Merge branch 'sync_ldap_members' into ee-master

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Conflicts:
	CHANGELOG-EE

CHANGELOG-EE

@@ -1,6 +1,7 @@
 v 7.5.0
   - Added an ability to check each author commit's email by regex
   - Added an abulity to restrict commit authors to existing Gitlab users
+  - Add an option for automatic daily LDAP user sync
 
 v 7.4.0
   - Support for multiple LDAP servers

Gemfile

@@ -114,6 +114,7 @@ gem "acts-as-taggable-on"
 gem 'slim'
 gem 'sinatra', require: nil
 gem 'sidekiq', '2.17.0'
+gem 'sidetiq', '0.6.1'
 
 # HTTP requests
 gem "httparty"

Gemfile.lock

@@ -252,6 +252,7 @@ GEM
       multi_xml (>= 0.5.2)
     httpauth (0.2.1)
     i18n (0.6.11)
+    ice_cube (0.12.1)
     ice_nine (0.10.0)
     jasmine (2.0.2)
       jasmine-core (~> 2.0.0)
@@ -477,6 +478,10 @@ GEM
       json
       redis (>= 3.0.4)
       redis-namespace (>= 1.3.1)
+    sidetiq (0.6.1)
+      celluloid (>= 0.14.1)
+      ice_cube (~> 0.12.0)
+      sidekiq (>= 2.16.0)
     simple_oauth (0.1.9)
     simplecov (0.9.0)
       docile (~> 1.1.0)
@@ -686,6 +691,7 @@ DEPENDENCIES
   settingslogic
   shoulda-matchers (~> 2.1.0)
   sidekiq (= 2.17.0)
+  sidetiq (= 0.6.1)
   simplecov
   sinatra
   six

app/workers/ldap_sync_worker.rb

@@ -0,0 +1,19 @@
+class LdapSyncWorker
+  include Sidekiq::Worker
+  include Sidetiq::Schedulable
+
+  if Gitlab.config.ldap.enabled
+    HOUR = Gitlab.config.ldap.schedule_sync_hour
+    MINUTE = Gitlab.config.ldap.schedule_sync_minute
+
+    recurrence { daily.hour_of_day(HOUR).minute_of_hour(MINUTE) }
+  end
+
+  def perform
+    Rails.logger.info "Performing daily LDAP sync task."
+    User.ldap.find_each(batch_size: 100).each do |ldap_user|
+      Rails.logger.debug "Syncing user #{ldap_user.username}, #{ldap_user.email}"
+      Gitlab::LDAP::Access.allowed?(ldap_user)
+    end
+  end
+end

config/gitlab.yml.example

@@ -135,6 +135,14 @@ production: &base
   #   bundle exec rake gitlab:ldap:check RAILS_ENV=production
   ldap:
     enabled: false
+
+    # GitLab EE only.
+    # In addition to refreshing users when they log in,
+    # enabling this setting will refresh LDAP user membership once a day.
+    # Default time of the day when this will happen is at 1:30am server time.
+    schedule_sync_hour: 1 # Hour of the day. Value from 0-23.
+    schedule_sync_minute: 30 # Minute of the hour. Value from 0-59.
+
     servers:
       main: # 'main' is the GitLab 'provider ID' of this LDAP server
         ## label

config/initializers/1_settings.rb

@@ -56,6 +56,8 @@ end
 Settings['ldap'] ||= Settingslogic.new({})
 Settings.ldap['enabled'] = false if Settings.ldap['enabled'].nil?
 Settings.ldap['sync_time'] = 3600 if Settings.ldap['sync_time'].nil?
+Settings.ldap['schedule_sync_hour'] = 1 if Settings.ldap['schedule_sync_hour'].nil?
+Settings.ldap['schedule_sync_minute'] = 30  if Settings.ldap['schedule_sync_minute'].nil?
 
 # backwards compatibility, we only have one host
 if Settings.ldap['enabled'] || Rails.env.test?