Is it possible to disable Gitlab from locking an LDAP account if the user does not sign in for days?

Viewed 1156

We are using LDAP accounts in our self-managed Gitlab. A GitLab account could be locked due to an excessive amount of unsuccessful sign in attempts. We have found that an excessive amount of unsuccessful https authentication attempts also makes the account locked.

It makes sense. But, what's troubling us is that it seems if a user doesn't sign in for several days, the account gets blocked too. Some of our Gitlab users don't sign in on the Gitlab page. They simply use git pull and git push with https. If the account gets blocked, the https authentication fails too. It annoys them if they have to sign in from time to time.

Is is possible to disable Gitlab from locking an account if the user does not sign in for days?

2 Answers

This might be related to the configuration of your LDAP server. Specifically the remember-me token config.

See also GitLab LDAP Auth docs.

If you have an idea for improving GitLab, you can always open an issue with your feature suggestion and use case.

With GitLab 14.7 (January 2022), you now have an UI-based alternative:

GitLab UI identifies to administrators that a user is locked

In previous versions of GitLab, administrators could not see in the UI that a user was locked.

Now, the GitLab UI identifies locked users to administrators, which helps confirm they are locked.

https://about.gitlab.com/images/14_7/unlock_user.png -- GitLab UI identifies to administrators that a user is locked

See Documentation and Issue.

Related