
-          *config.attributes['name'],
-          *config.attributes['email'],
-          *config.attributes['username']
-        ].compact.uniq
-      end
-
-      def self.normalize_dn(dn)
-        ::Gitlab::LDAP::DN.new(dn).to_normalized_s
-      rescue ::Gitlab::LDAP::DN::FormatError => e
-        Rails.logger.info("Returning original DN \"#{dn}\" due to error during normalization attempt: #{e.message}")
-
-        dn
-      end
-
-      # Returns the UID in a normalized form.
-      #
-      # 1. Excess spaces are stripped
-      # 2. The string is downcased (for case-insensitivity)
-      def self.normalize_uid(uid)
-        ::Gitlab::LDAP::DN.normalize_value(uid)
-      rescue ::Gitlab::LDAP::DN::FormatError => e
-        Rails.logger.info("Returning original UID \"#{uid}\" due to error during normalization attempt: #{e.message}")
-
-        uid
-      end
-
-      def initialize(entry, provider)
-        Rails.logger.debug { "Instantiating #{self.class.name} with LDIF:\n#{entry.to_ldif}" }
-        @entry = entry
-        @provider = provider
-      end
-
-      def name
-        attribute_value(:name).first
-      end
-
-      def uid
-        entry.public_send(config.uid).first # rubocop:disable GitlabSecurity/PublicSend
-      end
-
-      def username
-        username = attribute_value(:username)
-
-        # Depending on the attribute, multiple values may
-        # be returned. We need only one for username.
-        # Ex. `uid` returns only one value but `mail` may
-        # return an array of multiple email addresses.
-        [username].flatten.first.tap do |username|
-          username.downcase! if config.lowercase_usernames
-        end
-      end
-
-      def email
-        attribute_value(:email)
-      end
-
-      def dn
-        self.class.normalize_dn(entry.dn)
-      end
-
-      private
-
-      def entry
-        @entry
-      end
-
-      def config
-        @config ||= Gitlab::LDAP::Config.new(provider)
-      end
-
-      # Using the LDAP attributes configuration, find and return the first
-      # attribute with a value. For example, by default, when given 'email',
-      # this method looks for 'mail', 'email' and 'userPrincipalName' and
-      # returns the first with a value.
-      def attribute_value(attribute)
-        attributes = Array(config.attributes[attribute.to_s])
-        selected_attr = attributes.find { |attr| entry.respond_to?(attr) }
-
-        return nil unless selected_attr
-
-        entry.public_send(selected_attr) # rubocop:disable GitlabSecurity/PublicSend
-      end
-    end
-  end
-end

lib/gitlab/ldap/user.rb

-# LDAP extension for User model
-#
-# * Find or create user from omniauth.auth data
-# * Links LDAP account with existing user
-# * Auth LDAP user with login and password
-#
-module Gitlab
-  module LDAP
-    class User < Gitlab::OAuth::User
-      prepend ::EE::Gitlab::LDAP::User
-
-      class << self
-        def find_by_uid_and_provider(uid, provider)
-          identity = ::Identity.with_extern_uid(provider, uid).take
-
-          identity && identity.user
-        end
-      end
-
-      def save
-        super('LDAP')
-      end
-
-      # instance methods
-      def find_user
-        find_by_uid_and_provider || find_by_email || build_new_user
-      end
-
-      def find_by_uid_and_provider
-        self.class.find_by_uid_and_provider(auth_hash.uid, auth_hash.provider)
-      end
-
-      def changed?
-        gl_user.changed? || gl_user.identities.any?(&:changed?)
-      end
-
-      def block_after_signup?
-        ldap_config.block_auto_created_users
-      end
-
-      def allowed?
-        Gitlab::LDAP::Access.allowed?(gl_user)
-      end
-
-      def ldap_config
-        Gitlab::LDAP::Config.new(auth_hash.provider)
-      end
-
-      def auth_hash=(auth_hash)
-        @auth_hash = Gitlab::LDAP::AuthHash.new(auth_hash)
-      end
-    end
-  end
-end

lib/gitlab/o_auth.rb

-module Gitlab
-  module OAuth
-    SignupDisabledError = Class.new(StandardError)
-    SigninDisabledForProviderError = Class.new(StandardError)
-  end
-end

lib/gitlab/o_auth/auth_hash.rb

-# Class to parse and transform the info provided by omniauth
-#
-module Gitlab
-  module OAuth
-    class AuthHash
-      prepend ::EE::Gitlab::OAuth::AuthHash
-
-      attr_reader :auth_hash
-      def initialize(auth_hash)
-        @auth_hash = auth_hash
-      end
-
-      def uid
-        @uid ||= Gitlab::Utils.force_utf8(auth_hash.uid.to_s)
-      end
-
-      def provider
-        @provider ||= auth_hash.provider.to_s
-      end
-
-      def name
-        @name ||= get_info(:name) || "#{get_info(:first_name)} #{get_info(:last_name)}"
-      end
-
-      def username
-        @username ||= username_and_email[:username].to_s
-      end
-
-      def email
-        @email ||= username_and_email[:email].to_s
-      end
-
-      def password
-        @password ||= Gitlab::Utils.force_utf8(Devise.friendly_token[0, 8].downcase)
-      end
-
-      def location
-        location = get_info(:address)
-        if location.is_a?(Hash)
-          [location.locality.presence, location.country.presence].compact.join(', ')
-        else
-          location
-        end
-      end
-
-      def has_attribute?(attribute)
-        if attribute == :location
-          get_info(:address).present?
-        else
-          get_info(attribute).present?
-        end
-      end
-
-      private
-
-      def info
-        auth_hash.info
-      end
-
-      def get_info(key)
-        value = info[key]
-        Gitlab::Utils.force_utf8(value) if value
-        value
-      end
-
-      def username_and_email
-        @username_and_email ||= begin
-          username  = get_info(:username).presence || get_info(:nickname).presence
-          email     = get_info(:email).presence
-
-          username ||= generate_username(email)             if email
-          email    ||= generate_temporarily_email(username) if username
-
-          {
-            username: username,
-            email:    email
-          }
-        end
-      end
-
-      # Get the first part of the email address (before @)
-      # In addtion in removes illegal characters
-      def generate_username(email)
-        email.match(/^[^@]*/)[0].mb_chars.normalize(:kd).gsub(/[^\x00-\x7F]/, '').to_s
-      end
-
-      def generate_temporarily_email(username)
-        "temp-email-for-oauth-#{username}@gitlab.localhost"
-      end
-    end
-  end
-end

lib/gitlab/o_auth/provider.rb

-module Gitlab
-  module OAuth
-    class Provider
-      LABELS = {
-        "github"         => "GitHub",
-        "gitlab"         => "GitLab.com",
-        "google_oauth2"  => "Google"
-      }.freeze
-
-      def self.providers
-        Devise.omniauth_providers
-      end
-
-      def self.enabled?(name)
-        providers.include?(name.to_sym)
-      end
-
-      def self.ldap_provider?(name)
-        name.to_s.start_with?('ldap')
-      end
-
-      def self.sync_profile_from_provider?(provider)
-        return true if ldap_provider?(provider)
-
-        providers = Gitlab.config.omniauth.sync_profile_from_provider
-
-        if providers.is_a?(Array)
-          providers.include?(provider)
-        else
-          providers
-        end
-      end
-
-      def self.config_for(name)
-        name = name.to_s
-        if ldap_provider?(name)
-          if Gitlab::LDAP::Config.valid_provider?(name)
-            Gitlab::LDAP::Config.new(name).options
-          else
-            nil
-          end
-        else
-          Gitlab.config.omniauth.providers.find { |provider| provider.name == name }
-        end
-      end
-
-      def self.label_for(name)
-        name = name.to_s
-        config = config_for(name)
-        (config && config['label']) || LABELS[name] || name.titleize
-      end
-    end
-  end
-end

