2013-02-14 13:25:55 +00:00
|
|
|
require_relative 'shell_env'
|
2013-04-27 20:20:26 +00:00
|
|
|
require 'omniauth-ldap'
|
2013-02-14 13:25:55 +00:00
|
|
|
|
2012-06-29 03:30:31 +00:00
|
|
|
module Grack
|
|
|
|
class Auth < Rack::Auth::Basic
|
2012-10-21 09:12:14 +00:00
|
|
|
attr_accessor :user, :project
|
2012-06-29 03:30:31 +00:00
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
def call(env)
|
|
|
|
@env = env
|
|
|
|
@request = Rack::Request.new(env)
|
|
|
|
@auth = Request.new(env)
|
2013-01-10 18:17:57 +00:00
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
# Need this patch due to the rails mount
|
|
|
|
@env['PATH_INFO'] = @request.path
|
|
|
|
@env['SCRIPT_NAME'] = ""
|
2012-11-26 09:23:08 +00:00
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
return render_not_found unless project
|
|
|
|
return unauthorized unless project.public || @auth.provided?
|
|
|
|
return bad_request if @auth.provided? && !@auth.basic?
|
2012-11-26 09:23:08 +00:00
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
if valid?
|
|
|
|
if @auth.provided?
|
|
|
|
@env['REMOTE_USER'] = @auth.username
|
|
|
|
end
|
|
|
|
return @app.call(env)
|
|
|
|
else
|
|
|
|
unauthorized
|
|
|
|
end
|
|
|
|
end
|
2012-06-29 13:40:23 +00:00
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
def valid?
|
|
|
|
if @auth.provided?
|
|
|
|
# Authentication with username and password
|
|
|
|
login, password = @auth.credentials
|
2013-05-24 17:36:28 +00:00
|
|
|
|
|
|
|
@user = authenticate(login, password)
|
|
|
|
return false unless @user
|
|
|
|
|
|
|
|
Gitlab::ShellEnv.set_env(@user)
|
2013-01-14 14:46:55 +00:00
|
|
|
end
|
2012-07-02 08:44:45 +00:00
|
|
|
|
2012-06-29 07:43:15 +00:00
|
|
|
# Git upload and receive
|
2012-09-17 10:36:23 +00:00
|
|
|
if @request.get?
|
2012-10-21 09:12:14 +00:00
|
|
|
validate_get_request
|
2012-09-17 10:36:23 +00:00
|
|
|
elsif @request.post?
|
2012-10-21 09:12:14 +00:00
|
|
|
validate_post_request
|
2012-06-29 10:11:37 +00:00
|
|
|
else
|
|
|
|
false
|
2012-06-29 07:43:15 +00:00
|
|
|
end
|
2012-10-21 09:12:14 +00:00
|
|
|
end
|
|
|
|
|
2013-05-24 17:36:28 +00:00
|
|
|
def authenticate(login, password)
|
|
|
|
user = User.find_by_email(login) || User.find_by_username(login)
|
|
|
|
|
|
|
|
# If the provided login was not a known email or username
|
|
|
|
# then user is nil
|
|
|
|
if user.nil? || user.ldap_user?
|
|
|
|
# Second chance - try LDAP authentication
|
|
|
|
return nil unless ldap_conf.enabled
|
|
|
|
|
|
|
|
auth = Gitlab::Auth.new
|
|
|
|
auth.ldap_auth(login, password)
|
|
|
|
else
|
|
|
|
return user if user.valid_password?(password)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2013-04-27 20:20:26 +00:00
|
|
|
def ldap_auth(login, password)
|
|
|
|
# Check user against LDAP backend if user is not authenticated
|
|
|
|
# Only check with valid login and password to prevent anonymous bind results
|
2013-05-24 17:36:28 +00:00
|
|
|
return nil unless ldap_conf.enabled && !login.blank? && !password.blank?
