omniauth_callbacks_controller.rb 4.64 KB
Newer Older
vsizov's avatar
vsizov committed
1
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
2
  include AuthenticatesWithTwoFactor
3
  include Devise::Controllers::Rememberable
4

tduehr's avatar
tduehr committed
5
  protect_from_forgery except: [:kerberos, :saml, :cas3]
6

7
  Gitlab.config.omniauth.providers.each do |provider|
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
8 9 10 11
    define_method provider['name'] do
      handle_omniauth
    end
  end
12 13 14 15

  # Extend the standard message generation to accept our custom exception
  def failure_message
    exception = env["omniauth.error"]
16 17 18 19
    error   = exception.error_reason if exception.respond_to?(:error_reason)
    error ||= exception.error        if exception.respond_to?(:error)
    error ||= exception.message      if exception.respond_to?(:message)
    error ||= env["omniauth.error.type"].to_s
20 21
    error.to_s.humanize if error
  end
Florian Unglaub's avatar
Florian Unglaub committed
22

23 24
  # We only find ourselves here
  # if the authentication to LDAP was successful.
vsizov's avatar
vsizov committed
25
  def ldap
26 27 28 29 30
    ldap_user = Gitlab::LDAP::User.new(oauth)
    ldap_user.save if ldap_user.changed? # will also save new users

    @user = ldap_user.gl_user
    @user.remember_me = params[:remember_me] if ldap_user.persisted?
31

32
    # Do additional LDAP checks for the user filter and EE features
33
    if ldap_user.allowed?
34 35 36 37 38 39
      if @user.two_factor_enabled?
        prompt_for_two_factor(@user)
      else
        log_audit_event(@user, with: :ldap)
        sign_in_and_redirect(@user)
      end
40 41 42
    else
      flash[:alert] = "Access denied for your LDAP account."
      redirect_to new_user_session_path
43
    end
vsizov's avatar
vsizov committed
44 45
  end

46 47 48 49 50 51 52 53 54 55 56 57 58
  def saml
    if current_user
      log_audit_event(current_user, with: :saml)
      # Update SAML identity if data has changed.
      identity = current_user.identities.find_by(extern_uid: oauth['uid'], provider: :saml)
      if identity.nil?
        current_user.identities.create(extern_uid: oauth['uid'], provider: :saml)
        redirect_to profile_account_path, notice: 'Authentication method updated'
      else
        redirect_to after_sign_in_path_for(current_user)
      end
    else
      saml_user = Gitlab::Saml::User.new(oauth)
59
      saml_user.save if saml_user.changed?
60 61 62 63
      @user = saml_user.gl_user

      continue_login_process
    end
64 65
  rescue Gitlab::OAuth::SignupDisabledError
    handle_signup_error
66 67
  end

68 69 70
  def omniauth_error
    @provider = params[:provider]
    @error = params[:error]
71
    render 'errors/omniauth_error', layout: "oauth_error", status: 422
72 73
  end

tduehr's avatar
tduehr committed
74 75 76 77 78 79 80 81
  def cas3
    ticket = params['ticket']
    if ticket
      handle_service_ticket oauth['provider'], ticket
    end
    handle_omniauth
  end

82 83 84 85 86 87 88
  def authentiq
    if params['sid']
      handle_service_ticket oauth['provider'], params['sid']
    end
    handle_omniauth
  end

Florian Unglaub's avatar
Florian Unglaub committed
89 90 91 92
  private

  def handle_omniauth
    if current_user
93 94
      # Add new authentication method
      current_user.identities.find_or_create_by(extern_uid: oauth['uid'], provider: oauth['provider'])
95
      log_audit_event(current_user, with: oauth['provider'])
96
      redirect_to profile_account_path, notice: 'Authentication method updated'
Florian Unglaub's avatar
Florian Unglaub committed
97
    else
98 99 100
      oauth_user = Gitlab::OAuth::User.new(oauth)
      oauth_user.save
      @user = oauth_user.gl_user
Florian Unglaub's avatar
Florian Unglaub committed
101

102
      continue_login_process
Florian Unglaub's avatar
Florian Unglaub committed
103
    end
104
  rescue Gitlab::OAuth::SignupDisabledError
105
    handle_signup_error
Florian Unglaub's avatar
Florian Unglaub committed
106
  end
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
107

108
  def handle_service_ticket(provider, ticket)
tduehr's avatar
tduehr committed
109 110 111 112 113
    Gitlab::OAuth::Session.create provider, ticket
    session[:service_tickets] ||= {}
    session[:service_tickets][provider] = ticket
  end

114 115 116 117
  def continue_login_process
    # Only allow properly saved users to login.
    if @user.persisted? && @user.valid?
      log_audit_event(@user, with: oauth['provider'])
118
      if @user.two_factor_enabled?
119
        params[:remember_me] = '1' if remember_me?
120 121
        prompt_for_two_factor(@user)
      else
122
        remember_me(@user) if remember_me?
123 124
        sign_in_and_redirect(@user)
      end
125 126 127
    else
      error_message = @user.errors.full_messages.to_sentence

Douwe Maan's avatar
Douwe Maan committed
128
      return redirect_to omniauth_error_path(oauth['provider'], error: error_message)
129 130 131
    end
  end

132 133 134 135 136 137 138 139 140 141 142 143 144
  def handle_signup_error
    label = Gitlab::OAuth::Provider.label_for(oauth['provider'])
    message = "Signing in using your #{label} account without a pre-existing GitLab account is not allowed."

    if current_application_settings.signup_enabled?
      message << " Create a GitLab account first, and then connect it to your #{label} account."
    end

    flash[:notice] = message

    redirect_to new_user_session_path
  end

Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
145 146 147
  def oauth
    @oauth ||= request.env['omniauth.auth']
  end
148 149

  def log_audit_event(user, options = {})
150 151
    AuditEventService.new(user, user, options)
      .for_authentication.security_event
152
  end
153 154 155

  def remember_me?
    request_params = request.env['omniauth.params']
Timothy Andrew's avatar
Timothy Andrew committed
156
    (request_params['remember_me'] == '1') if request_params.present?
157
  end
vsizov's avatar
vsizov committed
158
end