debian-mirror-gitlab/app/controllers/omniauth_callbacks_controller.rb

96 lines
3 KiB
Ruby
Raw Normal View History

2014-09-02 18:07:02 +05:30
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
2015-09-11 14:41:01 +05:30
protect_from_forgery except: [:kerberos, :saml]
2014-09-02 18:07:02 +05:30
Gitlab.config.omniauth.providers.each do |provider|
define_method provider['name'] do
handle_omniauth
end
end
# Extend the standard message generation to accept our custom exception
def failure_message
exception = env["omniauth.error"]
error = exception.error_reason if exception.respond_to?(:error_reason)
error ||= exception.error if exception.respond_to?(:error)
error ||= exception.message if exception.respond_to?(:message)
error ||= env["omniauth.error.type"].to_s
error.to_s.humanize if error
end
2015-04-26 12:48:37 +05:30
# We only find ourselves here
# if the authentication to LDAP was successful.
2014-09-02 18:07:02 +05:30
def ldap
2015-04-26 12:48:37 +05:30
@user = Gitlab::LDAP::User.new(oauth)
@user.save if @user.changed? # will also save new users
gl_user = @user.gl_user
2015-09-11 14:41:01 +05:30
gl_user.remember_me = params[:remember_me] if @user.persisted?
2014-09-02 18:07:02 +05:30
# Do additional LDAP checks for the user filter and EE features
2015-04-26 12:48:37 +05:30
if @user.allowed?
2015-09-11 14:41:01 +05:30
log_audit_event(gl_user, with: :ldap)
2015-04-26 12:48:37 +05:30
sign_in_and_redirect(gl_user)
2014-09-02 18:07:02 +05:30
else
flash[:alert] = "Access denied for your LDAP account."
redirect_to new_user_session_path
end
end
def omniauth_error
@provider = params[:provider]
@error = params[:error]
render 'errors/omniauth_error', layout: "errors", status: 422
end
private
def handle_omniauth
if current_user
2015-04-26 12:48:37 +05:30
# Add new authentication method
current_user.identities.find_or_create_by(extern_uid: oauth['uid'], provider: oauth['provider'])
2015-09-11 14:41:01 +05:30
log_audit_event(current_user, with: oauth['provider'])
2015-04-26 12:48:37 +05:30
redirect_to profile_account_path, notice: 'Authentication method updated'
2014-09-02 18:07:02 +05:30
else
2015-04-26 12:48:37 +05:30
@user = Gitlab::OAuth::User.new(oauth)
@user.save
2014-09-02 18:07:02 +05:30
2015-04-26 12:48:37 +05:30
# Only allow properly saved users to login.
if @user.persisted? && @user.valid?
2015-09-11 14:41:01 +05:30
log_audit_event(@user.gl_user, with: oauth['provider'])
2015-04-26 12:48:37 +05:30
sign_in_and_redirect(@user.gl_user)
2014-09-02 18:07:02 +05:30
else
2015-04-26 12:48:37 +05:30
error_message =
if @user.gl_user.errors.any?
@user.gl_user.errors.map do |attribute, message|
"#{attribute} #{message}"
end.join(", ")
else
''
end
redirect_to omniauth_error_path(oauth['provider'], error: error_message) and return
2014-09-02 18:07:02 +05:30
end
end
2015-10-24 18:46:33 +05:30
rescue Gitlab::OAuth::SignupDisabledError
2015-09-11 14:41:01 +05:30
label = Gitlab::OAuth::Provider.label_for(oauth['provider'])
message = "Signing in using your #{label} account without a pre-existing GitLab account is not allowed."
if current_application_settings.signup_enabled?
message << " Create a GitLab account first, and then connect it to your #{label} account."
end
flash[:notice] = message
2015-10-24 18:46:33 +05:30
2015-04-26 12:48:37 +05:30
redirect_to new_user_session_path
2014-09-02 18:07:02 +05:30
end
def oauth
@oauth ||= request.env['omniauth.auth']
end
2015-09-11 14:41:01 +05:30
def log_audit_event(user, options = {})
AuditEventService.new(user, user, options).
for_authentication.security_event
end
2014-09-02 18:07:02 +05:30
end