From 51eda1cb65a7d374a165c47c7341ba3f1a0f04f3 Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Tue, 28 Oct 2014 15:22:36 +0100 Subject: [PATCH 1/6] Add sidetiq to gemfile. --- Gemfile | 1 + Gemfile.lock | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/Gemfile b/Gemfile index e1b474c172..9315504826 100644 --- a/Gemfile +++ b/Gemfile @@ -114,6 +114,7 @@ gem "acts-as-taggable-on" gem 'slim' gem 'sinatra', require: nil gem 'sidekiq', '2.17.0' +gem 'sidetiq', '0.6.1' # HTTP requests gem "httparty" diff --git a/Gemfile.lock b/Gemfile.lock index 2d373422c3..f4f99c638b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -252,6 +252,7 @@ GEM multi_xml (>= 0.5.2) httpauth (0.2.1) i18n (0.6.11) + ice_cube (0.12.1) ice_nine (0.10.0) jasmine (2.0.2) jasmine-core (~> 2.0.0) @@ -477,6 +478,10 @@ GEM json redis (>= 3.0.4) redis-namespace (>= 1.3.1) + sidetiq (0.6.1) + celluloid (>= 0.14.1) + ice_cube (~> 0.12.0) + sidekiq (>= 2.16.0) simple_oauth (0.1.9) simplecov (0.9.0) docile (~> 1.1.0) @@ -686,6 +691,7 @@ DEPENDENCIES settingslogic shoulda-matchers (~> 2.1.0) sidekiq (= 2.17.0) + sidetiq (= 0.6.1) simplecov sinatra six From 80640413734ddbebff15e8e90869fc40ea5be1a9 Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Wed, 29 Oct 2014 13:32:16 +0100 Subject: [PATCH 2/6] Add time configuration option for LDAP user daily sync. --- config/gitlab.yml.example | 5 +++++ config/initializers/1_settings.rb | 2 ++ 2 files changed, 7 insertions(+) diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example index b3e5f9a646..a8dbbb824d 100644 --- a/config/gitlab.yml.example +++ b/config/gitlab.yml.example @@ -210,6 +210,11 @@ production: &base # sync_ssh_keys: false + # GitLab will refresh LDAP user membership once a day. + # Default time of the day when this will happen is at 1:30am server time. + schedule_sync_hour: 1 # Hour of the day. Value from 0-23. + schedule_sync_minute: 30 # Minute of the hour. Value from 0-59. + # GitLab EE only: add more LDAP servers # Choose an ID made of a-z and 0-9 . This ID will be stored in the database # so that GitLab can remember which LDAP server a user belongs to. diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb index 4920ce2d09..f55062eb2a 100644 --- a/config/initializers/1_settings.rb +++ b/config/initializers/1_settings.rb @@ -77,6 +77,8 @@ if Settings.ldap['enabled'] || Rails.env.test? server['provider_name'] ||= "ldap#{key}".downcase server['sync_time'] = 3600 if server['sync_time'].nil? server['provider_class'] = OmniAuth::Utils.camelize(server['provider_name']) + server['schedule_sync_hour'] = 1 if server['schedule_sync_hour'].nil? + server['schedule_sync_minute'] = 30 if server['schedule_sync_minute'].nil? Settings.ldap['servers'][key] = server end end From 8a92a1bb96b0b3fcee8cf5012acb249b0dfb3468 Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Wed, 29 Oct 2014 13:33:00 +0100 Subject: [PATCH 3/6] Create sidetiq ldap sync worker. --- app/workers/ldap_sync_worker.rb | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 app/workers/ldap_sync_worker.rb diff --git a/app/workers/ldap_sync_worker.rb b/app/workers/ldap_sync_worker.rb new file mode 100644 index 0000000000..f78909c458 --- /dev/null +++ b/app/workers/ldap_sync_worker.rb @@ -0,0 +1,19 @@ +class LdapSyncWorker + include Sidekiq::Worker + include Sidetiq::Schedulable + + if Gitlab.config.ldap.enabled + HOUR = Gitlab.config.ldap.servers.values.first['schedule_sync_hour'] + MINUTE = Gitlab.config.ldap.servers.values.first['schedule_sync_minute'] + + recurrence { daily.hour_of_day(HOUR).minute_of_hour(MINUTE) } + end + + def perform + Rails.logger.info "Performing daily LDAP sync task." + User.ldap.find_each(batch_size: 100).each do |ldap_user| + Rails.logger.debug "Syncing user #{ldap_user.username}, #{ldap_user.email}" + Gitlab::LDAP::Access.allowed?