Commit 7611ce72b97da690317a1adb2a0bdf17bddb1b8c
Exists in
spb-stable
and in
3 other branches
Merge branch 'doc/ldap' into 'master'
Explain LDAP activation for existing users
Showing
1 changed file
with
14 additions
and
0 deletions
Show diff stats
| @@ -0,0 +1,14 @@ | @@ -0,0 +1,14 @@ | ||
| 1 | +# GitLab LDAP integration | ||
| 2 | + | ||
| 3 | +GitLab can be configured to allow your users to sign with their LDAP credentials to integrate with e.g. Active Directory. | ||
| 4 | +The first time a user signs in with LDAP credentials, GitLab will create a new GitLab user associated with the LDAP Distinguished Name (DN) of the LDAP user. | ||
| 5 | +GitLab user attributes such as nickname and email will be copied from the LDAP user entry. | ||
| 6 | + | ||
| 7 | +## Enabling LDAP sign-in for existing GitLab users | ||
| 8 | + | ||
| 9 | +When a user signs in to GitLab with LDAP for the first time, and their LDAP email address is the primary email address of an existing GitLab user, then the LDAP DN will be associated with the existing user. | ||
| 10 | +If the LDAP email attribute is not found in GitLab's database, a new user is created. | ||
| 11 | + | ||
| 12 | +In other words, if an existing GitLab user wants to enable LDAP sign-in for themselves, they should check that their GitLab email address matches their LDAP email address, and then sign into GitLab via their LDAP credentials. | ||
| 13 | +GitLab recognizes the following LDAP attributes as email addresses: `mail`, `email` and `userPrincipalName`. | ||
| 14 | +If multiple LDAP email attributes are present, e.g. `mail: foo@bar.com` and `email: foo@example.com`, then the first attribute found wins -- in this case `foo@bar.com`. |