X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/383122c1bc4a08772df618a415420ac3ea527051..b9c5339d113c63ffc3d8a7c6bf1019616bb3f89a:/services/api/app/controllers/user_sessions_controller.rb diff --git a/services/api/app/controllers/user_sessions_controller.rb b/services/api/app/controllers/user_sessions_controller.rb index 1c5842f969..ae34fa7600 100644 --- a/services/api/app/controllers/user_sessions_controller.rb +++ b/services/api/app/controllers/user_sessions_controller.rb @@ -11,69 +11,38 @@ class UserSessionsController < ApplicationController respond_to :html - # omniauth callback method + # create a new session def create - omniauth = request.env['omniauth.auth'] - - identity_url_ok = (omniauth['info']['identity_url'].length > 0) rescue false - unless identity_url_ok - # Whoa. This should never happen. - logger.error "UserSessionsController.create: omniauth object missing/invalid" - logger.error "omniauth: "+omniauth.pretty_inspect - - return redirect_to login_failure_url + if !Rails.configuration.Login.LoginCluster.empty? and Rails.configuration.Login.LoginCluster != Rails.configuration.ClusterID + raise "Local login disabled when LoginCluster is set" end - # Only local users can create sessions, hence uuid_like_pattern - # here. - user = User.unscoped.where('identity_url = ? and uuid like ?', - omniauth['info']['identity_url'], - User.uuid_like_pattern).first - if not user - # Check for permission to log in to an existing User record with - # a different identity_url - Link.where("link_class = ? and name = ? and tail_uuid = ? and head_uuid like ?", - 'permission', - 'can_login', - omniauth['info']['email'], - User.uuid_like_pattern).each do |link| - if prefix = link.properties['identity_url_prefix'] - if prefix == omniauth['info']['identity_url'][0..prefix.size-1] - user = User.find_by_uuid(link.head_uuid) - break if user - end - end + max_expires_at = nil + if params[:provider] == 'controller' + if request.headers['Authorization'] != 'Bearer ' + Rails.configuration.SystemRootToken + return send_error('Invalid authorization header', status: 401) end + # arvados-controller verified the user and is passing auth_info + # in request params. + authinfo = SafeJSON.load(params[:auth_info]) + max_expires_at = authinfo["expires_at"] + else + return send_error "Legacy code path no longer supported", status: 404 end - if not user - # New user registration - user = User.new(:email => omniauth['info']['email'], - :first_name => omniauth['info']['first_name'], - :last_name => omniauth['info']['last_name'], - :identity_url => omniauth['info']['identity_url'], - :is_active => Rails.configuration.Users.NewUsersAreActive, - :owner_uuid => system_user_uuid) - if omniauth['info']['username'] - user.set_initial_username(requested: omniauth['info']['username']) - end - act_as_system_user do - user.save or raise Exception.new(user.errors.messages) + if !authinfo['user_uuid'].blank? + user = User.find_by_uuid(authinfo['user_uuid']) + if !user + Rails.logger.warn "Nonexistent user_uuid in authinfo #{authinfo.inspect}" + return redirect_to login_failure_url end else - user.email = omniauth['info']['email'] - user.first_name = omniauth['info']['first_name'] - user.last_name = omniauth['info']['last_name'] - if user.identity_url.nil? - # First login to a pre-activated account - user.identity_url = omniauth['info']['identity_url'] - end - - while (uuid = user.redirect_to_user_uuid) - user = User.unscoped.where(uuid: uuid).first - if !user - raise Exception.new("identity_url #{omniauth['info']['identity_url']} redirects to nonexistent uuid #{uuid}") - end + begin + user = User.register(authinfo) + rescue => e + Rails.logger.warn "User.register error #{e}" + Rails.logger.warn "authinfo was #{authinfo.inspect}" + return redirect_to login_failure_url end end @@ -96,8 +65,6 @@ class UserSessionsController < ApplicationController user.save or raise Exception.new(user.errors.messages) - omniauth.delete('extra') - # Give