Home / server / Questions / 879932
Accepted
trueCamelType
Asked: 2017-10-24 18:30:13 +0800 CST

Gitlab Omnibus login broken after update

  • 772

I just updated to the most recent version of gitlab-omnibus (I believe 10.1, but I’m not positive). None of my users can login now, and I'm not seeing anything incredibly useful in the error logs.

I’m not 100% certain which version of gitlab-omnibus I came from, but it hadn’t been more than a month since I updated, so probably a later 9.x version.

The error I’m getting is

Could not authenticate you from Ldapmain because "Ssl connect returned=1 errno=0 state=error: certificate verify failed".

at the login screen when anyone goes to login. When I tail all of the logs using gitlab-ctl tail, I get the following error on login attempt.

{"method":"POST","path":"/users/auth/ldapmain/callback","format":"html","controller":"OmniauthCallbacksController","action":"failure","status":302,"duration":6.6,"view":0.0,"db":0.0,"location":"https://gitlab.mycompany.com/users/sign_in","time":"2017-10-24T01:37:36.538Z","params":{"utf8":"✓","authenticity_token":"[FILTERED]","username":"my.name","password":"[FILTERED]"},"remote_ip":"192.168.0.81","user_id":null,"username":null}

I've checked that nothing was changed with the certs I'm currently using, and nothing in the gitlab.rb file has changed. The last time I had a problem similar to this, gitlab had changed the name of one of the fields in the gitlab.rb file...but that doesn't appear to be the issue this time.

Once I rebuild the server from a backup, I can look up what the last version I had was, and I'll update here.

ubuntu-16.04

1 Answers

  1. Best Answer

    As it turns out, they did release that there would be a breaking change in LDAP (for most people).

    From Gitlab 10.0 Release

    The LDAP config option verify_certificates now defaults to true for security. This option was added in 9.4.2 but defaulted to false for backwards-compatibility.

    Installations that are using start_tls or simple_tls for the encryption parameter and that unknowingly do not have SSL configured properly between the LDAP server and the GitLab server, may break if the LDAP server’s SSL certificate cannot be verified by the GitLab server.

    After adding verify_certificates: false to my ldap configuration, everything works again.

    • 1