devise.rb 11.1 KB
Newer Older
gitlabhq's avatar
gitlabhq committed
1 2 3
# Use this hook to configure devise mailer, warden hooks and so forth. The first
# four configuration values can also be set straight in your models.
Devise.setup do |config|
4
  config.warden do |manager|
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
5
    manager.default_strategies(scope: :user).unshift :two_factor_authenticatable
6
    manager.default_strategies(scope: :user).unshift :two_factor_backupable
7 8
  end

gitlabhq's avatar
gitlabhq committed
9 10
  # ==> Mailer Configuration
  # Configure the class responsible to send e-mails.
11
  config.mailer = "DeviseMailer"
gitlabhq's avatar
gitlabhq committed
12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

  # ==> ORM configuration
  # Load and configure the ORM. Supports :active_record (default) and
  # :mongoid (bson_ext recommended) by default. Other ORMs may be
  # available as additional gems.
  require 'devise/orm/active_record'

  # ==> Configuration for any authentication mechanism
  # Configure which keys are used when authenticating a user. The default is
  # just :email. You can configure it to use [:username, :subdomain], so for
  # authenticating a user, both parameters are required. Remember that those
  # parameters are used only when authenticating and not when retrieving from
  # session. If you need permissions, you should implement that in a before filter.
  # You can also supply a hash where the value is a boolean determining whether
  # or not authentication should be aborted when the value is not present.
27
  config.authentication_keys = [ :login ]
gitlabhq's avatar
gitlabhq committed
28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57

  # Configure parameters from the request object used for authentication. Each entry
  # given should be a request method and it will automatically be passed to the
  # find_for_authentication method and considered in your model lookup. For instance,
  # if you set :request_keys to [:subdomain], :subdomain will be used on authentication.
  # The same considerations mentioned for authentication_keys also apply to request_keys.
  # config.request_keys = []

  # Configure which authentication keys should be case-insensitive.
  # These keys will be downcased upon creating or modifying a user and when used
  # to authenticate or find a user. Default is :email.
  config.case_insensitive_keys = [ :email ]

  # Configure which authentication keys should have whitespace stripped.
  # These keys will have whitespace before and after removed upon creating or
  # modifying a user and when used to authenticate or find a user. Default is :email.
  config.strip_whitespace_keys = [ :email ]

  # Tell if authentication through request.params is enabled. True by default.
  # config.params_authenticatable = true

  # Tell if authentication through HTTP Basic Auth is enabled. False by default.
  # config.http_authenticatable = false

  # If http headers should be returned for AJAX requests. True by default.
  # config.http_authenticatable_on_xhr = true

  # The realm used in Http Basic Authentication. "Application" by default.
  # config.http_authentication_realm = "Application"

58 59
  config.reconfirmable = true

gitlabhq's avatar
gitlabhq committed
60 61 62
  # It will change confirmation, password recovery and other workflows
  # to behave the same regardless if the e-mail provided was right or wrong.
  # Does not affect registerable.
63
  config.paranoid = true
gitlabhq's avatar
gitlabhq committed
64 65 66 67 68 69 70 71 72 73 74 75 76 77

  # ==> Configuration for :database_authenticatable
  # For bcrypt, this is the cost for hashing the password and defaults to 10. If
  # using other encryptors, it sets how many times you want the password re-encrypted.
  #
  # Limiting the stretches to just one in testing will increase the performance of
  # your test suite dramatically. However, it is STRONGLY RECOMMENDED to not use
  # a value less than 10 in other environments.
  config.stretches = Rails.env.test? ? 1 : 10

  # Setup a pepper to generate the encrypted password.
  # config.pepper = "2ef62d549c4ff98a5d3e0ba211e72cff592060247e3bbbb9f499af1222f876f53d39b39b823132affb32858168c79c1d7741d26499901b63c6030a42129924ef"