|
|
|
|
|
|
|
|
ldap = OmniAuth::LDAP::Adaptor.new(ldap_conf)
|
|
|
|
ldap_user = ldap.bind_as(
|
|
|
|
filter: Net::LDAP::Filter.eq(ldap.uid, login),
|
|
|
|
size: 1,
|
|
|
|
password: password
|
|
|
|
)
|
|
|
|
|
|
|
|
User.find_by_extern_uid_and_provider(ldap_user.dn, 'ldap') if ldap_user
|
2013-04-27 20:20:26 +00:00
|
|
|
end
|
|
|
|
|
2012-10-21 09:12:14 +00:00
|
|
|
def validate_get_request
|
2013-04-19 08:43:54 +00:00
|
|
|
validate_request(@request.params['service'])
|
2012-10-21 09:12:14 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def validate_post_request
|
2013-04-19 08:43:54 +00:00
|
|
|
validate_request(File.basename(@request.path))
|
|
|
|
end
|
|
|
|
|
|
|
|
def validate_request(service)
|
|
|
|
if service == 'git-upload-pack'
|
2013-01-14 14:46:55 +00:00
|
|
|
project.public || can?(user, :download_code, project)
|
2013-04-19 08:43:54 +00:00
|
|
|
elsif service == 'git-receive-pack'
|
2012-10-21 09:12:14 +00:00
|
|
|
action = if project.protected_branch?(current_ref)
|
|
|
|
:push_code_to_protected_branches
|
|
|
|
else
|
|
|
|
:push_code
|
|
|
|
end
|
|
|
|
|
|
|
|
can?(user, action, project)
|
|
|
|
else
|
|
|
|
false
|
|
|
|
end
|
|
|
|
end
|
2012-06-29 10:11:37 +00:00
|
|
|
|
2012-10-22 15:45:42 +00:00
|
|
|
def can?(object, action, subject)
|
|
|
|
abilities.allowed?(object, action, subject)
|
|
|
|
end
|
|
|
|
|
2012-06-29 10:11:37 +00:00
|
|
|
def current_ref
|
|
|
|
if @env["HTTP_CONTENT_ENCODING"] =~ /gzip/
|
2012-08-25 07:24:21 +00:00
|
|
|
input = Zlib::GzipReader.new(@request.body).read
|
2012-06-29 10:11:37 +00:00
|
|
|
else
|
2012-08-25 07:24:21 +00:00
|
|
|
input = @request.body.read
|
2012-06-29 10:11:37 +00:00
|
|
|
end
|
2012-08-25 07:24:21 +00:00
|
|
|
# Need to reset seek point
|
|
|
|
@request.body.rewind
|
2013-05-03 03:31:23 +00:00
|
|
|
/refs\/heads\/([\w\.-]+)/n.match(input.force_encoding('ascii-8bit')).to_a.last
|
2012-06-29 10:11:37 +00:00
|
|
|
end
|
2012-10-22 15:45:42 +00:00
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
def project
|
|
|
|
unless instance_variable_defined? :@project
|
|
|
|
# Find project by PATH_INFO from env
|
|
|
|
if m = /^\/([\w\.\/-]+)\.git/.match(@request.path_info).to_a
|
|
|
|
@project = Project.find_with_namespace(m.last)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
return @project
|
|
|
|
end
|
|
|
|
|
|
|
|
PLAIN_TYPE = {"Content-Type" => "text/plain"}
|
|
|
|
|
|
|
|
def render_not_found
|
|
|
|
[404, PLAIN_TYPE, ["Not Found"]]
|
|
|
|
end
|
|
|
|
|
2012-10-22 15:45:42 +00:00
|
|
|
protected
|
|
|
|
|
|
|
|
def abilities
|
|
|
|
@abilities ||= begin
|
|
|
|
abilities = Six.new
|
|
|
|
abilities << Ability
|
|
|
|
abilities
|
|
|
|
end
|
|
|
|
end
|
2013-05-24 17:36:28 +00:00
|
|
|
|
|
|
|
def ldap_conf
|
|
|
|
@ldap_conf ||= Gitlab.config.ldap
|
|
|
|
end
|
2012-06-29 07:43:15 +00:00
|
|
|
end# Auth
|
|
|
|
end# Grack
|