13647: Update keepstore install docs, eliminate keep_services step.

[arvados.git] / services / api / app / controllers / user_sessions_controller.rb

diff --git a/services/api/app/controllers/user_sessions_controller.rb b/services/api/app/controllers/user_sessions_controller.rb
index 7f7b47fd997b24cbb0fe16b0868336d3a61de3ff..ef0f8868666dfb3bb786dab263270c8911df45e6 100644 (file)
--- a/services/api/app/controllers/user_sessions_controller.rb
+++ b/services/api/app/controllers/user_sessions_controller.rb
@@ -3,17 +3,17 @@
 # SPDX-License-Identifier: AGPL-3.0
 
 class UserSessionsController < ApplicationController
-  before_filter :require_auth_scope, :only => [ :destroy ]
+  before_action :require_auth_scope, :only => [ :destroy ]
 
-  skip_before_filter :set_cors_headers
-  skip_before_filter :find_object_by_uuid
-  skip_before_filter :render_404_if_no_object
+  skip_before_action :set_cors_headers
+  skip_before_action :find_object_by_uuid
+  skip_before_action :render_404_if_no_object
 
   respond_to :html
 
   # omniauth callback method
   def create
-    omniauth = env['omniauth.auth']
+    omniauth = request.env['omniauth.auth']
 
     identity_url_ok = (omniauth['info']['identity_url'].length > 0) rescue false
     unless identity_url_ok
@@ -52,7 +52,7 @@ class UserSessionsController < ApplicationController
                       :first_name => omniauth['info']['first_name'],
                       :last_name => omniauth['info']['last_name'],
                       :identity_url => omniauth['info']['identity_url'],
-                      :is_active => Rails.configuration.new_users_are_active,
+                      :is_active => Rails.configuration.Users.NewUsersAreActive,
                       :owner_uuid => system_user_uuid)
       if omniauth['info']['username']
         user.set_initial_username(requested: omniauth['info']['username'])
@@ -80,6 +80,16 @@ class UserSessionsController < ApplicationController
     # For the benefit of functional and integration tests:
     @user = user
 
+    if user.uuid[0..4] != Rails.configuration.ClusterID
+      # Actually a remote user
+      # Send them to their home cluster's login
+      rh = Rails.configuration.RemoteClusters[user.uuid[0..4]]
+      remote, return_to_url = params[:return_to].split(',', 2)
+      @remotehomeurl = "#{rh.Scheme || "https"}://#{rh.Host}/login?remote=#{Rails.configuration.ClusterID}&return_to=#{return_to_url}"
+      render
+      return
+    end
+
     # prevent ArvadosModel#before_create and _update from throwing
     # "unauthorized":
     Thread.current[:user] = user
@@ -99,6 +109,9 @@ class UserSessionsController < ApplicationController
       # encoding the remote=zbbbb parameter passed by a client asking for a salted
       # token.
       remote, return_to_url = params[:return_to].split(',', 2)
+      if remote !~ /^[0-9a-z]{5}$/ && remote != ""
+        return send_error 'Invalid remote cluster id', status: 400
+      end
       remote = nil if remote == ''
       return send_api_token_to(return_to_url, user, remote)
     end
@@ -117,13 +130,16 @@ class UserSessionsController < ApplicationController
 
     flash[:notice] = 'You have logged off'
     return_to = params[:return_to] || root_url
-    redirect_to "#{Rails.configuration.sso_provider_url}/users/sign_out?redirect_uri=#{CGI.escape return_to}"
+    redirect_to "#{Rails.configuration.Services.SSO.ExternalURL}/users/sign_out?redirect_uri=#{CGI.escape return_to}"
   end
 
   # login - Just bounce to /auth/joshid. The only purpose of this function is
   # to save the return_to parameter (if it exists; see the application
   # controller). /auth/joshid bypasses the application controller.
   def login
+    if params[:remote] !~ /^[0-9a-z]{5}$/ && !params[:remote].nil?
+      return send_error 'Invalid remote cluster id', status: 400
+    end
     if current_user and params[:return_to]
       # Already logged in; just need to send a token to the requesting
       # API client.
@@ -139,7 +155,7 @@ class UserSessionsController < ApplicationController
       # Encode remote param inside callback's return_to, so that we'll get it on
       # create() after login.
       remote_param = params[:remote].nil? ? '' : params[:remote]
-      p << "return_to=#{CGI.escape(remote_param)},#{CGI.escape(params[:return_to])}"
+      p << "return_to=#{CGI.escape(remote_param + ',' + params[:return_to])}"
     end
     redirect_to "/auth/joshid?#{p.join('&')}"
   end