debian-mirror-gitlab/app/controllers/omniauth_callbacks_controller.rb

216 lines
5.9 KiB
Ruby
Raw Normal View History

2014-09-02 18:07:02 +05:30
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
2016-04-02 18:10:28 +05:30
include AuthenticatesWithTwoFactor
2017-09-10 17:25:29 +05:30
include Devise::Controllers::Rememberable
2015-09-11 14:41:01 +05:30
protect_from_forgery except: [:kerberos, :saml, :cas3]
2015-09-11 14:41:01 +05:30
2014-09-02 18:07:02 +05:30
Gitlab.config.omniauth.providers.each do |provider|
define_method provider['name'] do
handle_omniauth
end
end
2018-03-27 19:54:05 +05:30
if Gitlab::Auth::LDAP::Config.enabled?
Gitlab::Auth::LDAP::Config.available_servers.each do |server|
2018-03-17 18:26:18 +05:30
define_method server['provider_name'] do
ldap
end
end
end
2018-05-09 12:01:36 +05:30
# Extend the standard implementation to also increment
# the number of failed sign in attempts
def failure
if params[:username].present? && AuthHelper.form_based_provider?(failed_strategy.name)
user = User.by_login(params[:username])
user&.increment_failed_attempts!
end
super
end
2014-09-02 18:07:02 +05:30
# Extend the standard message generation to accept our custom exception
def failure_message
exception = env["omniauth.error"]
error = exception.error_reason if exception.respond_to?(:error_reason)
error ||= exception.error if exception.respond_to?(:error)
error ||= exception.message if exception.respond_to?(:message)
error ||= env["omniauth.error.type"].to_s
error.to_s.humanize if error
end
2015-04-26 12:48:37 +05:30
# We only find ourselves here
# if the authentication to LDAP was successful.
2014-09-02 18:07:02 +05:30
def ldap
2018-03-27 19:54:05 +05:30
ldap_user = Gitlab::Auth::LDAP::User.new(oauth)
2016-02-05 20:25:01 +05:30
ldap_user.save if ldap_user.changed? # will also save new users
@user = ldap_user.gl_user
@user.remember_me = params[:remember_me] if ldap_user.persisted?
2014-09-02 18:07:02 +05:30
# Do additional LDAP checks for the user filter and EE features
2016-02-05 20:25:01 +05:30
if ldap_user.allowed?
2016-04-02 18:10:28 +05:30
if @user.two_factor_enabled?
prompt_for_two_factor(@user)
else
2017-09-10 17:25:29 +05:30
log_audit_event(@user, with: oauth['provider'])
2016-04-02 18:10:28 +05:30
sign_in_and_redirect(@user)
end
2014-09-02 18:07:02 +05:30
else
2017-09-10 17:25:29 +05:30
fail_ldap_login
2014-09-02 18:07:02 +05:30
end
end
2016-04-02 18:10:28 +05:30
def saml
if current_user
log_audit_event(current_user, with: :saml)
# Update SAML identity if data has changed.
2018-03-17 18:26:18 +05:30
identity = current_user.identities.with_extern_uid(:saml, oauth['uid']).take
2016-04-02 18:10:28 +05:30
if identity.nil?
current_user.identities.create(extern_uid: oauth['uid'], provider: :saml)
redirect_to profile_account_path, notice: 'Authentication method updated'
else
redirect_to after_sign_in_path_for(current_user)
end
else
2018-03-27 19:54:05 +05:30
saml_user = Gitlab::Auth::Saml::User.new(oauth)
2016-06-02 11:05:42 +05:30
saml_user.save if saml_user.changed?
2016-04-02 18:10:28 +05:30
@user = saml_user.gl_user
continue_login_process
end
2018-03-27 19:54:05 +05:30
rescue Gitlab::Auth::OAuth::User::SignupDisabledError
2016-06-02 11:05:42 +05:30
handle_signup_error
2016-04-02 18:10:28 +05:30
end
2014-09-02 18:07:02 +05:30
def omniauth_error
@provider = params[:provider]
@error = params[:error]
2017-08-17 22:00:37 +05:30
render 'errors/omniauth_error', layout: "oauth_error", status: 422
2014-09-02 18:07:02 +05:30
end
def cas3
ticket = params['ticket']
if ticket
handle_service_ticket oauth['provider'], ticket
end
2018-03-17 18:26:18 +05:30
handle_omniauth
end
2017-08-17 22:00:37 +05:30
def authentiq
if params['sid']
handle_service_ticket oauth['provider'], params['sid']
end
2018-03-17 18:26:18 +05:30
2017-08-17 22:00:37 +05:30
handle_omniauth
end
2018-03-26 14:24:53 +05:30
def auth0
if oauth['uid'].blank?