lib/gitlab/o_auth/session.rb

-# :nocov:
-module Gitlab
-  module OAuth
-    module Session
-      def self.create(provider, ticket)
-        Rails.cache.write("gitlab:#{provider}:#{ticket}", ticket, expires_in: Gitlab.config.omniauth.cas3.session_duration)
-      end
-
-      def self.destroy(provider, ticket)
-        Rails.cache.delete("gitlab:#{provider}:#{ticket}")
-      end
-
-      def self.valid?(provider, ticket)
-        Rails.cache.read("gitlab:#{provider}:#{ticket}").present?
-      end
-    end
-  end
-end
-# :nocov:

lib/gitlab/o_auth/user.rb

-# OAuth extension for User model
-#
-# * Find GitLab user based on omniauth uid and provider
-# * Create new user from omniauth data
-#
-module Gitlab
-  module OAuth
-    class User
-      prepend ::EE::Gitlab::OAuth::User
-
-      attr_accessor :auth_hash, :gl_user
-
-      def initialize(auth_hash)
-        self.auth_hash = auth_hash
-        update_profile
-        add_or_update_user_identities
-      end
-
-      def persisted?
-        gl_user.try(:persisted?)
-      end
-
-      def new?
-        !persisted?
-      end
-
-      def valid?
-        gl_user.try(:valid?)
-      end
-
-      def save(provider = 'OAuth')
-        raise SigninDisabledForProviderError if oauth_provider_disabled?
-        raise SignupDisabledError unless gl_user
-
-        block_after_save = needs_blocking?
-
-        Users::UpdateService.new(gl_user, user: gl_user).execute!
-
-        gl_user.block if block_after_save
-
-        log.info "(#{provider}) saving user #{auth_hash.email} from login with extern_uid => #{auth_hash.uid}"
-        gl_user
-      rescue ActiveRecord::RecordInvalid => e
-        log.info "(#{provider}) Error saving user #{auth_hash.uid} (#{auth_hash.email}): #{gl_user.errors.full_messages}"
-        return self, e.record.errors
-      end
-
-      def gl_user
-        return @gl_user if defined?(@gl_user)
-
-        @gl_user = find_user
-      end
-
-      def find_user
-        user = find_by_uid_and_provider
-
-        user ||= find_or_build_ldap_user if auto_link_ldap_user?
-        user ||= build_new_user if signup_enabled?
-
-        user.external = true if external_provider? && user&.new_record?
-
-        user
-      end
-
-      protected
-
-      def add_or_update_user_identities
-        return unless gl_user
-
-        # find_or_initialize_by doesn't update `gl_user.identities`, and isn't autosaved.
-        identity = gl_user.identities.find { |identity| identity.provider == auth_hash.provider }
-
-        identity ||= gl_user.identities.build(provider: auth_hash.provider)
-        identity.extern_uid = auth_hash.uid
-
-        if auto_link_ldap_user? && !gl_user.ldap_user? && ldap_person
-          log.info "Correct LDAP account has been found. identity to user: #{gl_user.username}."
-          gl_user.identities.build(provider: ldap_person.provider, extern_uid: ldap_person.dn)
-        end
-      end
-
-      def find_or_build_ldap_user
-        return unless ldap_person
-
-        user = Gitlab::LDAP::User.find_by_uid_and_provider(ldap_person.dn, ldap_person.provider)
-        if user
-          log.info "LDAP account found for user #{user.username}. Building new #{auth_hash.provider} identity."
-          return user
-        end
-
-        log.info "No user found using #{auth_hash.provider} provider. Creating a new one."
-        build_new_user
-      end
-
-      def find_by_email
-        return unless auth_hash.has_attribute?(:email)
-
-        ::User.find_by(email: auth_hash.email.downcase)
-      end
-
-      def auto_link_ldap_user?
-        Gitlab.config.omniauth.auto_link_ldap_user
-      end
-
-      def creating_linked_ldap_user?
-        auto_link_ldap_user? && ldap_person
-      end
-
-      def ldap_person
-        return @ldap_person if defined?(@ldap_person)
-
-        # Look for a corresponding person with same uid in any of the configured LDAP providers
-        Gitlab::LDAP::Config.providers.each do |provider|
-          adapter = Gitlab::LDAP::Adapter.new(provider)
-          @ldap_person = find_ldap_person(auth_hash, adapter)
-          break if @ldap_person
-        end
-        @ldap_person
-      end
-
-      def find_ldap_person(auth_hash, adapter)
-        Gitlab::LDAP::Person.find_by_uid(auth_hash.uid, adapter) ||
-          Gitlab::LDAP::Person.find_by_email(auth_hash.uid, adapter) ||
-          Gitlab::LDAP::Person.find_by_dn(auth_hash.uid, adapter)
-      end
-
-      def ldap_config
-        Gitlab::LDAP::Config.new(ldap_person.provider) if ldap_person
-      end
-
-      def needs_blocking?
-        new? && block_after_signup?
-      end
-
-      def signup_enabled?
-        providers = Gitlab.config.omniauth.allow_single_sign_on
-        if providers.is_a?(Array)
-          providers.include?(auth_hash.provider)
-        else
-          providers
-        end
-      end
-
-      def external_provider?
-        Gitlab.config.omniauth.external_providers.include?(auth_hash.provider)
-      end
-
-      def block_after_signup?
-        if creating_linked_ldap_user?
-          ldap_config.block_auto_created_users
-        else
-          Gitlab.config.omniauth.block_auto_created_users
-        end
-      end
-
-      def auth_hash=(auth_hash)
-        @auth_hash = AuthHash.new(auth_hash)
-      end
-
-      def find_by_uid_and_provider
-        identity = Identity.with_extern_uid(auth_hash.provider, auth_hash.uid).take
-        identity && identity.user
-      end
-
-      def build_new_user
-        user_params = user_attributes.merge(skip_confirmation: true)
-        Users::BuildService.new(nil, user_params).execute(skip_authorization: true)
-      end
-
-      def user_attributes
-        # Give preference to LDAP for sensitive information when creating a linked account
-        if creating_linked_ldap_user?
-          username = ldap_person.username.presence
-          email = ldap_person.email.first.presence
-        end
-
-        username ||= auth_hash.username
-        email ||= auth_hash.email
-
-        valid_username = ::Namespace.clean_path(username)
-
-        uniquify = Uniquify.new
-        valid_username = uniquify.string(valid_username) { |s| !NamespacePathValidator.valid_path?(s) }
-
-        name = auth_hash.name
-        name = valid_username if name.strip.empty?
-
-        {
-          name:                       name,
-          username:                   valid_username,
-          email:                      email,
-          password:                   auth_hash.password,
-          password_confirmation:      auth_hash.password,
-          password_automatically_set: true
-        }
-      end
-
-      def sync_profile_from_provider?
-        Gitlab::OAuth::Provider.sync_profile_from_provider?(auth_hash.provider)
-      end
-
-      def update_profile
-        clear_user_synced_attributes_metadata
-
-        return unless sync_profile_from_provider? || creating_linked_ldap_user?
-
-        metadata = gl_user.build_user_synced_attributes_metadata
-
-        if sync_profile_from_provider?
-          UserSyncedAttributesMetadata::SYNCABLE_ATTRIBUTES.each do |key|
-            if auth_hash.has_attribute?(key) && gl_user.sync_attribute?(key)
-              gl_user[key] = auth_hash.public_send(key) # rubocop:disable GitlabSecurity/PublicSend
-              metadata.set_attribute_synced(key, true)
-            else
-              metadata.set_attribute_synced(key, false)
-            end
-          end
-
-          metadata.provider = auth_hash.provider
-        end
-
-        if creating_linked_ldap_user? && gl_user.email == ldap_person.email.first
-          metadata.set_attribute_synced(:email, true)
-          metadata.provider = ldap_person.provider
-        end
-      end
-
-      def clear_user_synced_attributes_metadata
-        gl_user&.user_synced_attributes_metadata&.destroy
-      end
-
-      def log
-        Gitlab::AppLogger
-      end
-
-      def oauth_provider_disabled?
-        Gitlab::CurrentSettings.current_application_settings
-                               .disabled_oauth_sign_in_sources
-                               .include?(auth_hash.provider)
-      end
-    end
-  end
-end

