Make mapping between ldap and kerberos configurable

config/initializers/1_settings.rb

@@ -731,6 +731,7 @@ Gitlab.ee do
   Settings['kerberos'] ||= Settingslogic.new({})
   Settings.kerberos['enabled'] = false if Settings.kerberos['enabled'].nil?
   Settings.kerberos['keytab'] = nil if Settings.kerberos['keytab'].blank? # nil means use default keytab
+  Settings.kerberos['simple_ldap_linking_allowed_realms'] = [] if Settings.kerberos['simple_ldap_linking_allowed_realms'].blank?
   Settings.kerberos['service_principal_name'] = nil if Settings.kerberos['service_principal_name'].blank? # nil means any SPN in keytab
   Settings.kerberos['use_dedicated_port'] = false if Settings.kerberos['use_dedicated_port'].nil?
   Settings.kerberos['https'] = Settings.gitlab.https if Settings.kerberos['https'].nil?

ee/changelogs/unreleased/2906-make-kerberos-mapping-configurable.yml

+---
+title: Add simple_ldap_linking kerberos options to make the mapping between ldap and
+  kerberos configureable
+merge_request:
+author: Christopher Schenk
+type: added

ee/lib/ee/gitlab/auth/ldap/person.rb

@@ -31,12 +31,22 @@ module EE
               uid, domain = principal.split('@', 2)
               return unless uid && domain
 
+              if ::Gitlab.config.kerberos.simple_ldap_linking_allowed_realms.blank?
+
                 # In multi-forest setups, there may be several users with matching
                 # uids but differing DNs, so skip adapters configured to connect to
                 # non-matching domains
                 return unless domain.casecmp(domain_from_dn(adapter.config.base)) == 0
 
                 find_by_uid(uid, adapter)
+
+              else
+                ::Gitlab.config.kerberos.simple_ldap_linking_allowed_realms.each do |realm|
+                  if domain.casecmp(realm) == 0
+                    return find_by_uid(uid, adapter)
+                  end
+                end
+              end
             end
 
             # Extracts the rightmost unbroken set of domain components from an