2018-09-14 05:42:05 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2012-01-28 13:23:17 +00:00
|
|
|
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
|
2016-02-03 18:31:12 +00:00
|
|
|
include AuthenticatesWithTwoFactor
|
2017-06-07 08:45:34 +00:00
|
|
|
include Devise::Controllers::Rememberable
|
2015-05-27 14:37:22 +00:00
|
|
|
|
2018-06-21 10:44:31 +00:00
|
|
|
protect_from_forgery except: [:kerberos, :saml, :cas3], prepend: true
|
2015-05-27 14:37:22 +00:00
|
|
|
|
2018-04-23 15:03:01 +00:00
|
|
|
def handle_omniauth
|
|
|
|
omniauth_flow(Gitlab::Auth::OAuth)
|
|
|
|
end
|
|
|
|
|
2018-04-22 23:15:48 +00:00
|
|
|
AuthHelper.providers_for_base_controller.each do |provider|
|
|
|
|
alias_method provider, :handle_omniauth
|
2012-09-12 05:23:20 +00:00
|
|
|
end
|
2012-07-16 22:31:28 +00:00
|
|
|
|
2018-03-20 13:49:51 +00:00
|
|
|
# Extend the standard implementation to also increment
|
|
|
|
# the number of failed sign in attempts
|
|
|
|
def failure
|
2018-03-22 10:34:42 +00:00
|
|
|
if params[:username].present? && AuthHelper.form_based_provider?(failed_strategy.name)
|
|
|
|
user = User.by_login(params[:username])
|
2018-03-20 13:49:51 +00:00
|
|
|
|
2018-03-22 10:34:42 +00:00
|
|
|
user&.increment_failed_attempts!
|
|
|
|
end
|
2018-03-20 13:49:51 +00:00
|
|
|
|
|
|
|
super
|
|
|
|
end
|
|
|
|
|
2012-07-16 22:31:28 +00:00
|
|
|
# Extend the standard message generation to accept our custom exception
|
|
|
|
def failure_message
|
2018-04-22 23:17:49 +00:00
|
|
|
exception = request.env["omniauth.error"]
|
2012-07-21 08:04:05 +00:00
|
|
|
error = exception.error_reason if exception.respond_to?(:error_reason)
|
|
|
|
error ||= exception.error if exception.respond_to?(:error)
|
|
|
|
error ||= exception.message if exception.respond_to?(:message)
|
2018-04-22 23:17:49 +00:00
|
|
|
error ||= request.env["omniauth.error.type"].to_s
|
2016-01-28 18:31:48 +00:00
|
|
|
|
2018-04-18 14:03:27 +00:00
|
|
|
error.to_s.humanize if error
|
2012-01-28 13:23:17 +00:00
|
|
|
end
|
|
|
|
|
2016-02-18 22:01:07 +00:00
|
|
|
def saml
|
2018-04-18 14:03:27 +00:00
|
|
|
omniauth_flow(Gitlab::Auth::Saml)
|
2016-02-18 22:01:07 +00:00
|
|
|
end
|
|
|
|
|
2014-06-24 12:16:52 +00:00
|
|
|
def omniauth_error
|
|
|
|
@provider = params[:provider]
|
|
|
|
@error = params[:error]
|
2017-05-05 08:33:04 +00:00
|
|
|
render 'errors/omniauth_error', layout: "oauth_error", status: 422
|
2014-06-24 12:16:52 +00:00
|
|
|
end
|
|
|
|
|
2015-11-12 04:25:31 +00:00
|
|
|
def cas3
|
|
|
|
ticket = params['ticket']
|
|
|
|
if ticket
|
|
|
|
handle_service_ticket oauth['provider'], ticket
|
|
|
|
end
|
2018-01-11 16:34:01 +00:00
|
|
|
|
2015-11-12 04:25:31 +00:00
|
|
|
handle_omniauth
|
|
|
|
end
|
|
|
|
|
2017-01-06 19:07:27 +00:00
|
|
|
def authentiq
|
|
|
|
if params['sid']
|
|
|
|
handle_service_ticket oauth['provider'], params['sid']
|
|
|
|
end
|
2018-01-11 16:34:01 +00:00
|
|
|
|
2017-01-06 19:07:27 +00:00
|
|
|
handle_omniauth
|
|
|
|
end
|
|
|
|
|
2018-03-15 15:01:13 +00:00
|
|
|
def auth0
|
|
|
|
if oauth['uid'].blank?
