debian-mirror-gitlab/lib/gitlab/ldap/access.rb

88 lines
2.3 KiB
Ruby
Raw Normal View History

2015-04-26 12:48:37 +05:30
# LDAP authorization model
#
# * Check if we are allowed access (not blocked)
#
2014-09-02 18:07:02 +05:30
module Gitlab
module LDAP
class Access
attr_reader :provider, :user
2014-09-02 18:07:02 +05:30
2015-04-26 12:48:37 +05:30
def self.open(user, &block)
Gitlab::LDAP::Adapter.open(user.ldap_identity.provider) do |adapter|
block.call(self.new(user, adapter))
2014-09-02 18:07:02 +05:30
end
end
def self.allowed?(user)
2015-04-26 12:48:37 +05:30
self.open(user) do |access|
if access.allowed?
2017-09-10 17:25:29 +05:30
Users::UpdateService.new(user, last_credential_check_at: Time.now).execute
2014-09-02 18:07:02 +05:30
true
else
false
end
end
end
2016-09-13 17:45:13 +05:30
def initialize(user, adapter = nil)
2014-09-02 18:07:02 +05:30
@adapter = adapter
2015-04-26 12:48:37 +05:30
@user = user
@provider = user.ldap_identity.provider
2014-09-02 18:07:02 +05:30
end
2015-04-26 12:48:37 +05:30
def allowed?
if ldap_user
2016-06-02 11:05:42 +05:30
unless ldap_config.active_directory
2017-08-17 22:00:37 +05:30
unblock_user(user, 'is available again') if user.ldap_blocked?
2016-06-02 11:05:42 +05:30
return true
end
2015-04-26 12:48:37 +05:30
# Block user in GitLab if he/she was blocked in AD
if Gitlab::LDAP::Person.disabled_via_active_directory?(user.ldap_identity.extern_uid, adapter)
2017-08-17 22:00:37 +05:30
block_user(user, 'is disabled in Active Directory')
2015-04-26 12:48:37 +05:30
false
else
2017-08-17 22:00:37 +05:30
unblock_user(user, 'is not disabled anymore') if user.ldap_blocked?
2015-04-26 12:48:37 +05:30
true
end
2014-09-02 18:07:02 +05:30
else
2015-12-23 02:04:40 +05:30
# Block the user if they no longer exist in LDAP/AD
2017-08-17 22:00:37 +05:30
block_user(user, 'does not exist anymore')
2014-09-02 18:07:02 +05:30
false
end
end
2015-04-26 12:48:37 +05:30
def adapter
@adapter ||= Gitlab::LDAP::Adapter.new(provider)
end
def ldap_config
Gitlab::LDAP::Config.new(provider)
end
def ldap_user
@ldap_user ||= Gitlab::LDAP::Person.find_by_dn(user.ldap_identity.extern_uid, adapter)
end
2017-08-17 22:00:37 +05:30
def block_user(user, reason)
user.ldap_block
Gitlab::AppLogger.info(
"LDAP account \"#{user.ldap_identity.extern_uid}\" #{reason}, " \
"blocking Gitlab user \"#{user.name}\" (#{user.email})"
)
end
def unblock_user(user, reason)
user.activate
Gitlab::AppLogger.info(
"LDAP account \"#{user.ldap_identity.extern_uid}\" #{reason}, " \
"unblocking Gitlab user \"#{user.name}\" (#{user.email})"
)
end
2014-09-02 18:07:02 +05:30
end
end
end