Gitlab 部署和AD对接
一、缘起
公司一直使用SVN厌倦了，准备换换口味，于是去实验Gitlab。
二、Gitlab安装
作为实验性质，自然选择了最为简便的Docker方式进行。
docker run --detach \
--publish 7443:443 \
--publish 7080:80 \
--publish 7022:22 \
--name gitlab \
--restart always \
--volume /data/gitlab/config:/etc/gitlab \
--volume /data/gitlab/logs:/var/log/gitlab \
--volume /data/gitlab/data:/var/opt/gitlab \
gitlab /gitlab-ce:latest
三、AD域对接
作为一个公司自然有着统一个用户体系，总不能一个系统去创建一套用户吧，于是AD对接成了必然。度娘一阵咨询，看了N多前辈曾经踩过的坑，总结了自己的做法，直接成功，幸运站在了前辈的肩膀上。
1、创建一个内部对接专用帐户
为方便配置，建议用户创建在域自有的组Users下，这里创建帐户如下：
帐户：ldaponly
密码：P@ssw0rd
2、登陆docker，修改/etc/gitlab/gitlab.rb中LDAP相关配置如下：
AD域的IP为172.10.10.1
AD域名为corp.local
### LDAP Settings
###! Docs: https://docs.gitlab.com/omnibus/settings/ldap.html
###! **Be careful not to break the indentation in the ldap_servers block. It is
###! in yaml format and the spaces must be retained. Using tabs will not work..
**
gitlab_rails['ldap_enabled'] = true
###! **remember to close this block with 'EOS' below**
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
main: # 'main' is the GitLab 'provider ID' of this LDAP server
label: 'LDAP'
host: '172.10.10.1'
port: 389
uid: 'sAMAccountName'
bind_dn: 'cn=ldaponly,cn=users,dc=corp,dc=local'
password: 'P@ssw0rd'
encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
verify_certificates: true
active_directory: true
allow_username_or_email_login: false
lowercase_usernames: false
block_auto_created_users: false
base: 'dc=corp,dc=local'
user_filter: ''
## EE only
group_base: ''
admin_group: ''
sync_ssh_keys: false
# secondary: # 'secondary' is the GitLab 'provider ID' of second LDAP server
# label: 'LDAP'
# host: '_your_ldap_server'
# port: 389
# uid: 'sAMAccountName'
# bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
# password: '_the_password_of_the_bind_user'
# encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
# verify_certificates: true
# active_directory: true
# allow_username_or_email_login: false
# lowercase_usernames: false
# block_auto_created_users: false
# base: ''
# user_filter: ''
# ## EE only
# group_base: ''
# admin_group: ''
# sync_ssh_keys: false
EOS
3、重置Gitlab并重启
#gitlab-ctl reconfigure
.....(略)
Running handlers:
Running handlers complete
Chef Client finished, 7/535 resources updated in 32 seconds
gitlab Reconfigured!
#gitlab-ctl restart
.....(略)
ok: run: redis-exporter: (pid 31729) 1s
ok: run: sidekiq: (pid 31738) 0s
ok: run: sshd: (pid 31741) 1s
ok: run: unicorn: (pid 31749) 0s
4、检查AD对接是否正常
#gitlab-rake gitlab:ldap:check
Checking LDAP ...
Server: ldapmain
LDAP authentication... Success
LDAP users with access to your GitLab server (only showing the first 100 results)
DN: cn=access control assistance operators,cn=builtin,dc=corp,dc=local sAMAccountName: Access Control Assistance Operators
DN: cn=account operators,cn=builtin,dc=corp,dc=local sAMAccountName: Account Operators
.....(略)
DN: cn=iis_iusrs,cn=builtin,dc=corp,dc=local sAMAccountName: IIS_IUSRS
DN: cn=incoming forest trust builders,cn=builtin,dc=corp,dc=local sAMAccountName: Incoming Forest Trust Builders
Checking LDAP ... Finished
四、使用
此时在登录界面上可以看到LDAP，直接选择次登录即可。
注意：LDAP Username中只输入用户名称不需要加@corp.local
