debian-mirror-gitlab/app/controllers/omniauth_callbacks_controller.rb

293 lines
8.1 KiB
Ruby
Raw Normal View History

2018-12-05 23:21:45 +05:30
# frozen_string_literal: true
2014-09-02 18:07:02 +05:30
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
2021-01-03 14:25:43 +05:30
include AuthenticatesWithTwoFactorForAdminMode
2017-09-10 17:25:29 +05:30
include Devise::Controllers::Rememberable
2019-07-07 11:18:12 +05:30
include AuthHelper
2020-01-01 13:55:28 +05:30
include InitializesCurrentUserMode
2020-05-24 23:13:21 +05:30
include KnownSignIn
after_action :verify_known_sign_in
2015-09-11 14:41:01 +05:30
2019-03-02 22:35:43 +05:30
protect_from_forgery except: [:kerberos, :saml, :cas3, :failure], with: :exception, prepend: true
2015-09-11 14:41:01 +05:30
2021-01-03 14:25:43 +05:30
feature_category :authentication_and_authorization
2018-10-15 14:42:47 +05:30
def handle_omniauth
omniauth_flow(Gitlab::Auth::OAuth)
2014-09-02 18:07:02 +05:30
end
2018-10-15 14:42:47 +05:30
AuthHelper.providers_for_base_controller.each do |provider|
alias_method provider, :handle_omniauth
2018-03-17 18:26:18 +05:30
end
2018-05-09 12:01:36 +05:30
# Extend the standard implementation to also increment
# the number of failed sign in attempts
def failure
if params[:username].present? && AuthHelper.form_based_provider?(failed_strategy.name)
user = User.by_login(params[:username])
user&.increment_failed_attempts!
2020-10-24 23:57:45 +05:30
log_failed_login(params[:username], failed_strategy.name)
2018-05-09 12:01:36 +05:30
end
super
end
2014-09-02 18:07:02 +05:30
# Extend the standard message generation to accept our custom exception
def failure_message
2018-11-08 19:23:39 +05:30
exception = request.env["omniauth.error"]
2020-03-13 15:44:24 +05:30
error = exception.error_reason if exception.respond_to?(:error_reason)
2014-09-02 18:07:02 +05:30
error ||= exception.error if exception.respond_to?(:error)
error ||= exception.message if exception.respond_to?(:message)
2018-11-08 19:23:39 +05:30
error ||= request.env["omniauth.error.type"].to_s
2014-09-02 18:07:02 +05:30
2018-10-15 14:42:47 +05:30
error.to_s.humanize if error
2014-09-02 18:07:02 +05:30
end
2016-04-02 18:10:28 +05:30
def saml
2018-10-15 14:42:47 +05:30
omniauth_flow(Gitlab::Auth::Saml)
2019-09-30 23:59:55 +05:30
rescue Gitlab::Auth::Saml::IdentityLinker::UnverifiedRequest
redirect_unverified_saml_initiation
2016-04-02 18:10:28 +05:30
end
def cas3
ticket = params['ticket']
if ticket
handle_service_ticket oauth['provider'], ticket
end
2018-03-17 18:26:18 +05:30
handle_omniauth
end
2017-08-17 22:00:37 +05:30
def authentiq
if params['sid']
handle_service_ticket oauth['provider'], params['sid']
end
2018-03-17 18:26:18 +05:30
2017-08-17 22:00:37 +05:30
handle_omniauth
end
2018-03-26 14:24:53 +05:30
def auth0
if oauth['uid'].blank?
fail_auth0_login
else
handle_omniauth
end
end
2019-09-30 23:59:55 +05:30
def salesforce
if oauth.dig('extra', 'email_verified')
handle_omniauth
else
fail_salesforce_login
end
end
2020-11-24 15:15:51 +05:30
def atlassian_oauth2
omniauth_flow(Gitlab::Auth::Atlassian)
end
2014-09-02 18:07:02 +05:30
private
2020-10-24 23:57:45 +05:30
def log_failed_login(user, provider)
# overridden in EE
end
2020-05-24 23:13:21 +05:30
def after_omniauth_failure_path_for(scope)
if Feature.enabled?(:user_mode_in_session)
return new_admin_session_path if current_user_mode.admin_mode_requested?
