2013-09-03 21:04:27 +00:00
|
|
|
# OAuth extension for User model
|
|
|
|
#
|
|
|
|
# * Find GitLab user based on omniauth uid and provider
|
|
|
|
# * Create new user from omniauth data
|
|
|
|
#
|
|
|
|
module Gitlab
|
|
|
|
module OAuth
|
2015-05-12 10:50:06 +00:00
|
|
|
class SignupDisabledError < StandardError; end
|
2014-11-27 11:34:39 +00:00
|
|
|
|
2013-09-03 21:04:27 +00:00
|
|
|
class User
|
2014-10-10 10:03:32 +00:00
|
|
|
attr_accessor :auth_hash, :gl_user
|
2013-09-03 21:04:27 +00:00
|
|
|
|
2014-10-10 10:03:32 +00:00
|
|
|
def initialize(auth_hash)
|
|
|
|
self.auth_hash = auth_hash
|
|
|
|
end
|
2013-09-03 21:04:27 +00:00
|
|
|
|
2014-10-10 10:03:32 +00:00
|
|
|
def persisted?
|
2014-10-16 18:08:30 +00:00
|
|
|
gl_user.try(:persisted?)
|
2014-10-10 10:03:32 +00:00
|
|
|
end
|
2013-09-03 21:04:27 +00:00
|
|
|
|
2014-10-10 10:03:32 +00:00
|
|
|
def new?
|
2014-10-17 11:08:02 +00:00
|
|
|
!persisted?
|
2014-10-10 10:03:32 +00:00
|
|
|
end
|
2013-09-03 21:04:27 +00:00
|
|
|
|
2014-10-10 10:03:32 +00:00
|
|
|
def valid?
|
2014-10-16 18:08:30 +00:00
|
|
|
gl_user.try(:valid?)
|
2014-09-03 13:59:50 +00:00
|
|
|
end
|
2013-09-03 21:04:27 +00:00
|
|
|
|
2016-02-18 22:01:07 +00:00
|
|
|
def save(provider = 'OAuth')
|
2014-10-16 18:08:30 +00:00
|
|
|
unauthorized_to_create unless gl_user
|
|
|
|
|
2014-10-17 11:08:02 +00:00
|
|
|
if needs_blocking?
|
2014-11-27 11:34:39 +00:00
|
|
|
gl_user.save!
|
2014-10-17 11:08:02 +00:00
|
|
|
gl_user.block
|
2014-11-27 11:34:39 +00:00
|
|
|
else
|
|
|
|
gl_user.save!
|
2014-10-17 11:08:02 +00:00
|
|
|
end
|
2013-09-03 21:04:27 +00:00
|
|
|
|
2016-02-18 22:01:07 +00:00
|
|
|
log.info "(#{provider}) saving user #{auth_hash.email} from login with extern_uid => #{auth_hash.uid}"
|
2014-10-10 10:03:32 +00:00
|
|
|
gl_user
|
|
|
|
rescue ActiveRecord::RecordInvalid => e
|
2016-02-18 22:01:07 +00:00
|
|
|
log.info "(#{provider}) Error saving user: #{gl_user.errors.full_messages}"
|
2014-10-10 10:03:32 +00:00
|
|
|
return self, e.record.errors
|
|
|
|
end
|
|
|
|
|
|
|
|
def gl_user
|
2014-10-16 18:08:30 +00:00
|
|
|
@user ||= find_by_uid_and_provider
|
|
|
|
|
2015-06-02 10:01:29 +00:00
|
|
|
if auto_link_ldap_user?
|
|
|
|
@user ||= find_or_create_ldap_user
|
|
|
|
end
|
|
|
|
|
2014-10-17 11:08:02 +00:00
|
|
|
if signup_enabled?
