<p>I have <a href="https://docs.gitlab.com/charts/installation/" rel="nofollow noreferrer">installed Gitlab CE using Helm</a>, but our AD users can't login to the platform. The following error is shown in the login UI: <code>Could not authenticate you from Ldapmain because "Invalid credentials for userX"</code> <a href="https://i.stack.imgur.com/0KTci.jpg" rel="nofollow noreferrer">Invalid credentials for user</a> (but credentials are ok!)  </p>

<p><strong>Installation</strong>:  </p>

<pre><code>helm upgrade --install gitlab gitlab/gitlab --namespace my-ns --tiller-namespace tiller-ns  --timeout 600 --set global.edition=ce --set global.hosts.domain=example.com --set global.hosts.externalIP=&lt;ExternalIPAddressAllocatedToTheNGINXIngressControllerLBService&gt; --set nginx-ingress.enabled=false --set global.ingress.class=mynginx-ic --set certmanager.install=false --set global.ingress.configureCertmanager=false --set gitlab-runner.install=false --set prometheus.install=false --set registry.enabled=false --set gitlab.gitaly.persistence.enabled=false --set postgresql.persistence.enabled=false --set redis.persistence.enabled=false --set minio.persistence.enabled=false --set global.appConfig.ldap.servers.main.label='LDAP' --set global.appConfig.ldap.servers.main.host=&lt;IPAddressOfMyDomainController&gt; --set global.appConfig.ldap.servers.main.port='389' --set global.appConfig.ldap.servers.main.uid='sAMAccountName' --set global.appConfig.ldap.servers.main.bind_dn='CN=testuser,OU=sampleOU3,OU=sampleOU2,OU=sampleOU1,DC=example,DC=com' --set global.appConfig.ldap.servers.main.password.secret='gitlab-ldap-secret' --set global.appConfig.ldap.servers.main.password.key='password' 
</code></pre>

<p><strong>Notes</strong>:<br>
-I have installed previously my own NGINX Ingress Controller separately:  </p>

<pre><code>helm install stable/nginx-ingress --name nginx-ingress --namespace my-ns --tiller-namespace tiller-ns --set controller.ingressClass=mynginx-ic  
</code></pre>

<p>-I have previously created a secret with the password for the user configured as bind_dn ('CN=testuser,OU=sampleOU3,OU=sampleOU2,OU=sampleOU1,DC=example,DC=com'). The password is encoded using base64, as indicated in <a href="https://docs.gitlab.com/charts/charts/globals.html#ldap" rel="nofollow noreferrer">the documentation</a>  </p>

<p>File: gitlab-ldap-secret.yaml  </p>

<pre><code>apiVersion: v1  
kind: Secret  
metadata:  
 name: gitlab-ldap-secret  
data:  
 password: encodedpass-blablabla 
</code></pre>

<p>-Instead of providing all these parameters in the commandline during the chart installation, I have tried just configuring everything in the various values.yaml that <a href="https://gitlab.com/gitlab-org/charts/gitlab/tree/master" rel="nofollow noreferrer">this Gitlab Helm chart</a> provides, but it just seemed easier to document here this way, for reproduction purposes.  </p>

<p>-I have tried adding these parameters, no luck:  </p>

<pre><code>--set global.appConfig.ldap.servers.main.encryption='plain'  
--set global.appConfig.ldap.servers.main.base='OU=sampleOU1,DC=example,DC=com'  
</code></pre>

<p>-To make it even simpler, we are not considering persistency for any component. That is why, these are all set to false:  </p>

<pre><code>--set gitlab.gitaly.persistence.enabled=false  
--set postgresql.persistence.enabled=false  
--set redis.persistence.enabled=false  
--set minio.persistence.enabled=false   
</code></pre>

<p><em>*I do need persistency, but let's just focus on LDAP authentication this time, which is my main issue at the moment.</em>  </p>

<p>-I have checked with my sysadmin, and we use plain 389 in Active Directory. No encryption</p>

<p><strong>My environment</strong>  </p>

<pre><code>kubectl.exe version  
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.1", GitCommit:"4485c6f18cee9a5d3c3b4e523bd27972b1b53892", GitTreeState:"clean", BuildDate:"2019-07-18T09:18:22Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"windows/amd64"}  
Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.1", GitCommit:"4485c6f18cee9a5d3c3b4e523bd27972b1b53892", GitTreeState:"clean", BuildDate:"2019-07-18T09:09:21Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}  

helm version  
Client: &amp;version.Version{SemVer:"v2.14.3", GitCommit:"0e7f3b6637f7af8fcfddb3d2941fcc7cbebb0085", GitTreeState:"clean"}  
Server: &amp;version.Version{SemVer:"v2.14.3", GitCommit:"0e7f3b6637f7af8fcfddb3d2941fcc7cbebb0085", GitTreeState:"clean"}  