fail_auth0_login
else
handle_omniauth
end
end
2014-09-02 18:07:02 +05:30
private
def handle_omniauth
if current_user
2015-04-26 12:48:37 +05:30
# Add new authentication method
2018-03-17 18:26:18 +05:30
current_user.identities
.with_extern_uid(oauth['provider'], oauth['uid'])
.first_or_create(extern_uid: oauth['uid'])
2015-09-11 14:41:01 +05:30
log_audit_event(current_user, with: oauth['provider'])
2015-04-26 12:48:37 +05:30
redirect_to profile_account_path, notice: 'Authentication method updated'
2014-09-02 18:07:02 +05:30
else
2018-03-27 19:54:05 +05:30
oauth_user = Gitlab::Auth::OAuth::User.new(oauth)
2016-04-02 18:10:28 +05:30
oauth_user.save
@user = oauth_user.gl_user
2014-09-02 18:07:02 +05:30
2016-04-02 18:10:28 +05:30
continue_login_process
2014-09-02 18:07:02 +05:30
end
2018-03-27 19:54:05 +05:30
rescue Gitlab::Auth::OAuth::User::SigninDisabledForProviderError
2018-03-17 18:26:18 +05:30
handle_disabled_provider
2018-03-27 19:54:05 +05:30
rescue Gitlab::Auth::OAuth::User::SignupDisabledError
2016-06-02 11:05:42 +05:30
handle_signup_error
2014-09-02 18:07:02 +05:30
end
def handle_service_ticket(provider, ticket)
2018-03-27 19:54:05 +05:30
Gitlab::Auth::OAuth::Session.create provider, ticket
session[:service_tickets] ||= {}
session[:service_tickets][provider] = ticket
end
2016-04-02 18:10:28 +05:30
def continue_login_process
# Only allow properly saved users to login.
if @user.persisted? && @user.valid?
log_audit_event(@user, with: oauth['provider'])
2018-03-17 18:26:18 +05:30
2016-08-24 12:49:21 +05:30
if @user.two_factor_enabled?
2017-09-10 17:25:29 +05:30
params[:remember_me] = '1' if remember_me?
2016-08-24 12:49:21 +05:30
prompt_for_two_factor(@user)
else
2017-09-10 17:25:29 +05:30
remember_me(@user) if remember_me?
2016-08-24 12:49:21 +05:30
sign_in_and_redirect(@user)
end
2016-04-02 18:10:28 +05:30
else
2017-09-10 17:25:29 +05:30
fail_login
2016-04-02 18:10:28 +05:30
end
end
2016-06-02 11:05:42 +05:30
def handle_signup_error
2018-03-27 19:54:05 +05:30
label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider'])
2016-06-02 11:05:42 +05:30
message = "Signing in using your #{label} account without a pre-existing GitLab account is not allowed."
2018-03-17 18:26:18 +05:30
if Gitlab::CurrentSettings.allow_signup?
2016-06-02 11:05:42 +05:30
message << " Create a GitLab account first, and then connect it to your #{label} account."
end
flash[:notice] = message
redirect_to new_user_session_path
end
2014-09-02 18:07:02 +05:30
def oauth
@oauth ||= request.env['omniauth.auth']
end
2018-03-17 18:26:18 +05:30
2017-09-10 17:25:29 +05:30
def fail_login
error_message = @user.errors.full_messages.to_sentence
return redirect_to omniauth_error_path(oauth['provider'], error: error_message)
end
2018-03-17 18:26:18 +05:30
2017-09-10 17:25:29 +05:30
def fail_ldap_login
flash[:alert] = 'Access denied for your LDAP account.'
redirect_to new_user_session_path
end
2015-09-11 14:41:01 +05:30
2018-03-26 14:24:53 +05:30
def fail_auth0_login
flash[:alert] = 'Wrong extern UID provided. Make sure Auth0 is configured correctly.'
redirect_to new_user_session_path
end
2018-03-17 18:26:18 +05:30
def handle_disabled_provider
2018-03-27 19:54:05 +05:30
label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider'])
2018-03-17 18:26:18 +05:30
flash[:alert] = "Signing in using #{label} has been disabled"
redirect_to new_user_session_path
end
2015-09-11 14:41:01 +05:30
def log_audit_event(user, options = {})
2017-09-10 17:25:29 +05:30
AuditEventService.new(user, user, options)
.for_authentication.security_event
end
def remember_me?
request_params = request.env['omniauth.params']
(request_params['remember_me'] == '1') if request_params.present?
2015-09-11 14:41:01 +05:30
end
2014-09-02 18:07:02 +05:30
end