|
2014-10-16 18:08:30 +00:00
|
|
|
@user ||= build_new_user
|
|
|
|
end
|
2014-10-17 11:08:02 +00:00
|
|
|
|
2016-04-11 22:26:01 +00:00
|
|
|
if external_provider? && @user
|
|
|
|
@user.external = true
|
|
|
|
elsif @user
|
|
|
|
@user.external = false
|
2016-04-11 15:16:15 +00:00
|
|
|
end
|
|
|
|
|
2014-10-16 18:08:30 +00:00
|
|
|
@user
|
2014-09-03 13:59:50 +00:00
|
|
|
end
|
2013-09-03 21:04:27 +00:00
|
|
|
|
2014-10-10 10:03:32 +00:00
|
|
|
protected
|
2014-10-17 11:08:02 +00:00
|
|
|
|
2015-06-02 10:01:29 +00:00
|
|
|
def find_or_create_ldap_user
|
|
|
|
return unless ldap_person
|
2015-06-05 10:32:01 +00:00
|
|
|
|
|
|
|
# If a corresponding person exists with same uid in a LDAP server,
|
2016-06-07 16:19:19 +00:00
|
|
|
# check if the user already has a GitLab account.
|
|
|
|
if (user = Gitlab::LDAP::User.find_by_uid_and_provider(ldap_person.dn, ldap_person.provider))
|
|
|
|
# Case when a LDAP user already exists in Gitlab. Add the OAuth identity to existing account.
|
|
|
|
log.info "LDAP account found for user #{user.username}. Building new identity."
|
2015-06-02 10:01:29 +00:00
|
|
|
user.identities.build(extern_uid: auth_hash.uid, provider: auth_hash.provider)
|
|
|
|
else
|
2016-06-07 16:19:19 +00:00
|
|
|
log.info 'No existing LDAP account was found in GitLab. Checking for OAuth account.'
|
|
|
|
user = find_by_uid_and_provider
|
|
|
|
if user.nil?
|
|
|
|
log.info 'No user found with the specified OAuth provider. Creating a new one.'
|
|
|
|
user = build_new_user
|
|
|
|
end
|
|
|
|
log.info "Correct account has been found. Adding LDAP identity to user: #{user.username}."
|
2015-06-02 10:01:29 +00:00
|
|
|
user.identities.new(provider: ldap_person.provider, extern_uid: ldap_person.dn)
|
|
|
|
end
|
2015-06-05 10:32:01 +00:00
|
|
|
|
2015-06-02 10:01:29 +00:00
|
|
|
user
|
|
|
|
end
|
|
|
|
|
|
|
|
def auto_link_ldap_user?
|
|
|
|
Gitlab.config.omniauth.auto_link_ldap_user
|
|
|
|
end
|
|
|
|
|
|
|
|
def creating_linked_ldap_user?
|
|
|
|
auto_link_ldap_user? && ldap_person
|
|
|
|
end
|
|
|
|
|
|
|
|
def ldap_person
|
|
|
|
return @ldap_person if defined?(@ldap_person)
|
|
|
|
|
2015-06-17 16:06:27 +00:00
|
|
|
# Look for a corresponding person with same uid in any of the configured LDAP providers
|
|
|
|
Gitlab::LDAP::Config.providers.each do |provider|
|
2015-06-02 10:01:29 +00:00
|
|
|
adapter = Gitlab::LDAP::Adapter.new(provider)
|
2016-06-07 16:19:19 +00:00
|
|
|
@ldap_person = Gitlab::LDAP::Person.find_by_uid(auth_hash.uid, adapter)
|
2015-06-17 16:06:27 +00:00
|
|
|
break if @ldap_person
|
2015-06-02 10:01:29 +00:00
|
|
|
end
|
2015-06-17 16:06:27 +00:00
|
|
|
@ldap_person
|
2015-06-02 10:01:29 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def ldap_config
|
2015-06-05 10:32:01 +00:00
|
|
|
Gitlab::LDAP::Config.new(ldap_person.provider) if ldap_person
|
2015-06-02 10:01:29 +00:00
|
|
|
end
|
|
|
|
|
2014-10-17 11:08:02 +00:00
|
|
|
def needs_blocking?
|
2015-06-05 10:32:01 +00:00
|
|
|
new? && block_after_signup?
|
2014-10-17 11:08:02 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def signup_enabled?
|
2016-02-18 22:01:07 +00:00
|
|
|
providers = Gitlab.config.omniauth.allow_single_sign_on
|
2016-02-18 22:02:43 +00:00
|
|
|
if providers.is_a?(Array)
|
|
|
|
providers.include?(auth_hash.provider)
|
|
|
|
else
|
|
|
|
providers
|
|
|
|
end
|
2014-10-17 11:08:02 +00:00
|
|
|
end
|
|
|
|
|
2016-04-11 15:16:15 +00:00
|
|
|
def external_provider?