lib/gitlab/saml/auth_hash.rb

-module Gitlab
-  module Saml
-    class AuthHash < Gitlab::OAuth::AuthHash
-      def groups
-        Array.wrap(get_raw(Gitlab::Saml::Config.groups))
-      end
-
-      private
-
-      def get_raw(key)
-        # Needs to call `all` because of https://git.io/vVo4u
-        # otherwise just the first value is returned
-        auth_hash.extra[:raw_info].all[key]
-      end
-    end
-  end
-end

lib/gitlab/saml/config.rb

-module Gitlab
-  module Saml
-    class Config
-      class << self
-        def options
-          Gitlab.config.omniauth.providers.find { |provider| provider.name == 'saml' }
-        end
-
-        def groups
-          options[:groups_attribute]
-        end
-
-        def external_groups
-          options[:external_groups]
-        end
-
-        def required_groups
-          Array(options[:required_groups])
-        end
-
-        def admin_groups
-          options[:admin_groups]
-        end
-      end
-    end
-  end
-end

lib/gitlab/saml/user.rb

-# SAML extension for User model
-#
-# * Find GitLab user based on SAML uid and provider
-# * Create new user from SAML data
-#
-module Gitlab
-  module Saml
-    class User < Gitlab::OAuth::User
-      def save
-        super('SAML')
-      end
-
-      def find_user
-        user = find_by_uid_and_provider
-
-        user ||= find_by_email if auto_link_saml_user?
-        user ||= find_or_build_ldap_user if auto_link_ldap_user?
-        user ||= build_new_user if signup_enabled?
-
-        if user_in_required_group?
-          unblock_user(user, "in required group") if user.persisted? && user.blocked?
-        elsif user.persisted?
-          block_user(user, "not in required group") unless user.blocked?
-        else
-          user = nil
-        end
-
-        if user
-          user.external = !(auth_hash.groups & Gitlab::Saml::Config.external_groups).empty? if external_users_enabled?
-          user.admin = !(auth_hash.groups & Gitlab::Saml::Config.admin_groups).empty? if admin_groups_enabled?
-        end
-
-        user
-      end
-
-      def changed?
-        return true unless gl_user
-
-        gl_user.changed? || gl_user.identities.any?(&:changed?)
-      end
-
-      protected
-
-      def block_user(user, reason)
-        user.ldap_block
-        log_user_changes(user, "#{reason}, blocking")
-      end
-
-      def unblock_user(user, reason)
-        user.activate
-        log_user_changes(user, "#{reason}, unblocking")
-      end
-
-      def log_user_changes(user, message)
-        Gitlab::AppLogger.info(
-          "SAML(#{auth_hash.provider}) account \"#{auth_hash.uid}\" #{message} " \
-          "Gitlab user \"#{user.name}\" (#{user.email})"
-        )
-      end
-
-      def user_in_required_group?
-        required_groups = Gitlab::Saml::Config.required_groups
-        required_groups.empty? || !(auth_hash.groups & required_groups).empty?
-      end
-
-      def auto_link_saml_user?
-        Gitlab.config.omniauth.auto_link_saml_user
-      end
-
-      def external_users_enabled?
-        !Gitlab::Saml::Config.external_groups.nil?
-      end
-
-      def auth_hash=(auth_hash)
-        @auth_hash = Gitlab::Saml::AuthHash.new(auth_hash)
-      end
-
-      def admin_groups_enabled?
-        !Gitlab::Saml::Config.admin_groups.nil?
-      end
-    end
-  end
-end

lib/gitlab/user_access.rb

@@ -31,7 +31,7 @@ module Gitlab
       return false unless can_access_git?
 
       if user.requires_ldap_check? && user.try_obtain_ldap_lease
-        return false unless Gitlab::LDAP::Access.allowed?(user)
+        return false unless Gitlab::Auth::LDAP::Access.allowed?(user)
       end
 
       true

lib/tasks/gitlab/check.rake

@@ -339,7 +339,7 @@ namespace :gitlab do
       warn_user_is_not_gitlab
       start_checking "LDAP"
 
-      if Gitlab::LDAP::Config.enabled?
+      if Gitlab::Auth::LDAP::Config.enabled?
         check_ldap(args.limit)
       else
         puts 'LDAP is disabled in config/gitlab.yml'
@@ -349,13 +349,13 @@ namespace :gitlab do
     end
 
     def check_ldap(limit)
-      servers = Gitlab::LDAP::Config.providers
+      servers = Gitlab::Auth::LDAP::Config.providers
 
       servers.each do |server|
         puts "Server: #{server}"
 
         begin
-          Gitlab::LDAP::Adapter.open(server) do |adapter|
+          Gitlab::Auth::LDAP::Adapter.open(server) do |adapter|
             check_ldap_auth(adapter)
 
             puts "LDAP users with access to your GitLab server (only showing the first #{limit} results)"

lib/tasks/gitlab/cleanup.rake

@@ -117,7 +117,7 @@ namespace :gitlab do
 
         print "#{user.name} (#{user.ldap_identity.extern_uid}) ..."
 