end
super
end
2018-10-15 14:42:47 +05:30
def omniauth_flow(auth_module, identity_linker: nil)
2019-03-02 22:35:43 +05:30
if fragment = request.env.dig('omniauth.params', 'redirect_fragment').presence
store_redirect_fragment(fragment)
end
2014-09-02 18:07:02 +05:30
if current_user
2019-07-07 11:18:12 +05:30
return render_403 unless link_provider_allowed?(oauth['provider'])
2015-09-11 14:41:01 +05:30
log_audit_event(current_user, with: oauth['provider'])
2019-07-31 22:56:46 +05:30
2020-01-01 13:55:28 +05:30
if Feature.enabled?(:user_mode_in_session)
2020-04-08 14:13:33 +05:30
return admin_mode_flow(auth_module::User) if current_user_mode.admin_mode_requested?
2020-01-01 13:55:28 +05:30
end
identity_linker ||= auth_module::IdentityLinker.new(current_user, oauth, session)
2019-07-31 22:56:46 +05:30
link_identity(identity_linker)
2018-10-15 14:42:47 +05:30
if identity_linker.changed?
redirect_identity_linked
elsif identity_linker.failed?
redirect_identity_link_failed(identity_linker.error_message)
else
redirect_identity_exists
end
else
sign_in_user_flow(auth_module::User)
2014-09-02 18:07:02 +05:30
end
2018-10-15 14:42:47 +05:30
end
2019-07-31 22:56:46 +05:30
def link_identity(identity_linker)
identity_linker.link
end
2018-10-15 14:42:47 +05:30
def redirect_identity_exists
redirect_to after_sign_in_path_for(current_user)
end
def redirect_identity_link_failed(error_message)
2019-07-31 22:56:46 +05:30
redirect_to profile_account_path, notice: _("Authentication failed: %{error_message}") % { error_message: error_message }
2018-10-15 14:42:47 +05:30
end
def redirect_identity_linked
2019-07-31 22:56:46 +05:30
redirect_to profile_account_path, notice: _('Authentication method updated')
2014-09-02 18:07:02 +05:30
end
def handle_service_ticket(provider, ticket)
2018-03-27 19:54:05 +05:30
Gitlab::Auth::OAuth::Session.create provider, ticket
session[:service_tickets] ||= {}
session[:service_tickets][provider] = ticket
end
2019-03-02 22:35:43 +05:30
def build_auth_user(auth_user_class)
auth_user_class.new(oauth)
end
2018-10-15 14:42:47 +05:30
def sign_in_user_flow(auth_user_class)
2019-03-02 22:35:43 +05:30
auth_user = build_auth_user(auth_user_class)
2018-10-15 14:42:47 +05:30
user = auth_user.find_and_update!
if auth_user.valid_sign_in?
log_audit_event(user, with: oauth['provider'])
set_remember_me(user)
2018-03-17 18:26:18 +05:30
2018-11-08 19:23:39 +05:30
if user.two_factor_enabled? && !auth_user.bypass_two_factor?
2018-10-15 14:42:47 +05:30
prompt_for_two_factor(user)
2016-08-24 12:49:21 +05:30
else
2019-12-21 20:55:43 +05:30
if user.deactivated?
user.activate
flash[:notice] = _('Welcome back! Your account had been deactivated due to inactivity but is now reactivated.')
end
2019-10-12 21:52:04 +05:30
sign_in_and_redirect(user, event: :authentication)
2016-08-24 12:49:21 +05:30
end
2016-04-02 18:10:28 +05:30
else
2018-10-15 14:42:47 +05:30
fail_login(user)
2016-04-02 18:10:28 +05:30
end
2018-10-15 14:42:47 +05:30
rescue Gitlab::Auth::OAuth::User::SigninDisabledForProviderError
handle_disabled_provider
rescue Gitlab::Auth::OAuth::User::SignupDisabledError
handle_signup_error
2016-04-02 18:10:28 +05:30
end
2016-06-02 11:05:42 +05:30
def handle_signup_error
2018-03-27 19:54:05 +05:30
label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider'])
2019-07-31 22:56:46 +05:30
message = [_("Signing in using your %{label} account without a pre-existing GitLab account is not allowed.") % { label: label }]
2016-06-02 11:05:42 +05:30
2018-03-17 18:26:18 +05:30
if Gitlab::CurrentSettings.allow_signup?
