Update gitlab group member access_level get 403 Forbidden

Published on Feb 27, 2019

HTTP 403 Forbidden

Today, I try to update the 9th LDAP user of group 8, with access_level=50, that is Owner access , but get 403 Forbidden error.

The API is showed as below.

RestClient.put "http://localhost/api/v4/groups/8/members/9?private_token=fJOED9DKSKdkeksjjd", "access_level=50", "Accept"=>"application/json", "Accept-Encoding"=>"gzip, deflate", "Content-Length"=>"15", "Content-Type"=>"application/x-www-form-urlencoded", "User-Agent"=>"rest-client/2.0.2 (linux-gnu x86_64) ruby/2.4.2p198"
# => 403 Forbidden | application/json 27 bytes

Restriction for LDAP user permissions

So, we figure out that it’s a new feature : Updating user permissions - new feature.

It’s said that LDAP user permissions must be overriden mannually by admin user, so the API call previously can run.

One way

Also, we figure the operation can be done with general http call as below, but the drawback is that it’s hard to find the corresponding relation between id below and the actual id of the member.

For example, the member id of previous API call is 9, but the id below is 189 , which should be the id generated dynamically by gitlab along with webpage render.

Besides, you have to also deal with authentication for the http call below, which is headache.

curl -X PATCH \
  http://localhost/groups/<group_name>/-/group_members/<id>/override \
  -H 'Content-Type: application/json' \
  -H 'cache-control: no-cache' \
  -d '{"group_member":{"override":true}}'

Better way

So, if it has to be done with command or script, it can be done with embedded ruby script of gitlab

#=> gitlab-rails runner -e production " \
	member = Group.find_by(id: group_id ).members.find_by(user_id: user_id) \
	member.override = true \
	member.save! \
"

After that, you should be seeing the previous API call working:

RestClient.put "http://localhost/api/v4/groups/8/members/9?private_token=fJOED9DKSKdkeksjjd", "access_level=50", "Accept"=>"application/json", "Accept-Encoding"=>"gzip, deflate", "Content-Length"=>"15", "Content-Type"=>"application/x-www-form-urlencoded", "User-Agent"=>"rest-client/2.0.2 (linux-gnu x86_64) ruby/2.4.2p198"
# => 200 OK | application/json 820 bytes