-        if Gitlab::LDAP::Access.allowed?(user)
+        if Gitlab::Auth::LDAP::Access.allowed?(user)
           puts " [OK]".color(:green)
         else
           if block_flag

spec/features/admin/admin_settings_spec.rb

@@ -32,7 +32,7 @@ feature 'Admin updates settings' do
   describe 'LDAP settings' do
     context 'with LDAP enabled' do
       scenario 'Change allow group owners to manage ldap' do
-        allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+        allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
         visit admin_application_settings_path
 
         find('#application_setting_allow_group_owners_to_manage_ldap').set(false)

spec/features/admin/admin_users_spec.rb

@@ -444,7 +444,7 @@ describe "Admin::Users" do
 
   describe 'update user identities' do
     before do
-      allow(Gitlab::OAuth::Provider).to receive(:providers).and_return([:twitter, :twitter_updated])
+      allow(Gitlab::Auth::OAuth::Provider).to receive(:providers).and_return([:twitter, :twitter_updated])
     end
 
     it 'modifies twitter identity' do

spec/features/groups/group_settings_spec.rb

@@ -13,7 +13,7 @@ feature 'Edit group settings' do
     context 'with LDAP enabled' do
       before do
         allow_any_instance_of(Group).to receive(:ldap_synced?).and_return(true)
-        allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+        allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
       end
 
       scenario 'is able to navigate to LDAP group section' do

spec/lib/gitlab/ldap/access_spec.rb → spec/lib/gitlab/auth/ldap/access_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::Access do
+describe Gitlab::Auth::LDAP::Access do
   include LdapHelpers
 
   let(:access) { described_class.new user }
@@ -19,14 +19,14 @@ describe Gitlab::LDAP::Access do
 
   describe '#find_ldap_user' do
     it 'finds a user by dn first' do
-      expect(Gitlab::LDAP::Person).to receive(:find_by_dn).and_return(:ldap_user)
+      expect(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(:ldap_user)
 
       access.find_ldap_user
     end
 
     it 'finds a user by email if the email came from LDAP' do
-      expect(Gitlab::LDAP::Person).to receive(:find_by_dn).and_return(nil)
-      expect(Gitlab::LDAP::Person).to receive(:find_by_email)
+      expect(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(nil)
+      expect(Gitlab::Auth::LDAP::Person).to receive(:find_by_email)
 
       access.find_ldap_user
     end
@@ -37,7 +37,7 @@ describe Gitlab::LDAP::Access do
 
     context 'when the user cannot be found' do
       before do
-        allow(Gitlab::LDAP::Person).to receive(:find_by_dn).and_return(nil)
+        allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(nil)
       end
 
       it { is_expected.to be_falsey }
@@ -57,12 +57,12 @@ describe Gitlab::LDAP::Access do
 
     context 'when the user is found' do
       before do
-        allow(Gitlab::LDAP::Person).to receive(:find_by_dn).and_return(:ldap_user)
+        allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(:ldap_user)
       end
 
       context 'and the user is disabled via active directory' do
         before do
-          allow(Gitlab::LDAP::Person).to receive(:disabled_via_active_directory?).and_return(true)
+          allow(Gitlab::Auth::LDAP::Person).to receive(:disabled_via_active_directory?).and_return(true)
         end
 
         it { is_expected.to be_falsey }
@@ -76,7 +76,7 @@ describe Gitlab::LDAP::Access do
 
       context 'and has no disabled flag in active directory' do
         before do
-          allow(Gitlab::LDAP::Person).to receive(:disabled_via_active_directory?).and_return(false)
+          allow(Gitlab::Auth::LDAP::Person).to receive(:disabled_via_active_directory?).and_return(false)
         end
 
         it { is_expected.to be_truthy }
@@ -111,15 +111,15 @@ describe Gitlab::LDAP::Access do
 
       context 'without ActiveDirectory enabled' do
         before do
-          allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
-          allow_any_instance_of(Gitlab::LDAP::Config).to receive(:active_directory).and_return(false)
+          allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
+          allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive(:active_directory).and_return(false)
         end
 
         it { is_expected.to be_truthy }
 
         context 'when user cannot be found' do
           before do
-            allow(Gitlab::LDAP::Person).to receive(:find_by_dn).and_return(nil)
+            allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(nil)
           end
 
           it { is_expected.to be_falsey }
@@ -196,7 +196,7 @@ describe Gitlab::LDAP::Access do
     before do
       allow(access).to(
         receive_messages(
-          ldap_user: Gitlab::LDAP::Person.new(entry, user.ldap_identity.provider)
+          ldap_user: Gitlab::Auth::LDAP::Person.new(entry, user.ldap_identity.provider)
         )
       )
     end
@@ -240,18 +240,18 @@ describe Gitlab::LDAP::Access do
     end
 
     before do
-      allow(access).to receive_messages(ldap_user: Gitlab::LDAP::Person.new(entry, user.ldap_identity.provider))
+      allow(access).to receive_messages(ldap_user: Gitlab::Auth::LDAP::Person.new(entry, user.ldap_identity.provider))
     end
 
     it "adds a Kerberos identity if it is in Active Directory but not in GitLab" do
-      allow_any_instance_of(EE::Gitlab::LDAP::Person).to receive_messages(kerberos_principal: "mylogin@FOO.COM")
+      allow_any_instance_of(EE::Gitlab::Auth::LDAP::Person).to receive_messages(kerberos_principal: "mylogin@FOO.COM")
 
       expect { access.update_kerberos_identity }.to change(user.identities.where(provider: :kerberos), :count).from(0).to(1)
       expect(user.identities.where(provider: "kerberos").last.extern_uid).to eq("mylogin@FOO.COM")
     end
 
     it "updates existing Kerberos identity in GitLab if Active Directory has a different one" do
-      allow_any_instance_of(EE::Gitlab::LDAP::Person).to receive_messages(kerberos_principal: "otherlogin@BAR.COM")
+      allow_any_instance_of(EE::Gitlab::Auth::LDAP::Person).to receive_messages(kerberos_principal: "otherlogin@BAR.COM")
       user.identities.build(provider: "kerberos", extern_uid: "mylogin@FOO.COM").save
 
       expect { access.update_kerberos_identity }.not_to change(user.identities.where(provider: "kerberos"), :count)
@@ -259,7 +259,7 @@ describe Gitlab::LDAP::Access do
     end
 
     it "does not remove Kerberos identities from GitLab if they are none in the LDAP provider" do
-      allow_any_instance_of(EE::Gitlab::LDAP::Person).to receive_messages(kerberos_principal: nil)
+      allow_any_instance_of(EE::Gitlab::Auth::LDAP::Person).to receive_messages(kerberos_principal: nil)
       user.identities.build(provider: "kerberos", extern_uid: "otherlogin@BAR.COM").save
 
       expect { access.update_kerberos_identity }.not_to change(user.identities.where(provider: "kerberos"), :count)
@@ -267,7 +267,7 @@ describe Gitlab::LDAP::Access do
     end
 
     it "does not modify identities in GitLab if they are no kerberos principal in the LDAP provider" do
-      allow_any_instance_of(EE::Gitlab::LDAP::Person).to receive_messages(kerberos_principal: nil)
+      allow_any_instance_of(EE::Gitlab::Auth::LDAP::Person).to receive_messages(kerberos_principal: nil)
 
       expect { access.update_kerberos_identity }.not_to change(user.identities, :count)
     end
@@ -281,18 +281,18 @@ describe Gitlab::LDAP::Access do
     end
 
     before do
-      allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(sync_ssh_keys: ssh_key_attribute_name)
+      allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(sync_ssh_keys: ssh_key_attribute_name)
       allow(access).to receive_messages(sync_ssh_keys?: true)
     end
 
     it "adds a SSH key if it is in LDAP but not in gitlab" do
-      allow_any_instance_of(Gitlab::LDAP::Adapter).to receive(:user) { Gitlab::LDAP::Person.new(entry, 'ldapmain') }
+      allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
 
       expect { access.update_ssh_keys }.to change(user.keys, :count).from(0).to(1)
     end
 
     it "adds a SSH key and give it a proper name" do
-      allow_any_instance_of(Gitlab::LDAP::Adapter).to receive(:user) { Gitlab::LDAP::Person.new(entry, 'ldapmain') }
+      allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
 
       access.update_ssh_keys
       expect(user.keys.last.title).to match(/LDAP/)
@@ -301,7 +301,7 @@ describe Gitlab::LDAP::Access do
 
