Merge branch 'saml_settings' into 'master'

Configuration settings for auto linking ldap users and auto sign in with a provider.

Fixes #645

See merge request !396

CHANGELOG.md

@@ -41,6 +41,7 @@ omnibus-gitlab repository.
 - Updated rubygems version to 2.2.5 c85aed400bd8e17c5e919d19cd93c08616190e0b
 - Rewrite runit default recipe which will now decide differently on which init is used  d3156878eadd643f136ee49d233e6c0b4ccebb28
 - Do not depend on Ohai platform helper for running selinux recipe cee73a23488f61fd5a0c2b090a8e86ca5209cd3c
+- Added configuration options for auto_link_ldap_user and auto_sign_in_with_provider
 
 7.11.0
 

files/gitlab-config-template/gitlab.rb.template

@@ -79,7 +79,9 @@ external_url 'GENERATED_EXTERNAL_URL'
 
 # gitlab_rails['omniauth_enabled'] = true
 # gitlab_rails['omniauth_allow_single_sign_on'] = false
+# gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
 # gitlab_rails['omniauth_block_auto_created_users'] = true
+# gitlab_rails['omniauth_auto_link_ldap_user'] = false
 # gitlab_rails['omniauth_providers'] = [
 #   {
 #     "name" => "google_oauth2",

files/gitlab-cookbooks/gitlab/attributes/default.rb

@@ -106,7 +106,9 @@ default['gitlab']['gitlab-rails']['ldap_active_directory'] = nil
 
 default['gitlab']['gitlab-rails']['omniauth_enabled'] = false
 default['gitlab']['gitlab-rails']['omniauth_allow_single_sign_on'] = nil
+default['gitlab']['gitlab-rails']['omniauth_auto_sign_in_with_provider'] = nil
 default['gitlab']['gitlab-rails']['omniauth_block_auto_created_users'] = nil
+default['gitlab']['gitlab-rails']['omniauth_auto_link_ldap_user'] = nil
 default['gitlab']['gitlab-rails']['omniauth_providers'] = []
 default['gitlab']['gitlab-rails']['bitbucket'] = nil
 default['gitlab']['gitlab-rails']['satellites_path'] = "/var/opt/gitlab/git-data/gitlab-satellites"

files/gitlab-cookbooks/gitlab/templates/default/gitlab.yml.erb

@@ -123,12 +123,20 @@ production: &base
     # Allow login via Twitter, Google, etc. using OmniAuth providers
     enabled: <%= @omniauth_enabled %>
 
+    # Uncomment this to automatically sign in with a specific omniauth provider's without
+    # showing GitLab's sign-in page (default: show the GitLab sign-in page)
+    auto_sign_in_with_provider: <%= @omniauth_auto_sign_in_with_provider %>
+
     # CAUTION!
     # This allows users to login without having a user account first (default: false).
     # User accounts will be created automatically when authentication was successful.
     allow_single_sign_on: <%= @omniauth_allow_single_sign_on %>
     # Locks down those users until they have been cleared by the admin (default: true).
     block_auto_created_users: <%= @omniauth_block_auto_created_users %>
+    # Look up new users in LDAP servers. If a match is found (same uid), automatically
+    # link the omniauth identity with the LDAP account. (default: false)
+    auto_link_ldap_user: <%= @omniauth_auto_link_ldap_user %>
+
 
     ## Auth providers
     # Uncomment the following lines and fill in the data of the auth provider you want to use