title: access to gitlab based on ldap-groups
body: <p>I am trying to setup gitlab on linux machine. And i am stuck on LDAP configuration in /etc/gitlab/gitlab.rb file.
  I want to allow access for members of both black and green teams, deny access to everyone else.</p>
  
  <p>my  conf looks like this:</p>
  
  <pre><code>gitlab_rails['ldap_enabled'] = true
  
  ###! **remember to close this block with 'EOS' below**
  gitlab_rails['ldap_servers'] = YAML.load &lt;&lt;-'EOS'
  main:
    label: 'LDAP'
    host: 'hidden'
    port: 'hidden'
    uid: 'sAMAccountName'
    method: 'plain'
    bind_dn: 'hidden'
    password: 'hidden'
    active_directory: true
  #  allow_username_or_email_login: true
  #  block_auto_created_users: false
    base: "cn=Black Team,OU=hidden2,OU=hidden3,OU=hidden4,OU=hidden5,OU=hidden6,DC=ad,DC=companyname,DC=com"  
    base: "cn=Green Team,OU=hidden2,OU=hidden3,OU=hidden4,OU=hidden5,OU=hidden6,DC=ad,DC=companyname,DC=com" 
  #  user_filter: ''
  #  attributes:
  #    username:['uid', 'userid', 'sAMAccountName']
  #    email:    ['mail', 'email', 'userPrincipalName']
  #    name:       'cn'
  #    first_name: 'givenName'
  #    last_name:  'sn'
  #  ## EE only
  #  admin_group: ''
  #  sync_ssh_keys: false
   EOS
  </code></pre>
  
  <p>but it doesnt work. Most probably because such configuration grant access for group, but not members of group. Is there any way to allow sub-group/sub-items/sub-elements grant access as well?</p>
  
  <p>I know we can do something like this:</p>
  
  <pre><code> base: ''
     user_filter: '(|(memberOf=cn=Black Team,OU=hidden2,OU=hidden3,OU=hidden4,OU=hidden5,OU=hidden6,DC=ad,DC=companyname,DC=com)(memberOf=cn=Green Team,OU=hidden2,OU=hidden3,OU=hidden4,OU=hidden5,OU=hidden6,DC=ad,DC=companyname,DC=com))'
  </code></pre>
  
  <p>which will be: "allow everyone, and trim results to only members of black &amp; green teams"
  and it works correctly so far, but after adding few more teams filter will become veeeeeery long, and it will be not easy to update in case of more complicated filters.</p>
  
  <p>Therefore i am interested in solution which allows every member of listed groups (in "base" fields).
  Is it possible to define multiple groups via "base" field?
  Is it possible to allow access for members of groups listed in "base" fields ?</p>