diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template index 3e3f44ea01dedfcd02a47cfe9005ade71ddbea44_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..17f7ca0b4e68dcc3fe136a119455323a2a1bc0ba_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644 --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -521,6 +521,8 @@ # verify_certificates: true # smartcard_auth: false # active_directory: true +# smartcard_ad_cert_field: 'altSecurityIdentities' +# smartcard_ad_cert_format: null # 'issuer_and_serial_number', 'issuer_and_subject' , 'principal_name' # allow_username_or_email_login: false # lowercase_usernames: false # block_auto_created_users: false @@ -542,6 +544,8 @@ # verify_certificates: true # smartcard_auth: false # active_directory: true +# smartcard_ad_cert_field: 'altSecurityIdentities' +# smartcard_ad_cert_format: null # 'issuer_and_serial_number', 'issuer_and_subject' , 'principal_name' # allow_username_or_email_login: false # lowercase_usernames: false # block_auto_created_users: false diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb index 3e3f44ea01dedfcd02a47cfe9005ade71ddbea44_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..17f7ca0b4e68dcc3fe136a119455323a2a1bc0ba_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644 --- a/files/gitlab-cookbooks/gitlab/attributes/default.rb +++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb @@ -301,6 +301,8 @@ default['gitlab']['gitlab_rails']['ldap_sync_ssh_keys'] = nil default['gitlab']['gitlab_rails']['ldap_sync_time'] = nil default['gitlab']['gitlab_rails']['ldap_active_directory'] = nil +default['gitlab']['gitlab_rails']['ldap_smartcard_ad_cert_field'] = nil +default['gitlab']['gitlab_rails']['ldap_smartcard_ad_cert_format'] = nil #### default['gitlab']['gitlab_rails']['smartcard_enabled'] = false diff --git a/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb index 3e3f44ea01dedfcd02a47cfe9005ade71ddbea44_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvZ2l0bGFiLnltbC5lcmI=..17f7ca0b4e68dcc3fe136a119455323a2a1bc0ba_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvZ2l0bGFiLnltbC5lcmI= 100644 --- a/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb +++ b/files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb @@ -791,6 +791,8 @@ ## EE only group_base: <%= quote(@ldap_group_base) %> admin_group: <%= quote(@ldap_admin_group) %> + smartcard_ad_cert_field: <%= quote(@ldap_smartcard_ad_cert_field) %> + smartcard_ad_cert_format: <%= quote(@ldap_smartcard_ad_cert_format) %> sync_ssh_keys: <%= quote(@ldap_sync_ssh_keys) %> sync_time: <%= @ldap_sync_time %> <% end %> diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails/gitlab_yml/ldap_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails/gitlab_yml/ldap_spec.rb index 3e3f44ea01dedfcd02a47cfe9005ade71ddbea44_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMvZ2l0bGFiX3ltbC9sZGFwX3NwZWMucmI=..17f7ca0b4e68dcc3fe136a119455323a2a1bc0ba_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMvZ2l0bGFiX3ltbC9sZGFwX3NwZWMucmI= 100644 --- a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails/gitlab_yml/ldap_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails/gitlab_yml/ldap_spec.rb @@ -20,6 +20,8 @@ password: nil, port: nil, prevent_ldap_sign_in: false, + smartcard_ad_cert_field: nil, + smartcard_ad_cert_format: nil, sync_ssh_keys: nil, sync_time: nil, uid: nil, @@ -55,4 +57,5 @@ encryption: 'plain', bind_dn: 'dc=example,dc=com', password: 's3cr3t', + active_directory: true, smartcard_auth: 'required', @@ -58,4 +61,6 @@ smartcard_auth: 'required', + smartcard_ad_cert_field: 'extendedAttribute1', + smartcard_ad_cert_format: 'rfc822_name', base: '', user_filter: '', } @@ -87,4 +92,5 @@ encryption: 'plain', bind_dn: 'dc=example,dc=com', password: 's3cr3t', + active_directory: true, smartcard_auth: 'required', @@ -90,4 +96,6 @@ smartcard_auth: 'required', + smartcard_ad_cert_field: 'extendedAttribute1', + smartcard_ad_cert_format: 'rfc822_name', base: '', user_filter: '', } @@ -113,6 +121,8 @@ ldap_method: 'plain', ldap_bind_dn: 'foobar', ldap_active_directory: 'asdf', + ldap_smartcard_ad_cert_field: 'extendedAttribute2', + ldap_smartcard_ad_cert_format: 'subject', ldap_allow_username_or_email_login: false, ldap_lowercase_usernames: true, ldap_group_base: 'dc-example.com', @@ -127,6 +137,8 @@ expected_output = { enabled: true, prevent_ldap_sign_in: false, + smartcard_ad_cert_field: 'extendedAttribute2', + smartcard_ad_cert_format: 'subject', sync_time: 10, host: 'primary.ldap', port: 389,