helm ls --tiller-namespace tiller-ns  
NAME                    REVISION        UPDATED                         STATUS          CHART                   APP VERSION     NAMESPACE
gitlab                  1               Tue Oct 29 18:16:06 2019        DEPLOYED        gitlab-2.3.7            12.3.5          my-ns

kubectl.exe get nodes
NAME                                    STATUS   ROLES    AGE     VERSION
kubernetes01.example.com                Ready    master   102d    v1.15.1
kubernetes02.example.com                Ready    &lt;none&gt;   7h16m   v1.15.1
kubernetes03.example.com                Ready    &lt;none&gt;   102d    v1.15.1
kubernetes04.example.com                Ready    &lt;none&gt;   11d     v1.15.1
</code></pre>

<p>After installing this chart, everything seems to work fine:</p>

<pre><code>kubectl.exe get pods
NAME                                                   READY   STATUS      RESTARTS   AGE
gitlab-gitaly-0                                        1/1     Running     0          65m
gitlab-gitlab-exporter-5b649bfbb-5pn7q                 1/1     Running     0          65m
gitlab-gitlab-shell-7d9497fcd7-h5478                   1/1     Running     0          65m
gitlab-gitlab-shell-7d9497fcd7-jvt9p                   1/1     Running     0          64m
gitlab-migrations.1-gf8jr                              0/1     Completed   0          65m
gitlab-minio-cb5945f79-kztmj                           1/1     Running     0          65m
gitlab-minio-create-buckets.1-d2bh5                    0/1     Completed   0          65m
gitlab-postgresql-685b68b4d7-ns2rw                     2/2     Running     0          65m
gitlab-redis-5cb5c8b4c6-jtfnr                          2/2     Running     0          65m
gitlab-sidekiq-all-in-1-5b997fdffd-n5cj2               1/1     Running     0          65m
gitlab-task-runner-5777748f59-gkf9v                    1/1     Running     0          65m
gitlab-unicorn-764f6548d5-fmggl                        2/2     Running     0          65m
gitlab-unicorn-764f6548d5-pqcm9                        2/2     Running     0          64m
</code></pre>

<p>Now, if I try to login with a LDAP user, I get the error mentioned before. If I go inside the unicorn pod, I can see the following messages in the <code>/var/log/gitlab/production.log</code>:
<a href="https://i.stack.imgur.com/UGpIp.png" rel="nofollow noreferrer">Production.log</a></p>

<p>What am I missing? Do I need to configure anything else? I have configured all the parameters for LDAP Authentication mentioned <a href="https://docs.gitlab.com/charts/charts/globals.html#ldap" rel="nofollow noreferrer">here</a> but still I'm having trouble trying to authenticate.   </p>

<p>Sorry, but I am new with Gitlab and all its internal components. I can't seem to find where to edit this file for example: <code>/etc/gitlab/gitlab.rb</code> (<em>in which pod should I enter? I literally entered each one of them, and did not find this configuration file</em>). Also, I noticed some of the documentation says that some diagnostics tools can be executed such as <code>gitlab-rake</code> <code>gitlab:ldap:check</code>, or utilities such as <code>gitlab-ctl reconfigure</code>, but again.... where to run these?? On the unicorn pod? gitlab-shell? I noticed various Gitlab documentation pages reference to some of these tools to troubleshoot incidents, but I don't think this chart follows the same architecture.</p>

<p>I have looked <a href="https://stackoverflow.com/questions/56161699/could-not-authenticate-you-from-ldapmain-because-invalid-credentials-for-user-n/56165991?noredirect=1#comment98973794_56165991">this post</a> for example, because it seems the same issue, but I can't find <code>/etc/gitlab/gitlab.rb</code> </p>

<p>Any help will be much appreciated. It's been a couple of weeks since I've been dealing with this issue.</p>

apereirapy
<p>I forgot to answer this. I managed to solve this issue by adding again the base parameter.</p>

<p>I was already trying this as explained in my original post but it turns out that I needed to escape the commas:</p>

<pre><code>--set global.appConfig.ldap.servers.main.base='OU=sampleOU1\,DC=example\,DC=com'
</code></pre>

<p>*The same with your bind_dn, commas need to be escaped.</p>

<p>I was able to realize that thanks to the LDAP diagnostic tool <code>gitlab-rake</code>, which in this helm chart is a bit different. You have to go inside <code>/srv/gitlab</code> directory on the unicorn container, and execute <code>./bin/rake gitlab:ldap:check</code>. That helped me understand where the problem was. Also you can check the <code>/srv/gitlab/config/gitlab.yaml</code> file to see if your LDAP parameters were successfully loaded/parsed.</p>

<p>You can also run the following command to see more information about your Gitlab deployment: <code>./bin/rake gitlab:env:info</code></p>