(ldap_user) + end + end +end From e69b5f19c52fc45d85e05f263659295edfdaa671 Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Fri, 31 Oct 2014 12:40:01 +0100 Subject: [PATCH 4/6] Place the settings that are valid for all ldap servers in a correct place. --- app/workers/ldap_sync_worker.rb | 4 ++-- config/gitlab.yml.example | 12 +++++++----- config/initializers/1_settings.rb | 4 ++-- 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/app/workers/ldap_sync_worker.rb b/app/workers/ldap_sync_worker.rb index f78909c458..13c6b41478 100644 --- a/app/workers/ldap_sync_worker.rb +++ b/app/workers/ldap_sync_worker.rb @@ -3,8 +3,8 @@ class LdapSyncWorker include Sidetiq::Schedulable if Gitlab.config.ldap.enabled - HOUR = Gitlab.config.ldap.servers.values.first['schedule_sync_hour'] - MINUTE = Gitlab.config.ldap.servers.values.first['schedule_sync_minute'] + HOUR = Gitlab.config.ldap.schedule_sync_hour + MINUTE = Gitlab.config.ldap.schedule_sync_minute recurrence { daily.hour_of_day(HOUR).minute_of_hour(MINUTE) } end diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example index a8dbbb824d..d48e67443b 100644 --- a/config/gitlab.yml.example +++ b/config/gitlab.yml.example @@ -135,6 +135,13 @@ production: &base # bundle exec rake gitlab:ldap:check RAILS_ENV=production ldap: enabled: false + + # GitLab EE only. + # GitLab will refresh LDAP user membership once a day. + # Default time of the day when this will happen is at 1:30am server time. + schedule_sync_hour: 1 # Hour of the day. Value from 0-23. + schedule_sync_minute: 30 # Minute of the hour. Value from 0-59. + servers: main: # 'main' is the GitLab 'provider ID' of this LDAP server ## label @@ -210,11 +217,6 @@ production: &base # sync_ssh_keys: false - # GitLab will refresh LDAP user membership once a day. - # Default time of the day when this will happen is at 1:30am server time. - schedule_sync_hour: 1 # Hour of the day. Value from 0-23. - schedule_sync_minute: 30 # Minute of the hour. Value from 0-59. - # GitLab EE only: add more LDAP servers # Choose an ID made of a-z and 0-9 . This ID will be stored in the database # so that GitLab can remember which LDAP server a user belongs to. diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb index f55062eb2a..466165e200 100644 --- a/config/initializers/1_settings.rb +++ b/config/initializers/1_settings.rb @@ -56,6 +56,8 @@ end Settings['ldap'] ||= Settingslogic.new({}) Settings.ldap['enabled'] = false if Settings.ldap['enabled'].nil? Settings.ldap['sync_time'] = 3600 if Settings.ldap['sync_time'].nil? +Settings.ldap['schedule_sync_hour'] = 1 if Settings.ldap['schedule_sync_hour'].nil? +Settings.ldap['schedule_sync_minute'] = 30 if Settings.ldap['schedule_sync_minute'].nil? # backwards compatibility, we only have one host if Settings.ldap['enabled'] || Rails.env.test? @@ -77,8 +79,6 @@ if Settings.ldap['enabled'] || Rails.env.test? server['provider_name'] ||= "ldap#{key}".downcase server['sync_time'] = 3600 if server['sync_time'].nil? server['provider_class'] = OmniAuth::Utils.camelize(server['provider_name']) - server['schedule_sync_hour'] = 1 if server['schedule_sync_hour'].nil? - server['schedule_sync_minute'] = 30 if server['schedule_sync_minute'].nil? Settings.ldap['servers'][key] = server end end From f07a5721c12bb59ea3b0a86b332d12fcd2cbeff6 Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Fri, 31 Oct 2014 13:49:43 +0100 Subject: [PATCH 5/6] Add ldap daily sync to changelog. --- CHANGELOG-EE | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG-EE b/CHANGELOG-EE index 06e03abc4b..e323f15d45 100644 --- a/CHANGELOG-EE +++ b/CHANGELOG-EE @@ -1,3 +1,6 @@ +v 7.5.0 + - Add an option for automatic daily LDAP user sync + v 7.4.0 - Support for multiple LDAP servers - Skip AD specific LDAP checks From 5135b3829d76a04eba944be08d6b241de273066f Mon Sep 17 00:00:00 2001 From: Marin Jankovski Date: Mon, 3 Nov 2014 08:13:09 +0100 Subject: [PATCH 6/6] Change comment in gitlab.yml about automatic ldap sync. --- config/gitlab.yml.example | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example index d48e67443b..4e3b390bbe 100644 --- a/config/gitlab.yml.example +++ b/config/gitlab.yml.example @@ -137,7 +137,8 @@ production: &base enabled: false # GitLab EE only. - # GitLab will refresh LDAP user membership once a day. + # In addition to refreshing users when they log in, + # enabling this setting will refresh LDAP user membership once a day. # Default time of the day when this will happen is at 1:30am server time. schedule_sync_hour: 1 # Hour of the day. Value from 0-23. schedule_sync_minute: 30 # Minute of the hour. Value from 0-59.