omniauth_callbacks_controller.rb 3.31 KB
Newer Older
vsizov's avatar
vsizov committed
1
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
2

tduehr's avatar
tduehr committed
3
  protect_from_forgery except: [:kerberos, :saml, :cas3]
4

5
  Gitlab.config.omniauth.providers.each do |provider|
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
6 7 8 9
    define_method provider['name'] do
      handle_omniauth
    end
  end
10 11 12 13

  # Extend the standard message generation to accept our custom exception
  def failure_message
    exception = env["omniauth.error"]
14 15 16 17
    error   = exception.error_reason if exception.respond_to?(:error_reason)
    error ||= exception.error        if exception.respond_to?(:error)
    error ||= exception.message      if exception.respond_to?(:message)
    error ||= env["omniauth.error.type"].to_s
18 19
    error.to_s.humanize if error
  end
Florian Unglaub's avatar
Florian Unglaub committed
20

21 22
  # We only find ourselves here
  # if the authentication to LDAP was successful.
vsizov's avatar
vsizov committed
23
  def ldap
24 25 26
    @user = Gitlab::LDAP::User.new(oauth)
    @user.save if @user.changed? # will also save new users
    gl_user = @user.gl_user
27
    gl_user.remember_me = params[:remember_me] if @user.persisted?
28

29
    # Do additional LDAP checks for the user filter and EE features
30
    if @user.allowed?
31
      log_audit_event(gl_user, with: :ldap)
32
      sign_in_and_redirect(gl_user)
33 34 35
    else
      flash[:alert] = "Access denied for your LDAP account."
      redirect_to new_user_session_path
36
    end
vsizov's avatar
vsizov committed
37 38
  end

39 40 41 42 43 44
  def omniauth_error
    @provider = params[:provider]
    @error = params[:error]
    render 'errors/omniauth_error', layout: "errors", status: 422
  end

tduehr's avatar
tduehr committed
45 46 47 48 49 50 51 52
  def cas3
    ticket = params['ticket']
    if ticket
      handle_service_ticket oauth['provider'], ticket
    end
    handle_omniauth
  end

Florian Unglaub's avatar
Florian Unglaub committed
53 54 55 56
  private

  def handle_omniauth
    if current_user
57 58
      # Add new authentication method
      current_user.identities.find_or_create_by(extern_uid: oauth['uid'], provider: oauth['provider'])
59
      log_audit_event(current_user, with: oauth['provider'])
60
      redirect_to profile_account_path, notice: 'Authentication method updated'
Florian Unglaub's avatar
Florian Unglaub committed
61
    else
62
      @user = Gitlab::OAuth::User.new(oauth)
63
      @user.save
Florian Unglaub's avatar
Florian Unglaub committed
64

65 66
      # Only allow properly saved users to login.
      if @user.persisted? && @user.valid?
67
        log_audit_event(@user.gl_user, with: oauth['provider'])
68
        sign_in_and_redirect(@user.gl_user)
69 70 71 72 73 74 75 76 77 78
      else
        error_message =
          if @user.gl_user.errors.any?
            @user.gl_user.errors.map do |attribute, message|
              "#{attribute} #{message}"
            end.join(", ")
          else
            ''
          end

79
        redirect_to omniauth_error_path(oauth['provider'], error: error_message) and return
Florian Unglaub's avatar
Florian Unglaub committed
80 81
      end
    end
82
  rescue Gitlab::OAuth::SignupDisabledError
83 84
    label = Gitlab::OAuth::Provider.label_for(oauth['provider'])
    message = "Signing in using your #{label} account without a pre-existing GitLab account is not allowed."
85 86

    if current_application_settings.signup_enabled?
87
      message << " Create a GitLab account first, and then connect it to your #{label} account."
88 89 90
    end

    flash[:notice] = message
91

92
    redirect_to new_user_session_path
Florian Unglaub's avatar
Florian Unglaub committed
93
  end
Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
94

tduehr's avatar
tduehr committed
95 96 97 98 99 100
  def handle_service_ticket provider, ticket
    Gitlab::OAuth::Session.create provider, ticket
    session[:service_tickets] ||= {}
    session[:service_tickets][provider] = ticket
  end

Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
101 102 103
  def oauth
    @oauth ||= request.env['omniauth.auth']
  end
104 105 106 107 108

  def log_audit_event(user, options = {})
    AuditEventService.new(user, user, options).
      for_authentication.security_event
  end
vsizov's avatar
vsizov committed
109
end