  # ==> Configuration for :confirmable
78 79
  # The time you want to give a user to confirm their account. During this time
  # they will be able to access your application without confirming. Default is 0.days
80
  # When allow_unconfirmed_access_for is zero, the user won't be able to sign in without confirming.
gitlabhq's avatar
gitlabhq committed
81 82 83
  # You can use this to let your user access some features of your application
  # without confirming the account, but blocking it after a certain period
  # (ie 2 days).
84
  # config.allow_unconfirmed_access_for = 2.days
gitlabhq's avatar
gitlabhq committed
85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

  # Defines which key will be used when confirming an account
  # config.confirmation_keys = [ :email ]

  # ==> Configuration for :rememberable
  # The time the user will be remembered without asking for credentials again.
  # config.remember_for = 2.weeks

  # If true, a valid remember token can be re-used between multiple browsers.
  # config.remember_across_browsers = true

  # If true, extends the user's remember period when remembered via cookie.
  # config.extend_remember_period = false

  # Options to be passed to the created cookie. For instance, you can set
100
  # secure: true in order to force SSL only cookies.
gitlabhq's avatar
gitlabhq committed
101 102 103 104
  # config.cookie_options = {}

  # ==> Configuration for :validatable
  # Range for password length. Default is 6..128.
105
  config.password_length = 8..128
gitlabhq's avatar
gitlabhq committed
106 107 108 109 110 111 112 113 114 115 116 117 118 119 120

  # Email regex used to validate email formats. It simply asserts that
  # an one (and only one) @ exists in the given string. This is mainly
  # to give user feedback and not to assert the e-mail validity.
  # config.email_regexp = /\A[^@]+@[^@]+\z/

  # ==> Configuration for :timeoutable
  # The time you want to timeout the user session without activity. After this
  # time the user will be asked for credentials again. Default is 30 minutes.
  # config.timeout_in = 30.minutes

  # ==> Configuration for :lockable
  # Defines which strategy will be used to lock an account.
  # :failed_attempts = Locks an account after a number of failed attempts to sign in.
  # :none            = No lock strategy. You should handle locking by yourself.
121
  config.lock_strategy = :failed_attempts
gitlabhq's avatar
gitlabhq committed
122 123

  # Defines which key will be used when locking and unlocking an account
124
  config.unlock_keys = [ :email ]
gitlabhq's avatar
gitlabhq committed
125 126 127 128 129 130

  # Defines which strategy will be used to unlock an account.
  # :email = Sends an unlock link to the user email
  # :time  = Re-enables login after a certain amount of time (see :unlock_in below)
  # :both  = Enables both strategies
  # :none  = No unlock strategy. You should handle unlocking by yourself.
131
  config.unlock_strategy = :both
gitlabhq's avatar
gitlabhq committed
132 133 134

  # Number of authentication tries before locking an account if lock_strategy
  # is failed attempts.
135
  config.maximum_attempts = 10
gitlabhq's avatar
gitlabhq committed
136 137

  # Time interval to unlock the account if :time is enabled as unlock_strategy.
138
  config.unlock_in = 10.minutes
gitlabhq's avatar
gitlabhq committed
139 140 141 142 143 144 145 146 147

  # ==> Configuration for :recoverable
  #
  # Defines which key will be used when recovering the password for an account
  # config.reset_password_keys = [ :email ]

  # Time interval you can reset your password with a reset password key.
  # Don't put a too small interval or your users won't have the time to
  # change their passwords.
148 149
  # When someone else invites you to GitLab this time is also used so it should be pretty long.
  config.reset_password_within = 2.days
gitlabhq's avatar
gitlabhq committed
150

151 152 153 154
  # When set to false, does not sign a user in automatically after their password is
  # reset. Defaults to true, so a user is signed in automatically after a reset.
  config.sign_in_after_reset_password = false

gitlabhq's avatar
gitlabhq committed
155 156 157 158 159 160 161 162
  # ==> Configuration for :encryptable
  # Allow you to use another encryption algorithm besides bcrypt (default). You can use
  # :sha1, :sha512 or encryptors from others authentication tools as :clearance_sha1,
  # :authlogic_sha512 (then you should set stretches above to 20 for default behavior)
  # and :restful_authentication_sha1 (then you should set stretches to 10, and copy
  # REST_AUTH_SITE_KEY to pepper)
  # config.encryptor = :sha512

