gitlab error: Could not authorize you from LDAP because "Invalid credentials" when trying to sign into UI via LDAP/AD - ldap

Question

My LDAP configuration located at /etc/gitlab/gitlab.rb is as follows:
gitlab_rails['ldap_enabled'] = true
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
main: # 'main' is the GitLab 'provider ID' of this LDAP server
label: 'LDAP'
host: '10.3.32.11'
port: 389
uid: 'sAMAccountName'
bind_dn: 'CN=svc gitlab,CN=Users,DC=VPN,DC=Local'
password: 'PASSWORD'
encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
verify_certificates: false
active_directory: true
allow_username_or_email_login: true
lowercase_usernames: true
block_auto_created_users: false
base: 'ou=vpnusers,dc=vpn,dc=local'
user_filter: '(&(objectCategory=user)(memberOf=CN=appGitLab,ou=vpnusers,dc=vpn,dc=local))'
EOS
I have ran a gitlab-ctl reconfigure and gitlab-ctl restart aftewr these configuration changes.
EDIT:
my production.log output is as follows:
Completed 200 OK in 3ms (Views: 0.4ms | ActiveRecord: 0.0ms | Elasticsearch: 0.0ms)
Started POST "/users/auth/ldapmain/callback" for 10.88.0.189 at 2018-08-21 12:57:56 -0500
Processing by OmniauthCallbacksController#failure as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"[FILTERED]", "username"=>"aaron.west", "password"=>"[FILTERED]"}
Redirected to http://10.3.18.80/users/sign_in
Completed 302 Found in 279ms (ActiveRecord: 1.8ms | Elasticsearch: 0.0ms)
Started GET "/users/sign_in" for 10.88.0.189 at 2018-08-21 12:57:56 -0500
Processing by SessionsController#new as HTML
Completed 200 OK in 35ms (Views: 18.9ms | ActiveRecord: 2.4ms | Elasticsearch: 0.0ms)
Started GET "/-/metrics" for 127.0.0.1 at 2018-08-21 12:57:58 -0500
Processing by MetricsController#index as HTML
Completed 200 OK in 3ms (Views: 0.4ms | ActiveRecord: 0.0ms | Elasticsearch: 0.0ms)
Started GET "/-/metrics" for 127.0.0.1 at 2018-08-21 12:58:13 -0500
Processing by MetricsController#index as HTML
Any idea why I keep seeing Could not authorize you from LDAP because "Invalid credentials" upon LDAP login?

Answer 1

There is a task you can check if your LDAP configuration is okay and get some samples of possible LDAP users: LDAP Rake Tasks
The LDAP check Rake task will test the bind_dn and password credentials (if configured) and will list a sample of LDAP users. This task is also executed as part of the gitlab:check task, but can run independently using the command below.
Omnibus Installation
sudo gitlab-rake gitlab:ldap:check
Source Installation
sudo -u git -H bundle exec rake gitlab:ldap:check RAILS_ENV=production
By default, the task will return a sample of 100 LDAP users. Change this limit by passing a number to the check task:
rake gitlab:ldap:check[50]