|
|
|
|
Gitlab.config.omniauth.external_providers.include?(auth_hash.provider)
|
|
|
|
end
|
|
|
|
|
2014-10-17 11:08:02 +00:00
|
|
|
def block_after_signup?
|
2015-06-05 10:32:01 +00:00
|
|
|
if creating_linked_ldap_user?
|
|
|
|
ldap_config.block_auto_created_users
|
2016-01-19 15:25:38 +00:00
|
|
|
else
|
2015-06-05 10:32:01 +00:00
|
|
|
Gitlab.config.omniauth.block_auto_created_users
|
|
|
|
end
|
2014-10-17 11:08:02 +00:00
|
|
|
end
|
|
|
|
|
2014-09-04 10:55:10 +00:00
|
|
|
def auth_hash=(auth_hash)
|
|
|
|
@auth_hash = AuthHash.new(auth_hash)
|
|
|
|
end
|
|
|
|
|
2014-10-10 10:03:32 +00:00
|
|
|
def find_by_uid_and_provider
|
2014-11-25 16:15:30 +00:00
|
|
|
identity = Identity.find_by(provider: auth_hash.provider, extern_uid: auth_hash.uid)
|
|
|
|
identity && identity.user
|
2014-10-10 10:03:32 +00:00
|
|
|
end
|
2014-09-03 15:33:03 +00:00
|
|
|
|
2014-10-10 10:03:32 +00:00
|
|
|
def build_new_user
|
2014-11-27 11:34:39 +00:00
|
|
|
user = ::User.new(user_attributes)
|
2014-11-25 16:15:30 +00:00
|
|
|
user.skip_confirmation!
|
|
|
|
user.identities.new(extern_uid: auth_hash.uid, provider: auth_hash.provider)
|
2014-11-27 11:34:39 +00:00
|
|
|
user
|
2014-09-03 15:33:03 +00:00
|
|
|
end
|
|
|
|
|
2014-09-03 13:59:50 +00:00
|
|
|
def user_attributes
|
2015-06-02 10:01:29 +00:00
|
|
|
# Give preference to LDAP for sensitive information when creating a linked account
|
2015-06-05 10:32:01 +00:00
|
|
|
if creating_linked_ldap_user?
|
2016-01-19 15:25:38 +00:00
|
|
|
username = ldap_person.username.presence
|
|
|
|
email = ldap_person.email.first.presence
|
2015-06-02 10:01:29 +00:00
|
|
|
end
|
2016-01-07 18:14:41 +00:00
|
|
|
|
2016-01-19 15:25:38 +00:00
|
|
|
username ||= auth_hash.username
|
|
|
|
email ||= auth_hash.email
|
|
|
|
|
2016-01-07 18:14:41 +00:00
|
|
|
name = auth_hash.name
|
|
|
|
name = ::Namespace.clean_path(username) if name.strip.empty?
|
2016-01-19 15:25:38 +00:00
|
|
|
|
2015-06-05 10:32:01 +00:00
|
|
|
{
|
2016-01-07 18:14:41 +00:00
|
|
|
name: name,
|
2015-06-02 10:01:29 +00:00
|
|
|
username: ::Namespace.clean_path(username),
|
|
|
|
email: email,
|
2015-02-13 12:33:28 +00:00
|
|
|
password: auth_hash.password,
|
|
|
|
password_confirmation: auth_hash.password,
|
|
|
|
password_automatically_set: true
|
2014-09-03 13:59:50 +00:00
|
|
|
}
|
|
|
|
end
|
2013-09-03 21:04:27 +00:00
|
|
|
|
2014-09-03 13:59:50 +00:00
|
|
|
def log
|
|
|
|
Gitlab::AppLogger
|
|
|
|
end
|
|
|
|
|
2014-11-27 11:34:39 +00:00
|
|
|
def unauthorized_to_create
|
2015-05-12 10:50:06 +00:00
|
|
|
raise SignupDisabledError
|
2014-10-16 18:08:30 +00:00
|
|
|
end
|
2013-09-03 21:04:27 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|