2012-01-28 08:23:17 -05:00
|
|
|
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
|
2016-02-03 13:31:12 -05:00
|
|
|
include AuthenticatesWithTwoFactor
|
2015-05-27 10:37:22 -04:00
|
|
|
|
2015-11-11 23:25:31 -05:00
|
|
|
protect_from_forgery except: [:kerberos, :saml, :cas3]
|
2015-05-27 10:37:22 -04:00
|
|
|
|
2012-12-14 19:16:25 -05:00
|
|
|
Gitlab.config.omniauth.providers.each do |provider|
|
2012-09-12 01:23:20 -04:00
|
|
|
define_method provider['name'] do
|
|
|
|
handle_omniauth
|
|
|
|
end
|
|
|
|
end
|
2012-07-16 18:31:28 -04:00
|
|
|
|
|
|
|
# Extend the standard message generation to accept our custom exception
|
|
|
|
def failure_message
|
|
|
|
exception = env["omniauth.error"]
|
2012-07-21 04:04:05 -04:00
|
|
|
error = exception.error_reason if exception.respond_to?(:error_reason)
|
|
|
|
error ||= exception.error if exception.respond_to?(:error)
|
|
|
|
error ||= exception.message if exception.respond_to?(:message)
|
|
|
|
error ||= env["omniauth.error.type"].to_s
|
2012-07-16 18:31:28 -04:00
|
|
|
error.to_s.humanize if error
|
|
|
|
end
|
2012-08-03 11:27:39 -04:00
|
|
|
|
2014-10-13 07:39:54 -04:00
|
|
|
# We only find ourselves here
|
|
|
|
# if the authentication to LDAP was successful.
|
2012-01-28 08:23:17 -05:00
|
|
|
def ldap
|
2016-01-28 13:31:48 -05:00
|
|
|
ldap_user = Gitlab::LDAP::User.new(oauth)
|
|
|
|
ldap_user.save if ldap_user.changed? # will also save new users
|
|
|
|
|
|
|
|
@user = ldap_user.gl_user
|
|
|
|
@user.remember_me = params[:remember_me] if ldap_user.persisted?
|
2014-06-12 10:01:23 -04:00
|
|
|
|
2014-07-30 03:50:50 -04:00
|
|
|
# Do additional LDAP checks for the user filter and EE features
|
2016-01-28 13:31:48 -05:00
|
|
|
if ldap_user.allowed?
|
2016-02-03 13:31:12 -05:00
|
|
|
if @user.two_factor_enabled?
|
|
|
|
prompt_for_two_factor(@user)
|
|
|
|
else
|
|
|
|
log_audit_event(@user, with: :ldap)
|
|
|
|
sign_in_and_redirect(@user)
|
|
|
|
end
|
2014-07-30 03:50:50 -04:00
|
|
|
else
|
|
|
|
flash[:alert] = "Access denied for your LDAP account."
|
|
|
|
redirect_to new_user_session_path
|
2014-06-12 10:01:23 -04:00
|
|
|
end
|
2012-01-28 08:23:17 -05:00
|
|
|
end
|
|
|
|
|
2016-02-18 17:01:07 -05:00
|
|
|
def saml
|
|
|
|
if current_user
|
|
|
|
log_audit_event(current_user, with: :saml)
|
|
|
|
# Update SAML identity if data has changed.
|
|
|
|
identity = current_user.identities.find_by(extern_uid: oauth['uid'], provider: :saml)
|
|
|
|
if identity.nil?
|
|
|
|
current_user.identities.create(extern_uid: oauth['uid'], provider: :saml)
|
|
|
|
redirect_to profile_account_path, notice: 'Authentication method updated'
|
|
|
|
else
|
|
|
|
redirect_to after_sign_in_path_for(current_user)
|
|
|
|
end
|
|
|
|
else
|
|
|
|
saml_user = Gitlab::Saml::User.new(oauth)
|
2016-04-04 20:10:59 -04:00
|
|
|
saml_user.save if saml_user.changed?