     it "does not add a SSH key if it is invalid" do
       entry = Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com\n#{ssh_key_attribute_name}: I am not a valid key")
-      allow_any_instance_of(Gitlab::LDAP::Adapter).to receive(:user) { Gitlab::LDAP::Person.new(entry, 'ldapmain') }
+      allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
 
       expect { access.update_ssh_keys }.not_to change(user.keys, :count)
     end
@@ -313,14 +313,14 @@ describe Gitlab::LDAP::Access do
 
       it "removes a SSH key if it is no longer in LDAP" do
         entry = Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com\n#{ssh_key_attribute_name}:\n")
-        allow_any_instance_of(Gitlab::LDAP::Adapter).to receive(:user) { Gitlab::LDAP::Person.new(entry, 'ldapmain') }
+        allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
 
         expect { access.update_ssh_keys }.to change(user.keys, :count).from(1).to(0)
       end
 
       it "removes a SSH key if the ldap attribute was removed" do
         entry = Net::LDAP::Entry.from_single_ldif_string("dn: cn=foo, dc=bar, dc=com")
-        allow_any_instance_of(Gitlab::LDAP::Adapter).to receive(:user) { Gitlab::LDAP::Person.new(entry, 'ldapmain') }
+        allow_any_instance_of(Gitlab::Auth::LDAP::Adapter).to receive(:user) { Gitlab::Auth::LDAP::Person.new(entry, 'ldapmain') }
 
         expect { access.update_ssh_keys }.to change(user.keys, :count).from(1).to(0)
       end
@@ -331,7 +331,7 @@ describe Gitlab::LDAP::Access do
     let(:entry) { Net::LDAP::Entry.new }
 
     before do
-      allow(access).to receive_messages(ldap_user: Gitlab::LDAP::Person.new(entry, user.ldap_identity.provider))
+      allow(access).to receive_messages(ldap_user: Gitlab::Auth::LDAP::Person.new(entry, user.ldap_identity.provider))
     end
 
     it "does not update email if email attribute is not set" do
@@ -361,7 +361,7 @@ describe Gitlab::LDAP::Access do
     let(:person_with_memberof) do
       entry['memberof'] = ['CN=Group1,CN=Users,DC=The dc,DC=com',
                            'CN=Group2,CN=Builtin,DC=The dc,DC=com']
-      Gitlab::LDAP::Person.new(entry, provider)
+      Gitlab::Auth::LDAP::Person.new(entry, provider)
     end
 
     it 'triggers a sync for all groups found in `memberof`' do
@@ -379,7 +379,7 @@ describe Gitlab::LDAP::Access do
 
     it "doesn't continue when there is no `memberOf` param" do
       allow(access).to receive(:ldap_user)
-                         .and_return(Gitlab::LDAP::Person.new(entry, provider))
+                         .and_return(Gitlab::Auth::LDAP::Person.new(entry, provider))
 
       expect(LdapGroupLink).not_to receive(:where)
       expect(LdapGroupSyncWorker).not_to receive(:perform_async)
@@ -404,7 +404,7 @@ describe Gitlab::LDAP::Access do
     it 'updates the external UID if it changed in the entry' do
       entry = ldap_user_entry('another uid')
       provider = user.ldap_identity.provider
-      person = Gitlab::LDAP::Person.new(entry, provider)
+      person = Gitlab::Auth::LDAP::Person.new(entry, provider)
 
       allow(access).to receive(:ldap_user).and_return(person)
 

spec/lib/gitlab/ldap/adapter_spec.rb → spec/lib/gitlab/auth/ldap/adapter_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::Adapter do
+describe Gitlab::Auth::LDAP::Adapter do
   include LdapHelpers
 
   let(:ldap) { double(:ldap) }
@@ -139,6 +139,6 @@ describe Gitlab::LDAP::Adapter do
   end
 
   def ldap_attributes
-    Gitlab::LDAP::Person.ldap_attributes(Gitlab::LDAP::Config.new('ldapmain'))
+    Gitlab::Auth::LDAP::Person.ldap_attributes(Gitlab::Auth::LDAP::Config.new('ldapmain'))
   end
 end

spec/lib/gitlab/ldap/auth_hash_spec.rb → spec/lib/gitlab/auth/ldap/auth_hash_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::AuthHash do
+describe Gitlab::Auth::LDAP::AuthHash do
   include LdapHelpers
 
   let(:auth_hash) do
@@ -56,7 +56,7 @@ describe Gitlab::LDAP::AuthHash do
     end
 
     before do
-      allow_any_instance_of(Gitlab::LDAP::Config).to receive(:attributes).and_return(attributes)
+      allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive(:attributes).and_return(attributes)
     end
 
     it "has the correct username" do

spec/lib/gitlab/ldap/authentication_spec.rb → spec/lib/gitlab/auth/ldap/authentication_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::Authentication do
+describe Gitlab::Auth::LDAP::Authentication do
   let(:dn)       { 'uid=John Smith, ou=People, dc=example, dc=com' }
-  let(:user)     { create(:omniauth_user, extern_uid: Gitlab::LDAP::Person.normalize_dn(dn)) }
+  let(:user)     { create(:omniauth_user, extern_uid: Gitlab::Auth::LDAP::Person.normalize_dn(dn)) }
   let(:login)    { 'john' }
   let(:password) { 'password' }
 
   describe 'login' do
     before do
-      allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+      allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
     end
 
     it "finds the user if authentication is successful" do
@@ -43,7 +43,7 @@ describe Gitlab::LDAP::Authentication do
     end
 
     it "fails if ldap is disabled" do
-      allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(false)
+      allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(false)
       expect(described_class.login(login, password)).to be_falsey
     end
 

spec/lib/gitlab/ldap/config_spec.rb → spec/lib/gitlab/auth/ldap/config_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::Config do
+describe Gitlab::Auth::LDAP::Config do
   include LdapHelpers
 
   let(:config) { described_class.new('ldapmain') }
@@ -23,7 +23,7 @@ describe Gitlab::LDAP::Config do
     end
 
     it 'raises an error if a unknown provider is used' do
-      expect { described_class.new 'unknown' }.to raise_error(Gitlab::LDAP::Config::InvalidProvider)
+      expect { described_class.new 'unknown' }.to raise_error(Gitlab::Auth::LDAP::Config::InvalidProvider)
     end
   end
 

spec/lib/gitlab/ldap/dn_spec.rb → spec/lib/gitlab/auth/ldap/dn_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::DN do
+describe Gitlab::Auth::LDAP::DN do
   using RSpec::Parameterized::TableSyntax
 
   describe '#normalize_value' do
@@ -13,7 +13,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'John Smith,' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
@@ -21,7 +21,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '#aa aa' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the end of an attribute value, but got \"a\"")
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, "Expected the end of an attribute value, but got \"a\"")
         end
       end
 
@@ -29,7 +29,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '#aaXaaa' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the first character of a hex pair, but got \"X\"")
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, "Expected the first character of a hex pair, but got \"X\"")
         end
       end
 
@@ -37,7 +37,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '#aaaYaa' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the second character of a hex pair, but got \"Y\"")
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, "Expected the second character of a hex pair, but got \"Y\"")
         end
       end
 
@@ -45,7 +45,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '"Sebasti\\cX\\a1n"' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
         end
       end
 
@@ -53,7 +53,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '"James' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
@@ -61,7 +61,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'J\ames' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Invalid escaped hex code "\am"')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'Invalid escaped hex code "\am"')
         end
       end
 