the authenticated user a cookie for direct API access session[:user_id] = user.id session[:api_client_uuid] = nil @@ -113,7 +80,7 @@ class UserSessionsController < ApplicationController return send_error 'Invalid remote cluster id', status: 400 end remote = nil if remote == '' - return send_api_token_to(return_to_url, user, remote) + return send_api_token_to(return_to_url, user, remote, max_expires_at) end redirect_to @redirect_to end @@ -123,19 +90,17 @@ class UserSessionsController < ApplicationController flash[:notice] = params[:message] end - # logout - Clear our rack session BUT essentially redirect to the provider - # to clean up the Devise session from there too ! + # logout - this gets intercepted by controller, so this is probably + # mostly dead code at this point. def logout session[:user_id] = nil flash[:notice] = 'You have logged off' return_to = params[:return_to] || root_url - redirect_to "#{Rails.configuration.Services.SSO.ExternalURL}/users/sign_out?redirect_uri=#{CGI.escape return_to}" + redirect_to return_to end - # login - Just bounce to /auth/joshid. The only purpose of this function is - # to save the return_to parameter (if it exists; see the application - # controller). /auth/joshid bypasses the application controller. + # login. Redirect to LoginCluster. def login if params[:remote] !~ /^[0-9a-z]{5}$/ && !params[:remote].nil? return send_error 'Invalid remote cluster id', status: 400 @@ -153,33 +118,25 @@ class UserSessionsController < ApplicationController p << "auth_provider=#{CGI.escape(params[:auth_provider])}" if params[:auth_provider] if !Rails.configuration.Login.LoginCluster.empty? and Rails.configuration.Login.LoginCluster != Rails.configuration.ClusterID - cluster = Rails.configuration.RemoteClusters[Rails.configuration.Login.LoginCluster] - if not cluster + host = ApiClientAuthorization.remote_host(uuid_prefix: Rails.configuration.Login.LoginCluster) + if not host raise "LoginCluster #{Rails.configuration.Login.LoginCluster} missing from RemoteClusters" end scheme = "https" - if cluster['Scheme'] and !cluster['Scheme'].empty? + cluster = Rails.configuration.RemoteClusters[Rails.configuration.Login.LoginCluster] + if cluster and cluster['Scheme'] and !cluster['Scheme'].empty? scheme = cluster['Scheme'] end - if !cluster['Host'] or cluster['Host'].empty? - raise "LoginCluster #{Rails.configuration.Login.LoginCluster} missing 'Host' in RemoteClusters" - end - login_cluster = "#{scheme}://#{cluster['Host']}" + login_cluster = "#{scheme}://#{host}" p << "remote=#{CGI.escape(params[:remote])}" if params[:remote] p << "return_to=#{CGI.escape(params[:return_to])}" if params[:return_to] redirect_to "#{login_cluster}/login?#{p.join('&')}" else - if params[:return_to] - # Encode remote param inside callback's return_to, so that we'll get it on - # create() after login. - remote_param = params[:remote].nil? ? '' : params[:remote] - p << "return_to=#{CGI.escape(remote_param + ',' + params[:return_to])}" - end - redirect_to "/auth/joshid?#{p.join('&')}" + return send_error "Legacy code path no longer supported", status: 404 end end - def send_api_token_to(callback_url, user, remote=nil) + def send_api_token_to(callback_url, user, remote=nil, token_expiration=nil) # Give the API client a token for making API calls on behalf of # the authenticated user @@ -189,11 +146,19 @@ class UserSessionsController < ApplicationController @api_client = ApiClient. find_or_create_by(url_prefix: api_client_url_prefix) end + if Rails.configuration.Login.TokenLifetime > 0 + if token_expiration == nil + token_expiration = db_current_time + Rails.configuration.Login.TokenLifetime + else + token_expiration = [token_expiration, db_current_time + Rails.configuration.Login.TokenLifetime].min + end + end @api_client_auth = ApiClientAuthorization. new(user: user, api_client: @api_client, created_by_ip_address: remote_ip, + expires_at: token_expiration, scopes: ["all"]) @api_client_auth.save!