Nihad Abbasov's avatar
Nihad Abbasov committed
163
  # Authentication through token does not store user in session and needs
gitlabhq's avatar
gitlabhq committed
164
  # to be supplied on each request. Useful if you are using the token as API token.
Nihad Abbasov's avatar
Nihad Abbasov committed
165
  config.skip_session_storage << :token_auth
gitlabhq's avatar
gitlabhq committed
166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197

  # ==> Scopes configuration
  # Turn scoped views on. Before rendering "sessions/new", it will first check for
  # "users/sessions/new". It's turned off by default because it's slower if you
  # are using only default views.
  # config.scoped_views = false

  # Configure the default scope given to Warden. By default it's the first
  # devise role declared in your routes (usually :user).
  # config.default_scope = :user

  # Configure sign_out behavior.
  # Sign_out action can be scoped (i.e. /users/sign_out affects only :user scope).
  # The default is true, which means any logout action will sign out all active scopes.
  # config.sign_out_all_scopes = true

  # ==> Navigation configuration
  # Lists the formats that should be treated as navigational. Formats like
  # :html, should redirect to the sign in page when the user does not have
  # access, but formats like :xml or :json, should return 401.
  #
  # If you have any extra navigational formats, like :iphone or :mobile, you
  # should add them to the navigational formats lists.
  #
  # The :"*/*" and "*/*" formats below is required to match Internet
  # Explorer requests.
  # config.navigational_formats = [:"*/*", "*/*", :html]

  # The default HTTP method used to sign out a resource. Default is :delete.
  config.sign_out_via = :delete

  # ==> OmniAuth
198 199 200
  # To configure a new OmniAuth provider copy and edit omniauth.rb.sample
  # selecting the provider you require.
  # Check the wiki for more information on setting up on your models
Valery Sizov's avatar
Valery Sizov committed
201

gitlabhq's avatar
gitlabhq committed
202 203 204 205
  # ==> Warden configuration
  # If you want to use other strategies, that are not supported by Devise, or
  # change the failure app, you can configure them inside the config.warden block.
  #
206 207 208 209 210
  config.warden do |manager|
    manager.failure_app = Gitlab::DeviseFailure
    # manager.intercept_401 = false
    # manager.default_strategies(scope: :user).unshift :some_external_strategy
  end
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
211

212
  if Gitlab::LDAP::Config.enabled?
213
    Gitlab.config.ldap.servers.values.each do |server|
214
      if server['allow_username_or_email_login']
215
        email_stripping_proc = ->(name) {name.gsub(/@.*\z/,'')}
216 217 218 219
      else
        email_stripping_proc = ->(name) {name}
      end

220
      config.omniauth server['provider_name'],
221 222 223 224 225 226 227 228
        host:     server['host'],
        base:     server['base'],
        uid:      server['uid'],
        port:     server['port'],
        method:   server['method'],
        bind_dn:  server['bind_dn'],
        password: server['password'],
        name_proc: email_stripping_proc
229
    end
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
230 231
  end

232
  Gitlab.config.omniauth.providers.each do |provider|
233 234 235 236 237 238
    provider_arguments = []

    %w[app_id app_secret].each do |argument|
      provider_arguments << provider[argument] if provider[argument]
    end

239 240 241
    case provider['args']
    when Array
      # An Array from the configuration will be expanded.
242
      provider_arguments.concat provider['args']
243
    when Hash
tduehr's avatar
tduehr committed
244 245 246 247 248 249 250 251 252 253
      # Add procs for handling SLO
      if provider['name'] == 'cas3'
        provider['args'][:on_single_sign_out]  = lambda do |request|
          ticket = request.params[:session_index]
          raise "Service Ticket not found." unless Gitlab::OAuth::Session.valid?(:cas3, ticket)
          Gitlab::OAuth::Session.destroy(:cas3, ticket)
          true
        end
      end

254
      # A Hash from the configuration will be passed as is.
Valery Sizov's avatar
Valery Sizov committed
255
      provider_arguments << provider['args'].symbolize_keys
256
    end
257 258

    config.omniauth provider['name'].to_sym, *provider_arguments
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
259
  end
260
end