@@ -69,7 +69,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'foo\\' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
     end
@@ -86,7 +86,7 @@ describe Gitlab::LDAP::DN do
           let(:given) { 'uid=john smith+telephonenumber=+1 555-555-5555,ou=people,dc=example,dc=com' }
 
           it 'raises UnsupportedError' do
-            expect { subject }.to raise_error(Gitlab::LDAP::DN::UnsupportedError)
+            expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::UnsupportedError)
           end
         end
 
@@ -95,7 +95,7 @@ describe Gitlab::LDAP::DN do
             let(:given) { 'uid = John Smith  + telephoneNumber  = + 1 555-555-5555 , ou = People,dc=example,dc=com' }
 
             it 'raises UnsupportedError' do
-              expect { subject }.to raise_error(Gitlab::LDAP::DN::UnsupportedError)
+              expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::UnsupportedError)
             end
           end
 
@@ -103,7 +103,7 @@ describe Gitlab::LDAP::DN do
             let(:given) { 'uid = John Smith  + telephoneNumber  = +1 555-555-5555 , ou = People,dc=example,dc=com' }
 
             it 'raises UnsupportedError' do
-              expect { subject }.to raise_error(Gitlab::LDAP::DN::UnsupportedError)
+              expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::UnsupportedError)
             end
           end
         end
@@ -115,7 +115,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'uid=John Smith,' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
@@ -123,7 +123,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '0.9.2342.19200300.100.1.25=#aa aa' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the end of an attribute value, but got \"a\"")
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, "Expected the end of an attribute value, but got \"a\"")
         end
       end
 
@@ -131,7 +131,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '0.9.2342.19200300.100.1.25=#aaXaaa' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the first character of a hex pair, but got \"X\"")
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, "Expected the first character of a hex pair, but got \"X\"")
         end
       end
 
@@ -139,7 +139,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '0.9.2342.19200300.100.1.25=#aaaYaa' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the second character of a hex pair, but got \"Y\"")
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, "Expected the second character of a hex pair, but got \"Y\"")
         end
       end
 
@@ -147,7 +147,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'uid="Sebasti\\cX\\a1n"' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, "Expected the second character of a hex pair inside a double quoted value, but got \"X\"")
         end
       end
 
@@ -155,7 +155,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'John' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
@@ -163,7 +163,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'cn="James' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
@@ -171,7 +171,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'cn=J\ames' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Invalid escaped hex code "\am"')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'Invalid escaped hex code "\am"')
         end
       end
 
@@ -179,7 +179,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'cn=\\' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'DN string ended unexpectedly')
         end
       end
 
@@ -187,7 +187,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { '1.2.d=Value' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Unrecognized RDN OID attribute type name character "d"')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'Unrecognized RDN OID attribute type name character "d"')
         end
       end
 
@@ -195,7 +195,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'd1.2=Value' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Unrecognized RDN attribute type name character "."')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'Unrecognized RDN attribute type name character "."')
         end
       end
 
@@ -203,7 +203,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { ' -uid=John Smith' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Unrecognized first character of an RDN attribute type name "-"')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'Unrecognized first character of an RDN attribute type name "-"')
         end
       end
 
@@ -211,7 +211,7 @@ describe Gitlab::LDAP::DN do
         let(:given) { 'uid\\=john' }
 
         it 'raises MalformedError' do
-          expect { subject }.to raise_error(Gitlab::LDAP::DN::MalformedError, 'Unrecognized RDN attribute type name character "\\"')
+          expect { subject }.to raise_error(Gitlab::Auth::LDAP::DN::MalformedError, 'Unrecognized RDN attribute type name character "\\"')
         end
       end
     end

spec/lib/gitlab/ldap/person_spec.rb → spec/lib/gitlab/auth/ldap/person_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::Person do
+describe Gitlab::Auth::LDAP::Person do
   include LdapHelpers
 
   let(:entry) { ldap_user_entry('john.doe') }
@@ -59,7 +59,7 @@ describe Gitlab::LDAP::Person do
           }
         }
       )
-      config = Gitlab::LDAP::Config.new('ldapmain')
+      config = Gitlab::Auth::LDAP::Config.new('ldapmain')
       ldap_attributes = described_class.ldap_attributes(config)
 
       expect(ldap_attributes).to match_array(%w(dn uid cn mail memberof))

spec/lib/gitlab/ldap/user_spec.rb → spec/lib/gitlab/auth/ldap/user_spec.rb

 require 'spec_helper'
 
-describe Gitlab::LDAP::User do
+describe Gitlab::Auth::LDAP::User do
   include LdapHelpers
 
   let(:ldap_user) { described_class.new(auth_hash) }

spec/lib/gitlab/o_auth/auth_hash_spec.rb → spec/lib/gitlab/auth/o_auth/auth_hash_spec.rb

 require 'spec_helper'
 
-describe Gitlab::OAuth::AuthHash do
+describe Gitlab::Auth::OAuth::AuthHash do
   let(:provider) { 'ldap'.freeze }
   let(:auth_hash) do
     described_class.new(

spec/lib/gitlab/o_auth/provider_spec.rb → spec/lib/gitlab/auth/o_auth/provider_spec.rb

 require 'spec_helper'
 
-describe Gitlab::OAuth::Provider do
+describe Gitlab::Auth::OAuth::Provider do
   describe '#config_for' do
     context 'for an LDAP provider' do
       context 'when the provider exists' do

spec/lib/gitlab/o_auth/user_spec.rb → spec/lib/gitlab/auth/o_auth/user_spec.rb

 require 'spec_helper'
 
-describe Gitlab::OAuth::User do
+describe Gitlab::Auth::OAuth::User do
   let(:oauth_user) { described_class.new(auth_hash) }
   let(:gl_user) { oauth_user.gl_user }
   let(:uid) { 'my-uid' }
@@ -18,7 +18,7 @@ describe Gitlab::OAuth::User do
       }
     }
   end
-  let(:ldap_user) { Gitlab::LDAP::Person.new(Net::LDAP::Entry.new, 'ldapmain') }
+  let(:ldap_user) { Gitlab::Auth::LDAP::Person.new(Net::LDAP::Entry.new, 'ldapmain') }
 
   describe '#persisted?' do
     let!(:existing_user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
@@ -39,7 +39,7 @@ describe Gitlab::OAuth::User do
 
   describe '#save' do
     def stub_ldap_config(messages)
-      allow(Gitlab::LDAP::Config).to receive_messages(messages)
+      allow(Gitlab::Auth::LDAP::Config).to receive_messages(messages)
     end
 
     let(:provider) { 'twitter' }
@@ -215,7 +215,7 @@ describe Gitlab::OAuth::User do
 
             context "and no account for the LDAP user" do
               before do
-                allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
+                allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
 
                 oauth_user.save
               end
@@ -250,7 +250,7 @@ describe Gitlab::OAuth::User do
             context "and LDAP user has an account already" do
               let!(:existing_user) { create(:omniauth_user, email: 'john@example.com', extern_uid: dn, provider: 'ldapmain', username: 'john') }
               it "adds the omniauth identity to the LDAP account" do
-                allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
+                allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
 