|
|
|
|
fail_auth0_login
|
|
|
|
else
|
|
|
|
handle_omniauth
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2012-08-03 15:27:39 +00:00
|
|
|
private
|
|
|
|
|
2018-04-18 14:03:27 +00:00
|
|
|
def omniauth_flow(auth_module, identity_linker: nil)
|
2018-06-04 21:28:18 +00:00
|
|
|
if fragment = request.env.dig('omniauth.params', 'redirect_fragment').presence
|
|
|
|
store_redirect_fragment(fragment)
|
2018-05-22 20:04:19 +00:00
|
|
|
end
|
|
|
|
|
2012-08-03 15:27:39 +00:00
|
|
|
if current_user
|
2015-07-03 11:54:50 +00:00
|
|
|
log_audit_event(current_user, with: oauth['provider'])
|
2012-08-03 15:27:39 +00:00
|
|
|
|
2018-04-18 14:03:27 +00:00
|
|
|
identity_linker ||= auth_module::IdentityLinker.new(current_user, oauth)
|
|
|
|
|
2018-04-23 10:56:44 +00:00
|
|
|
identity_linker.link
|
2018-04-18 14:03:27 +00:00
|
|
|
|
2018-04-23 10:56:44 +00:00
|
|
|
if identity_linker.changed?
|
2018-04-18 14:03:27 +00:00
|
|
|
redirect_identity_linked
|
2018-04-22 23:05:12 +00:00
|
|
|
elsif identity_linker.failed?
|
2018-04-22 18:08:08 +00:00
|
|
|
redirect_identity_link_failed(identity_linker.error_message)
|
2018-04-18 14:03:27 +00:00
|
|
|
else
|
|
|
|
redirect_identity_exists
|
|
|
|
end
|
|
|
|
else
|
|
|
|
sign_in_user_flow(auth_module::User)
|
2012-08-03 15:27:39 +00:00
|
|
|
end
|
2018-04-18 14:03:27 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def redirect_identity_exists
|
|
|
|
redirect_to after_sign_in_path_for(current_user)
|
|
|
|
end
|
|
|
|
|
2018-04-22 18:08:08 +00:00
|
|
|
def redirect_identity_link_failed(error_message)
|
|
|
|
redirect_to profile_account_path, notice: "Authentication failed: #{error_message}"
|
|
|
|
end
|
|
|
|
|
2018-04-18 14:03:27 +00:00
|
|
|
def redirect_identity_linked
|
|
|
|
redirect_to profile_account_path, notice: 'Authentication method updated'
|
2012-08-03 15:27:39 +00:00
|
|
|
end
|
2013-09-03 21:06:29 +00:00
|
|
|
|
2016-05-30 10:08:53 +00:00
|
|
|
def handle_service_ticket(provider, ticket)
|
2018-02-23 12:10:39 +00:00
|
|
|
Gitlab::Auth::OAuth::Session.create provider, ticket
|
2015-11-12 04:25:31 +00:00
|
|
|
session[:service_tickets] ||= {}
|
|
|
|
session[:service_tickets][provider] = ticket
|
|
|
|
end
|
|
|
|
|
2018-04-18 14:03:27 +00:00
|
|
|
def sign_in_user_flow(auth_user_class)
|
|
|
|
auth_user = auth_user_class.new(oauth)
|
|
|
|
user = auth_user.find_and_update!
|
|
|
|
|
|
|
|
if auth_user.valid_sign_in?
|
|
|
|
log_audit_event(user, with: oauth['provider'])
|
|
|
|
|
|
|
|
set_remember_me(user)
|
2018-01-11 16:34:01 +00:00
|
|
|
|
2018-06-25 15:32:03 +00:00
|
|
|
if user.two_factor_enabled? && !auth_user.bypass_two_factor?
|
2018-04-18 14:03:27 +00:00
|
|
|
prompt_for_two_factor(user)
|
2016-06-30 19:54:07 +00:00
|
|
|
else
|
2018-04-18 14:03:27 +00:00
|
|
|
sign_in_and_redirect(user)
|
2016-06-30 19:54:07 +00:00
|
|
|
end
|
2016-02-18 22:01:07 +00:00
|
|
|
else
|
2018-04-18 14:03:27 +00:00
|
|
|
fail_login(user)
|
2016-02-18 22:01:07 +00:00
|
|
|
end
|
2018-04-18 14:03:27 +00:00
|
|
|
rescue Gitlab::Auth::OAuth::User::SigninDisabledForProviderError
|
|
|
|
handle_disabled_provider
|
|
|
|
rescue Gitlab::Auth::OAuth::User::SignupDisabledError
|
|
|
|
handle_signup_error
|
2016-02-18 22:01:07 +00:00
|
|
|
end
|
|
|
|
|
2016-04-07 21:45:33 +00:00
|
|
|
def handle_signup_error
|
2018-02-23 12:10:39 +00:00
|
|
|
label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider'])
|
2018-09-14 05:42:05 +00:00
|
|
|
message = ["Signing in using your #{label} account without a pre-existing GitLab account is not allowed."]