2019-07-31 22:56:46 +05:30
message << _("Create a GitLab account first, and then connect it to your %{label} account.") % { label: label }
2016-06-02 11:05:42 +05:30
end
2020-03-13 15:44:24 +05:30
flash[:alert] = message.join(' ')
2016-06-02 11:05:42 +05:30
redirect_to new_user_session_path
end
2014-09-02 18:07:02 +05:30
def oauth
@oauth ||= request.env['omniauth.auth']
end
2018-03-17 18:26:18 +05:30
2018-10-15 14:42:47 +05:30
def fail_login(user)
2020-10-24 23:57:45 +05:30
log_failed_login(user.username, oauth['provider'])
2020-09-03 11:15:55 +05:30
@provider = Gitlab::Auth::OAuth::Provider.label_for(params[:action])
@error = user.errors.full_messages.to_sentence
2017-09-10 17:25:29 +05:30
2020-09-03 11:15:55 +05:30
render 'errors/omniauth_error', layout: "oauth_error", status: :unprocessable_entity
2017-09-10 17:25:29 +05:30
end
2018-03-17 18:26:18 +05:30
2018-03-26 14:24:53 +05:30
def fail_auth0_login
2019-09-30 23:59:55 +05:30
fail_login_with_message(_('Wrong extern UID provided. Make sure Auth0 is configured correctly.'))
end
def fail_salesforce_login
fail_login_with_message(_('Email not verified. Please verify your email in Salesforce.'))
end
def fail_login_with_message(message)
flash[:alert] = message
2018-03-26 14:24:53 +05:30
redirect_to new_user_session_path
end
2019-09-30 23:59:55 +05:30
def redirect_unverified_saml_initiation
redirect_to profile_account_path, notice: _('Request to link SAML account must be authorized')
end
2018-03-17 18:26:18 +05:30
def handle_disabled_provider
2018-03-27 19:54:05 +05:30
label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider'])
2019-07-31 22:56:46 +05:30
flash[:alert] = _("Signing in using %{label} has been disabled") % { label: label }
2018-03-17 18:26:18 +05:30
redirect_to new_user_session_path
end
2015-09-11 14:41:01 +05:30
def log_audit_event(user, options = {})
2017-09-10 17:25:29 +05:30
AuditEventService.new(user, user, options)
.for_authentication.security_event
end
2018-10-15 14:42:47 +05:30
def set_remember_me(user)
return unless remember_me?
if user.two_factor_enabled?
params[:remember_me] = '1'
else
remember_me(user)
end
end
2017-09-10 17:25:29 +05:30
def remember_me?
request_params = request.env['omniauth.params']
(request_params['remember_me'] == '1') if request_params.present?
2015-09-11 14:41:01 +05:30
end
2019-03-02 22:35:43 +05:30
def store_redirect_fragment(redirect_fragment)
key = stored_location_key_for(:user)
location = session[key]
if uri = parse_uri(location)
uri.fragment = redirect_fragment
store_location_for(:user, uri.to_s)
end
end
2020-01-01 13:55:28 +05:30
2020-04-08 14:13:33 +05:30
def admin_mode_flow(auth_user_class)
auth_user = build_auth_user(auth_user_class)
return fail_admin_mode_invalid_credentials unless omniauth_identity_matches_current_user?
if current_user.two_factor_enabled? && !auth_user.bypass_two_factor?
admin_mode_prompt_for_two_factor(current_user)
else
# Can only reach here if the omniauth identity matches current user
# and current_user is an admin that requested admin mode
2020-01-01 13:55:28 +05:30
current_user_mode.enable_admin_mode!(skip_password_validation: true)
redirect_to stored_location_for(:redirect) || admin_root_path, notice: _('Admin mode enabled')
end
end
def omniauth_identity_matches_current_user?
current_user.matches_identity?(oauth['provider'], oauth['uid'])
end
def fail_admin_mode_invalid_credentials
redirect_to new_admin_session_path, alert: _('Invalid login or password')
end
2014-09-02 18:07:02 +05:30
end
2019-12-04 20:38:33 +05:30
OmniauthCallbacksController.prepend_if_ee('EE::OmniauthCallbacksController')