                 oauth_user.save
 
@@ -270,8 +270,8 @@ describe Gitlab::OAuth::User do
 
             context 'when an LDAP person is not found by uid' do
               it 'tries to find an LDAP person by DN and adds the omniauth identity to the user' do
-                allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(nil)
-                allow(Gitlab::LDAP::Person).to receive(:find_by_dn).and_return(ldap_user)
+                allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(nil)
+                allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(ldap_user)
 
                 oauth_user.save
 
@@ -297,7 +297,7 @@ describe Gitlab::OAuth::User do
 
             context 'and no account for the LDAP user' do
               it 'creates a user favoring the LDAP username and strips email domain' do
-                allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
+                allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
 
                 oauth_user.save
 
@@ -309,7 +309,7 @@ describe Gitlab::OAuth::User do
 
           context "and no corresponding LDAP person" do
             before do
-              allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(nil)
+              allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(nil)
             end
 
             include_examples "to verify compliance with allow_single_sign_on"
@@ -358,13 +358,13 @@ describe Gitlab::OAuth::User do
           allow(ldap_user).to receive(:username) { uid }
           allow(ldap_user).to receive(:email) { ['johndoe@example.com', 'john2@example.com'] }
           allow(ldap_user).to receive(:dn) { dn }
-          allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
+          allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
         end
 
         context "and no account for the LDAP user" do
           context 'dont block on create (LDAP)' do
             before do
-              allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: false)
+              allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: false)
             end
 
             it do
@@ -376,7 +376,7 @@ describe Gitlab::OAuth::User do
 
           context 'block on create (LDAP)' do
             before do
-              allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: true)
+              allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: true)
             end
 
             it do
@@ -392,7 +392,7 @@ describe Gitlab::OAuth::User do
 
           context 'dont block on create (LDAP)' do
             before do
-              allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: false)
+              allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: false)
             end
 
             it do
@@ -404,7 +404,7 @@ describe Gitlab::OAuth::User do
 
           context 'block on create (LDAP)' do
             before do
-              allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: true)
+              allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: true)
             end
 
             it do
@@ -448,7 +448,7 @@ describe Gitlab::OAuth::User do
 
         context 'dont block on create (LDAP)' do
           before do
-            allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: false)
+            allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: false)
           end
 
           it do
@@ -460,7 +460,7 @@ describe Gitlab::OAuth::User do
 
         context 'block on create (LDAP)' do
           before do
-            allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: true)
+            allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: true)
           end
 
           it do

spec/lib/gitlab/saml/auth_hash_spec.rb → spec/lib/gitlab/auth/saml/auth_hash_spec.rb

 require 'spec_helper'
 
-describe Gitlab::Saml::AuthHash do
+describe Gitlab::Auth::Saml::AuthHash do
   include LoginHelpers
 
   let(:raw_info_attr) { { 'groups' => %w(Developers Freelancers) } }

spec/lib/gitlab/saml/user_spec.rb → spec/lib/gitlab/auth/saml/user_spec.rb

 require 'spec_helper'
 
-describe Gitlab::Saml::User do
+describe Gitlab::Auth::Saml::User do
   include LdapHelpers
   include LoginHelpers
 
@@ -17,7 +17,7 @@ describe Gitlab::Saml::User do
       email: 'john@mail.com'
     }
   end
-  let(:ldap_user) { Gitlab::LDAP::Person.new(Net::LDAP::Entry.new, 'ldapmain') }
+  let(:ldap_user) { Gitlab::Auth::LDAP::Person.new(Net::LDAP::Entry.new, 'ldapmain') }
 
   describe '#save' do
     def stub_omniauth_config(messages)
@@ -25,23 +25,23 @@ describe Gitlab::Saml::User do
     end
 
     def stub_ldap_config(messages)
-      allow(Gitlab::LDAP::Config).to receive_messages(messages)
+      allow(Gitlab::Auth::LDAP::Config).to receive_messages(messages)
     end
 
     def stub_basic_saml_config
-      allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', args: {} } })
+      allow(Gitlab::Auth::Saml::Config).to receive_messages({ options: { name: 'saml', args: {} } })
     end
 
     def stub_saml_group_config(groups)
-      allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', external_groups: groups, args: {} } })
+      allow(Gitlab::Auth::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', external_groups: groups, args: {} } })
     end
 
     def stub_saml_required_group_config(groups)
-      allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', required_groups: groups, args: {} } })
+      allow(Gitlab::Auth::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', required_groups: groups, args: {} } })
     end
 
     def stub_saml_admin_group_config(groups)
-      allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', admin_groups: groups, args: {} } })
+      allow(Gitlab::Auth::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', admin_groups: groups, args: {} } })
     end
 
     before do
@@ -216,7 +216,7 @@ describe Gitlab::Saml::User do
 
           it 'does not allow non-members' do
             stub_saml_required_group_config(%w(ArchitectureAstronauts))
-            expect { saml_user.save }.to raise_error Gitlab::OAuth::SignupDisabledError
+            expect { saml_user.save }.to raise_error Gitlab::Auth::OAuth::User::SignupDisabledError
           end
 
           it 'blocks non-members' do
@@ -276,10 +276,10 @@ describe Gitlab::Saml::User do
               allow(ldap_user).to receive(:username) { uid }
               allow(ldap_user).to receive(:email) { %w(john@mail.com john2@example.com) }
               allow(ldap_user).to receive(:dn) { dn }
-              allow(Gitlab::LDAP::Adapter).to receive(:new).and_return(adapter)
-              allow(Gitlab::LDAP::Person).to receive(:find_by_uid).with(uid, adapter).and_return(ldap_user)
-              allow(Gitlab::LDAP::Person).to receive(:find_by_dn).with(dn, adapter).and_return(ldap_user)
-              allow(Gitlab::LDAP::Person).to receive(:find_by_email).with('john@mail.com', adapter).and_return(ldap_user)
+              allow(Gitlab::Auth::LDAP::Adapter).to receive(:new).and_return(adapter)
+              allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).with(uid, adapter).and_return(ldap_user)
+              allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).with(dn, adapter).and_return(ldap_user)
+              allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_email).with('john@mail.com', adapter).and_return(ldap_user)
             end
 
             context 'and no account for the LDAP user' do
@@ -327,10 +327,10 @@ describe Gitlab::Saml::User do
                   nil_types = uid_types - [uid_type]
 
                   nil_types.each do |type|
-                    allow(Gitlab::LDAP::Person).to receive(:"find_by_#{type}").and_return(nil)
+                    allow(Gitlab::Auth::LDAP::Person).to receive(:"find_by_#{type}").and_return(nil)
                   end
 
-                  allow(Gitlab::LDAP::Person).to receive(:"find_by_#{uid_type}").and_return(ldap_user)
+                  allow(Gitlab::Auth::LDAP::Person).to receive(:"find_by_#{uid_type}").and_return(ldap_user)
                 end
 
                 it 'adds the omniauth identity to the LDAP account' do
@@ -397,7 +397,7 @@ describe Gitlab::Saml::User do
               it 'adds the LDAP identity to the existing SAML user' do
                 create(:omniauth_user, email: 'john@mail.com', extern_uid: dn, provider: 'saml', username: 'john')
 
