1 files changed, 38 insertions, 30 deletions

diff --git a/lib/gitlab/o_auth/user.rb b/lib/gitlab/o_auth/user.rb
index e06d4dc45f7..68815be4d13 100644
--- a/lib/gitlab/o_auth/user.rb
+++ b/lib/gitlab/o_auth/user.rb
@@ -13,6 +13,7 @@ module Gitlab
       def initialize(auth_hash)
         self.auth_hash = auth_hash
         update_profile if sync_profile_from_provider?
+        add_or_update_user_identities
       end
 
       def persisted?
@@ -44,47 +45,54 @@ module Gitlab
       end
 
       def gl_user
-        @user ||= find_by_uid_and_provider
+        return @gl_user if defined?(@gl_user)
 
-        if auto_link_ldap_user?
-          @user ||= find_or_create_ldap_user
-        end
+        @gl_user = find_user
+      end
 
-        if signup_enabled?
-          @user ||= build_new_user
-        end
+      def find_user
+        user = find_by_uid_and_provider
 
-        if external_provider? && @user
-          @user.external = true
-        end
+        user ||= find_or_build_ldap_user if auto_link_ldap_user?
+        user ||= build_new_user if signup_enabled?
+
+        user.external = true if external_provider? && user
 
-        @user
+        user
       end
 
       protected
 
-      def find_or_create_ldap_user
+      def add_or_update_user_identities
+        # find_or_initialize_by doesn't update `gl_user.identities`, and isn't autosaved.
+        identity = gl_user.identities.find { |identity| identity.provider == auth_hash.provider }
+
+        identity ||= gl_user.identities.build(provider: auth_hash.provider)
+        identity.extern_uid = auth_hash.uid
+
+        if auto_link_ldap_user? && !gl_user.ldap_user? && ldap_person
+          log.info "Correct LDAP account has been found. identity to user: #{gl_user.username}."
+          gl_user.identities.build(provider: ldap_person.provider, extern_uid: ldap_person.dn)
+        end
+      end
+
+      def find_or_build_ldap_user
         return unless ldap_person
 
-        # If a corresponding person exists with same uid in a LDAP server,
-        # check if the user already has a GitLab account.
         user = Gitlab::LDAP::User.find_by_uid_and_provider(ldap_person.dn, ldap_person.provider)
         if user
-          # Case when a LDAP user already exists in Gitlab. Add the OAuth identity to existing account.
           log.info "LDAP account found for user #{user.username}. Building new #{auth_hash.provider} identity."
-          user.identities.find_or_initialize_by(extern_uid: auth_hash.uid, provider: auth_hash.provider)
-        else
-          log.info "No existing LDAP account was found in GitLab. Checking for #{auth_hash.provider} account."
-          user = find_by_uid_and_provider
-          if user.nil?
-            log.info "No user found using #{auth_hash.provider} provider. Creating a new one."
-            user = build_new_user
-          end
-          log.info "Correct account has been found. Adding LDAP identity to user: #{user.username}."
-          user.identities.new(provider: ldap_person.provider, extern_uid: ldap_person.dn)
+          return user
         end
 
-        user
+        log.info "No user found using #{auth_hash.provider} provider. Creating a new one."
+        build_new_user
+      end
+
+      def find_by_email
+        return unless auth_hash.has_attribute?(:email)
+
+        ::User.find_by(email: auth_hash.email.downcase)
       end
 
       def auto_link_ldap_user?
@@ -108,9 +116,9 @@ module Gitlab
       end
 
       def find_ldap_person(auth_hash, adapter)
-        by_uid = Gitlab::LDAP::Person.find_by_uid(auth_hash.uid, adapter)
-        # The `uid` might actually be a DN. Try it next.
-        by_uid || Gitlab::LDAP::Person.find_by_dn(auth_hash.uid, adapter)
+        Gitlab::LDAP::Person.find_by_uid(auth_hash.uid, adapter) ||
+          Gitlab::LDAP::Person.find_by_email(auth_hash.uid, adapter) ||
+          Gitlab::LDAP::Person.find_by_dn(auth_hash.uid, adapter)
       end
 
       def ldap_config
@@ -152,7 +160,7 @@ module Gitlab
       end
 
       def build_new_user
-        user_params = user_attributes.merge(extern_uid: auth_hash.uid, provider: auth_hash.provider, skip_confirmation: true)
+        user_params = user_attributes.merge(skip_confirmation: true)
         Users::BuildService.new(nil, user_params).execute(skip_authorization: true)
       end