omniauth_callbacks_controller.rb 2.23 KB
Newer Older
vsizov's avatar
vsizov committed
1
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
2
  Gitlab.config.omniauth.providers.each do |provider|
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
3 4 5 6
    define_method provider['name'] do
      handle_omniauth
    end
  end
7 8 9 10

  # Extend the standard message generation to accept our custom exception
  def failure_message
    exception = env["omniauth.error"]
11 12 13 14
    error   = exception.error_reason if exception.respond_to?(:error_reason)
    error ||= exception.error        if exception.respond_to?(:error)
    error ||= exception.message      if exception.respond_to?(:message)
    error ||= env["omniauth.error.type"].to_s
15 16
    error.to_s.humanize if error
  end
Florian Unglaub's avatar
Florian Unglaub committed
17

18 19
  # We only find ourselves here
  # if the authentication to LDAP was successful.
vsizov's avatar
vsizov committed
20
  def ldap
21 22 23 24
    @user = Gitlab::LDAP::User.new(oauth)
    @user.save if @user.changed? # will also save new users
    gl_user = @user.gl_user
    gl_user.remember_me = true if @user.persisted?
25

26
    # Do additional LDAP checks for the user filter and EE features
27 28
    if @user.allowed?
      sign_in_and_redirect(gl_user)
29 30 31
    else
      flash[:alert] = "Access denied for your LDAP account."
      redirect_to new_user_session_path
32
    end
vsizov's avatar
vsizov committed
33 34
  end

35 36 37 38 39 40
  def omniauth_error
    @provider = params[:provider]
    @error = params[:error]
    render 'errors/omniauth_error', layout: "errors", status: 422
  end

Florian Unglaub's avatar
Florian Unglaub committed
41 42 43 44
  private

  def handle_omniauth
    if current_user
45 46
      # Add new authentication method
      current_user.identities.find_or_create_by(extern_uid: oauth['uid'], provider: oauth['provider'])
Florian Unglaub's avatar
Florian Unglaub committed
47 48
      redirect_to profile_path
    else
49
      @user = Gitlab::OAuth::User.new(oauth)
50
      @user.save
Florian Unglaub's avatar
Florian Unglaub committed
51

52 53
      # Only allow properly saved users to login.
      if @user.persisted? && @user.valid?
54
        sign_in_and_redirect(@user.gl_user)
55 56 57 58 59 60 61 62 63 64
      else
        error_message =
          if @user.gl_user.errors.any?
            @user.gl_user.errors.map do |attribute, message|
              "#{attribute} #{message}"
            end.join(", ")
          else
            ''
          end

65
        redirect_to omniauth_error_path(oauth['provider'], error: error_message) and return
Florian Unglaub's avatar
Florian Unglaub committed
66 67
      end
    end
68 69
  rescue ForbiddenAction => e
    flash[:notice] = e.message
70
    redirect_to new_user_session_path
Florian Unglaub's avatar
Florian Unglaub committed
71
  end
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
72 73 74 75

  def oauth
    @oauth ||= request.env['omniauth.auth']
  end
vsizov's avatar
vsizov committed
76
end