gitlabhq/gitlabhq — pull request #5400 by lokedhs (2013-10-22 08:00:15+00:00)
Title: When looking up a user by DN, use single scope

The blocked? method is used to check whether a user exists in LDAP.
Prior to this change, if the LDAP server had more objects below the
one pointed to by the DN, those objects would also be picked up by the
search, causing the method to determine the user should be blocked.

One case where this can happen is when using Active Directory and a
user have a mobile phone assigned. In this case, Exchange will add an
entry called ExchangeActiveSyncDevices under the users entry. The
user-visible behaviour is then that a user loses Gitlab access when he
enables a mobile device.

This fix sets the search scope to BaseObject in order to ensure that
only the user itself is returned when looking up the user.