-                allow(Gitlab::LDAP::Person).to receive(:find_by_uid).with(dn, adapter).and_return(ldap_user)
+                allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).with(dn, adapter).and_return(ldap_user)
 
                 local_hash = OmniAuth::AuthHash.new(uid: dn, provider: provider, info: info_hash)
                 local_saml_user = described_class.new(local_hash)

spec/lib/gitlab/auth_spec.rb

@@ -309,17 +309,17 @@ describe Gitlab::Auth do
 
     context "with ldap enabled" do
       before do
-        allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+        allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
       end
 
       it "tries to autheticate with db before ldap" do
-        expect(Gitlab::LDAP::Authentication).not_to receive(:login)
+        expect(Gitlab::Auth::LDAP::Authentication).not_to receive(:login)
 
         gl_auth.find_with_user_password(username, password)
       end
 
       it "uses ldap as fallback to for authentication" do
-        expect(Gitlab::LDAP::Authentication).to receive(:login)
+        expect(Gitlab::Auth::LDAP::Authentication).to receive(:login)
 
         gl_auth.find_with_user_password('ldap_user', 'password')
       end
@@ -336,7 +336,7 @@ describe Gitlab::Auth do
 
       context "with ldap enabled" do
         before do
-          allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+          allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
         end
 
         it "does not find non-ldap user by valid login/password" do

spec/requests/api/groups_spec.rb

@@ -938,7 +938,7 @@ describe API::Groups do
 
   describe 'POST /groups/:id/ldap_sync' do
     before do
-      allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
+      allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
     end
 
     context 'when the ldap_group_sync feature is available' do

spec/requests/git_http_spec.rb

@@ -506,8 +506,8 @@ describe 'Git HTTP requests' do
 
                 context 'when LDAP is configured' do
                   before do
-                    allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
-                    allow_any_instance_of(Gitlab::LDAP::Authentication)
+                    allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
+                    allow_any_instance_of(Gitlab::Auth::LDAP::Authentication)
                       .to receive(:login).and_return(nil)
                   end
 
@@ -919,9 +919,9 @@ describe 'Git HTTP requests' do
     let(:path) { 'doesnt/exist.git' }
 
     before do
-      allow(Gitlab::LDAP::Config).to receive(:enabled?).and_return(true)
-      allow(Gitlab::LDAP::Authentication).to receive(:login).and_return(nil)
-      allow(Gitlab::LDAP::Authentication).to receive(:login).with(user.username, user.password).and_return(user)
+      allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
+      allow(Gitlab::Auth::LDAP::Authentication).to receive(:login).and_return(nil)
+      allow(Gitlab::Auth::LDAP::Authentication).to receive(:login).with(user.username, user.password).and_return(user)
     end
 
     it_behaves_like 'pulls require Basic HTTP Authentication'

spec/support/ldap_helpers.rb

@@ -2,12 +2,12 @@ module LdapHelpers
   include EE::LdapHelpers
 
   def ldap_adapter(provider = 'ldapmain', ldap = double(:ldap))
-    ::Gitlab::LDAP::Adapter.new(provider, ldap)
+    ::Gitlab::Auth::LDAP::Adapter.new(provider, ldap)
   end
 
   def fake_ldap_sync_proxy(provider)
     fake_proxy = double(:proxy, adapter: ldap_adapter)
-    allow(::EE::Gitlab::LDAP::Sync::Proxy).to receive(:open).with(provider).and_yield(fake_proxy)
+    allow(::EE::Gitlab::Auth::LDAP::Sync::Proxy).to receive(:open).with(provider).and_yield(fake_proxy)
     fake_proxy
   end
 
@@ -15,7 +15,7 @@ module LdapHelpers
     "uid=#{uid},ou=users,dc=example,dc=com"
   end
 
-  # Accepts a hash of Gitlab::LDAP::Config keys and values.
+  # Accepts a hash of Gitlab::Auth::LDAP::Config keys and values.
   #
   # Example:
   #   stub_ldap_config(
@@ -23,21 +23,21 @@ module LdapHelpers
   #     admin_group: 'my-admin-group'
   #   )
   def stub_ldap_config(messages)
-    allow_any_instance_of(::Gitlab::LDAP::Config).to receive_messages(messages)
+    allow_any_instance_of(::Gitlab::Auth::LDAP::Config).to receive_messages(messages)
   end
 
   # Stub an LDAP person search and provide the return entry. Specify `nil` for
   # `entry` to simulate when an LDAP person is not found
   #
   # Example:
-  #  adapter = ::Gitlab::LDAP::Adapter.new('ldapmain', double(:ldap))
+  #  adapter = ::Gitlab::Auth::LDAP::Adapter.new('ldapmain', double(:ldap))
   #  ldap_user_entry = ldap_user_entry('john_doe')
   #
   #  stub_ldap_person_find_by_uid('john_doe', ldap_user_entry, adapter)
   def stub_ldap_person_find_by_uid(uid, entry, provider = 'ldapmain')
-    return_value = ::Gitlab::LDAP::Person.new(entry, provider) if entry.present?
+    return_value = ::Gitlab::Auth::LDAP::Person.new(entry, provider) if entry.present?
 
-    allow(::Gitlab::LDAP::Person)
+    allow(::Gitlab::Auth::LDAP::Person)
       .to receive(:find_by_uid).with(uid, any_args).and_return(return_value)
   end
 

spec/support/login_helpers.rb

@@ -138,7 +138,7 @@ module LoginHelpers
     Rails.application.routes.draw do
       post '/users/auth/saml' => 'omniauth_callbacks#saml'
     end
-    allow(Gitlab::OAuth::Provider).to receive_messages(providers: [:saml], config_for: mock_saml_config)
+    allow(Gitlab::Auth::OAuth::Provider).to receive_messages(providers: [:saml], config_for: mock_saml_config)
     stub_omniauth_setting(messages)
     allow_any_instance_of(Object).to receive(:user_saml_omniauth_authorize_path).and_return('/users/auth/saml')
     allow_any_instance_of(Object).to receive(:omniauth_authorize_path).with(:user, "saml").and_return('/users/auth/saml')
@@ -149,10 +149,10 @@ module LoginHelpers
   end
 
   def stub_basic_saml_config
-    allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', args: {} } })
+    allow(Gitlab::Auth::Saml::Config).to receive_messages({ options: { name: 'saml', args: {} } })
   end
 
   def stub_saml_group_config(groups)
-    allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', external_groups: groups, args: {} } })
+    allow(Gitlab::Auth::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', external_groups: groups, args: {} } })
   end
 end

spec/tasks/gitlab/check_rake_spec.rb

@@ -11,8 +11,8 @@ describe 'gitlab:ldap:check rake task' do
 
   context 'when LDAP is not enabled' do
     it 'does not attempt to bind or search for users' do
-      expect(Gitlab::LDAP::Config).not_to receive(:providers)
-      expect(Gitlab::LDAP::Adapter).not_to receive(:open)
+      expect(Gitlab::Auth::LDAP::Config).not_to receive(:providers)
+      expect(Gitlab::Auth::LDAP::Adapter).not_to receive(:open)
 
       run_rake_task('gitlab:ldap:check')
     end
@@ -23,12 +23,12 @@ describe 'gitlab:ldap:check rake task' do
     let(:adapter) { ldap_adapter('ldapmain', ldap) }
 
     before do
-      allow(Gitlab::LDAP::Config)
+      allow(Gitlab::Auth::LDAP::Config)
         .to receive_messages(
           enabled?: true,
           providers: ['ldapmain']
         )
-      allow(Gitlab::LDAP::Adapter).to receive(:open).and_yield(adapter)
+      allow(Gitlab::Auth::LDAP::Adapter).to receive(:open).and_yield(adapter)
       allow(adapter).to receive(:users).and_return([])
     end