|
2016-04-07 21:45:33 +00:00
|
|
|
|
2018-02-02 18:39:55 +00:00
|
|
|
if Gitlab::CurrentSettings.allow_signup?
|
2018-09-14 05:42:05 +00:00
|
|
|
message << "Create a GitLab account first, and then connect it to your #{label} account."
|
2016-04-07 21:45:33 +00:00
|
|
|
end
|
|
|
|
|
2018-09-14 05:42:05 +00:00
|
|
|
flash[:notice] = message.join(' ')
|
2016-04-07 21:45:33 +00:00
|
|
|
redirect_to new_user_session_path
|
|
|
|
end
|
|
|
|
|
2013-09-03 21:06:29 +00:00
|
|
|
def oauth
|
|
|
|
@oauth ||= request.env['omniauth.auth']
|
|
|
|
end
|
2017-08-15 17:44:37 +00:00
|
|
|
|
2018-04-18 14:03:27 +00:00
|
|
|
def fail_login(user)
|
|
|
|
error_message = user.errors.full_messages.to_sentence
|
2017-08-07 20:10:24 +00:00
|
|
|
|
|
|
|
return redirect_to omniauth_error_path(oauth['provider'], error: error_message)
|
|
|
|
end
|
2017-08-15 17:44:37 +00:00
|
|
|
|
2018-03-15 15:01:13 +00:00
|
|
|
def fail_auth0_login
|
|
|
|
flash[:alert] = 'Wrong extern UID provided. Make sure Auth0 is configured correctly.'
|
|
|
|
|
|
|
|
redirect_to new_user_session_path
|
|
|
|
end
|
|
|
|
|
2018-01-09 16:47:31 +00:00
|
|
|
def handle_disabled_provider
|
2018-02-23 12:10:39 +00:00
|
|
|
label = Gitlab::Auth::OAuth::Provider.label_for(oauth['provider'])
|
2018-01-09 16:47:31 +00:00
|
|
|
flash[:alert] = "Signing in using #{label} has been disabled"
|
|
|
|
|
|
|
|
redirect_to new_user_session_path
|
|
|
|
end
|
|
|
|
|
2015-07-03 11:54:50 +00:00
|
|
|
def log_audit_event(user, options = {})
|
2017-06-21 13:48:12 +00:00
|
|
|
AuditEventService.new(user, user, options)
|
|
|
|
.for_authentication.security_event
|
2015-07-03 11:54:50 +00:00
|
|
|
end
|
2017-06-07 08:45:34 +00:00
|
|
|
|
2018-04-18 14:03:27 +00:00
|
|
|
def set_remember_me(user)
|
|
|
|
return unless remember_me?
|
|
|
|
|
|
|
|
if user.two_factor_enabled?
|
|
|
|
params[:remember_me] = '1'
|
|
|
|
else
|
|
|
|
remember_me(user)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-06-07 08:45:34 +00:00
|
|
|
def remember_me?
|
|
|
|
request_params = request.env['omniauth.params']
|
2017-07-03 19:37:37 +00:00
|
|
|
(request_params['remember_me'] == '1') if request_params.present?
|
2017-06-07 08:45:34 +00:00
|
|
|
end
|
2018-05-22 20:04:19 +00:00
|
|
|
|
|
|
|
def store_redirect_fragment(redirect_fragment)
|
|
|
|
key = stored_location_key_for(:user)
|
|
|
|
location = session[key]
|
2018-06-04 21:28:18 +00:00
|
|
|
if uri = parse_uri(location)
|
2018-05-22 20:04:19 +00:00
|
|
|
uri.fragment = redirect_fragment
|
|
|
|
store_location_for(:user, uri.to_s)
|
|
|
|
end
|
|
|
|
end
|
2012-01-28 13:23:17 +00:00
|
|
|
end
|