|
2016-02-18 17:01:07 -05:00
|
|
|
@user = saml_user.gl_user
|
|
|
|
|
|
|
|
continue_login_process
|
|
|
|
end
|
2016-04-07 17:45:33 -04:00
|
|
|
rescue Gitlab::OAuth::SignupDisabledError
|
|
|
|
handle_signup_error
|
2016-02-18 17:01:07 -05:00
|
|
|
end
|
|
|
|
|
2014-06-24 08:16:52 -04:00
|
|
|
def omniauth_error
|
|
|
|
@provider = params[:provider]
|
|
|
|
@error = params[:error]
|
|
|
|
render 'errors/omniauth_error', layout: "errors", status: 422
|
|
|
|
end
|
|
|
|
|
2015-11-11 23:25:31 -05:00
|
|
|
def cas3
|
|
|
|
ticket = params['ticket']
|
|
|
|
if ticket
|
|
|
|
handle_service_ticket oauth['provider'], ticket
|
|
|
|
end
|
|
|
|
handle_omniauth
|
|
|
|
end
|
|
|
|
|
2012-08-03 11:27:39 -04:00
|
|
|
private
|
|
|
|
|
|
|
|
def handle_omniauth
|
|
|
|
if current_user
|
2014-11-25 11:15:30 -05:00
|
|
|
# Add new authentication method
|
|
|
|
current_user.identities.find_or_create_by(extern_uid: oauth['uid'], provider: oauth['provider'])
|
2015-07-03 07:54:50 -04:00
|
|
|
log_audit_event(current_user, with: oauth['provider'])
|
2015-02-08 03:53:31 -05:00
|
|
|
redirect_to profile_account_path, notice: 'Authentication method updated'
|
2012-08-03 11:27:39 -04:00
|
|
|
else
|
2016-02-18 17:01:07 -05:00
|
|
|
oauth_user = Gitlab::OAuth::User.new(oauth)
|
|
|
|
oauth_user.save
|
|
|
|
@user = oauth_user.gl_user
|
2012-08-03 11:27:39 -04:00
|
|
|
|
2016-02-18 17:01:07 -05:00
|
|
|
continue_login_process
|
2012-08-03 11:27:39 -04:00
|
|
|
end
|
2015-10-03 01:56:37 -04:00
|
|
|
rescue Gitlab::OAuth::SignupDisabledError
|
2016-04-07 17:45:33 -04:00
|
|
|
handle_signup_error
|
2012-08-03 11:27:39 -04:00
|
|
|
end
|
2013-09-03 17:06:29 -04:00
|
|
|
|
2015-11-11 23:25:31 -05:00
|
|
|
def handle_service_ticket provider, ticket
|
|
|
|
Gitlab::OAuth::Session.create provider, ticket
|
|
|
|
session[:service_tickets] ||= {}
|
|
|
|
session[:service_tickets][provider] = ticket
|
|
|
|
end
|
|
|
|
|
2016-02-18 17:01:07 -05:00
|
|
|
def continue_login_process
|
|
|
|
# Only allow properly saved users to login.
|
|
|
|
if @user.persisted? && @user.valid?
|
|
|
|
log_audit_event(@user, with: oauth['provider'])
|
|
|
|
sign_in_and_redirect(@user)
|
|
|
|
else
|
|
|
|
error_message = @user.errors.full_messages.to_sentence
|
|
|
|
|
|
|
|
redirect_to omniauth_error_path(oauth['provider'], error: error_message) and return
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-04-07 17:45:33 -04:00
|
|
|
def handle_signup_error
|
|
|
|
label = Gitlab::OAuth::Provider.label_for(oauth['provider'])
|
|
|
|
message = "Signing in using your #{label} account without a pre-existing GitLab account is not allowed."
|
|
|
|
|
|
|
|
if current_application_settings.signup_enabled?
|
|
|
|
message << " Create a GitLab account first, and then connect it to your #{label} account."
|
|
|
|
end
|
|
|
|
|
|
|
|
flash[:notice] = message
|
|
|
|
|
|
|
|
redirect_to new_user_session_path
|
|
|
|
end
|
|
|
|
|
2013-09-03 17:06:29 -04:00
|
|
|
def oauth
|
|
|
|
@oauth ||= request.env['omniauth.auth']
|
|
|
|
end
|
2015-07-03 07:54:50 -04:00
|
|
|
|
|
|
|
def log_audit_event(user, options = {})
|
|
|
|
AuditEventService.new(user, user, options).
|
|
|
|
for_authentication.security_event
|
|
|
|
end
|
2012-01-28 08:23:17 -05:00
|
|
|
end
|