debian-mirror-gitlab/lib/gitlab/omniauth_initializer.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

147 lines
4.1 KiB
Ruby
Raw Normal View History

2018-12-13 13:39:08 +05:30
# frozen_string_literal: true
2018-05-09 12:01:36 +05:30
module Gitlab
class OmniauthInitializer
2020-05-24 23:13:21 +05:30
OAUTH2_TIMEOUT_SECONDS = 10
2022-05-07 20:08:51 +05:30
ConfigurationError = Class.new(StandardError)
2019-12-04 20:38:33 +05:30
2018-05-09 12:01:36 +05:30
def initialize(devise_config)
@devise_config = devise_config
end
def execute(providers)
providers.each do |provider|
2018-11-18 11:00:15 +05:30
name = provider['name'].to_sym
add_provider_to_devise(name, *arguments_for(provider))
setup_provider(name)
2018-05-09 12:01:36 +05:30
end
end
2020-05-24 23:13:21 +05:30
class << self
def default_arguments_for(provider_name)
case provider_name
when 'cas3'
{ on_single_sign_out: cas3_signout_handler }
when 'authentiq'
{ remote_sign_out_handler: authentiq_signout_handler }
when 'shibboleth'
{ fail_with_empty_uid: true }
when 'google_oauth2'
{ client_options: { connection_opts: { request: { timeout: OAUTH2_TIMEOUT_SECONDS } } } }
2022-04-04 11:22:00 +05:30
when 'gitlab'
{
authorize_params: { gl_auth_type: 'login' }
}
2020-05-24 23:13:21 +05:30
else
{}
end
end
2022-06-21 17:19:12 +05:30
def full_host
proc { |_env| Settings.gitlab['base_url'] }
end
2020-05-24 23:13:21 +05:30
private
def cas3_signout_handler
lambda do |request|
ticket = request.params[:session_index]
raise "Service Ticket not found." unless Gitlab::Auth::OAuth::Session.valid?(:cas3, ticket)
Gitlab::Auth::OAuth::Session.destroy(:cas3, ticket)
true
end
end
def authentiq_signout_handler
lambda do |request|
authentiq_session = request.params['sid']
if Gitlab::Auth::OAuth::Session.valid?(:authentiq, authentiq_session)
Gitlab::Auth::OAuth::Session.destroy(:authentiq, authentiq_session)
true
else
false
end
end
end
end
2018-05-09 12:01:36 +05:30
private
2018-11-18 11:00:15 +05:30
def add_provider_to_devise(*args)
2018-05-09 12:01:36 +05:30
@devise_config.omniauth(*args)
end
def arguments_for(provider)
provider_arguments = []
%w[app_id app_secret].each do |argument|
provider_arguments << provider[argument] if provider[argument]
end
2022-05-07 20:08:51 +05:30
arguments = provider.fetch('args', {})
defaults = provider_defaults(provider)
case arguments
2018-05-09 12:01:36 +05:30
when Array
2022-05-07 20:08:51 +05:30
# An Array from the configuration will be expanded
provider_arguments.concat arguments
provider_arguments << defaults unless defaults.empty?
2018-05-09 12:01:36 +05:30
when Hash
2022-05-07 20:08:51 +05:30
hash_arguments = arguments.deep_symbolize_keys.deep_merge(defaults)
normalized = normalize_hash_arguments(hash_arguments)
2018-05-09 12:01:36 +05:30
# A Hash from the configuration will be passed as is.
2022-05-07 20:08:51 +05:30
provider_arguments << normalized unless normalized.empty?
else
# this will prevent the application from starting in development mode.
# we still set defaults, and let the application start in prod.
Gitlab::ErrorTracking.track_and_raise_for_dev_exception(
ConfigurationError.new("Arguments were provided for #{provider['name']}, but not as an array or a hash"),
provider_name: provider['name'],
arguments_type: arguments.class.name
)
provider_arguments << defaults unless defaults.empty?
2018-05-09 12:01:36 +05:30
end
provider_arguments
end
2019-07-31 22:56:46 +05:30
def normalize_hash_arguments(args)
2020-05-24 23:13:21 +05:30
args.deep_symbolize_keys!
2019-07-31 22:56:46 +05:30
# Rails 5.1 deprecated the use of string names in the middleware
# (https://github.com/rails/rails/commit/83b767ce), so we need to
# pass in the actual class to Devise.
if args[:strategy_class].is_a?(String)
args[:strategy_class] = args[:strategy_class].constantize
end
args
end
2018-05-09 12:01:36 +05:30
def provider_defaults(provider)
2020-05-24 23:13:21 +05:30
self.class.default_arguments_for(provider['name'])
2018-05-09 12:01:36 +05:30
end
2018-11-18 11:00:15 +05:30
def omniauth_customized_providers
@omniauth_customized_providers ||= build_omniauth_customized_providers
end
# We override this in EE
def build_omniauth_customized_providers
%i[bitbucket jwt]
end
def setup_provider(provider)
case provider
when *omniauth_customized_providers
require_dependency "omni_auth/strategies/#{provider}"
end
end
2018-05-09 12:01:36 +05:30
end
end
2020-05-24 23:13:21 +05:30
2021-06-08 01:23:25 +05:30
Gitlab::OmniauthInitializer.prepend_mod_with('Gitlab::OmniauthInitializer')