Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/app/controllers/omniauth_callbacks_controller.rb
AgeCommit message (Collapse)Author
2019-09-26Merge branch 'security-sarcila-verify-saml-request-origin-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Check that SAML identity linking validates the origin of the request See merge request gitlab/gitlabhq!3376
2019-09-16Validate that SAML requests are originated from gitlabSebastian Arcila Valenzuela
If the request wasn't initiated by gitlab we shouldn't add the new identity to the user, and instead show that we weren't able to link the identity to the user. This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509
2019-09-11Add checking for email_verified keyMałgorzata Ksionek
Fix rubocop offences and add changelog Add email_verified key for feature specs Add code review remarks Add code review remarks Fix specs
2019-05-06CE changes for SSO web enforcementJames Edwards-Jones
Adds two methods for us to extend in EE: - OmniauthCallbacksController#link_identity - GroupPolicy#lookup_access_level!
2019-04-08Externalize strings in flash messagesMartin Wortschack
- Externalize strings in controllers - Update PO file
2019-03-19Move out link\unlink ability checks to a policyPavel Shutsin
We can extend the policy in EE for additional behavior
2019-02-06Backport build_auth_user for GroupSAML callbackJames Edwards-Jones
2019-02-04Avoid CSRF check on SAML failure endpointJames Edwards-Jones
SAML and OAuth failures should cause a message to be presented, as well as logging that an attempt was made. These were incorrectly prevented by the CSRF check on POST endpoints such as SAML. In addition we were using a NullSession forgery protection, which made testing more difficult and could have allowed account linking to take place if a CSRF was ever needed but not present.
2019-01-10Addressing peer review feedback.Scott Escue
Replacing inline JS with ES 2015 functions included in pages/sessions/new. Also applying suggested server-side syntax improvements to OmniAuthCallbacksController.
2019-01-10Preserve URL fragment across sign-in and sign-up redirectsScott Escue
If window.location contains a URL fragment, append the fragment to all sign-in forms, the sign-up form, and all button based providers.
2018-09-19Enable frozen string in app/controllers/**/*.rbgfyoung
Enables frozen string for the following: * app/controllers/*.rb * app/controllers/admin/**/*.rb * app/controllers/boards/**/*.rb * app/controllers/ci/**/*.rb * app/controllers/concerns/**/*.rb Partially addresses #47424.
2018-06-25Honor saml assurance level to allow 2FA bypassingRoger Rüttimann
2018-06-21[Rails5] Force the `protect_from_forgery` callback run firstblackst0ne
Since Rails 5.0 the `protect_from_forgery` callback doesn't run first by default anymore. [1] Instead it gets inserted into callbacks chain where callbacks get called in order. This commit forces the callback to run first. [1]: https://github.com/rails/rails/commit/39794037817703575c35a75f1961b01b83791191
2018-05-21Backport helpers from GroupSAML failure messagesJames Edwards-Jones
2018-05-04Backport IdentityLinker#failed? from GroupSaml callback flowJames Edwards-Jones
2018-04-30Exclude LDAP from OmniauthCallbackController base methodsJames Edwards-Jones
2018-04-23Replace define_method with alias_method in Omniauth ControllersJames Edwards-Jones
2018-04-23Unify Saml::IdentityLinker and OAuth::IdentityLinkerJames Edwards-Jones
2018-04-23Show error on failed OAuth account linkJames Edwards-Jones
2018-04-23Refactor OmniauthCallbacksController to remove duplicationJames Edwards-Jones
Moves LDAP to its own controller with tests Provides path forward for implementing GroupSaml
2018-03-22Writes specsTiago Botelho
2018-03-22Tracks the number of failed attempts made by a user trying to authenticate ↵Tiago Botelho
with any external authentication method
2018-03-21Merge branch 'fix/auth0-unsafe-login-10-6' into 'security-10-6'James Lopez
[10.6] Fix GitLab Auth0 integration signs in the wrong user See merge request gitlab/gitlabhq!2354
2018-02-28Moved o_auth/saml/ldap modules under gitlab/authHoratiu Eugen Vlad
2018-02-02use Gitlab::UserSettings directly as a singleton instead of ↵Mario de la Ossa
including/extending it
2018-01-17Merge branch 'jej/fix-disabled-oauth-access-10-3' into 'security-10-3'Robert Speicher
[10.3] Prevent login with disabled OAuth providers See merge request gitlab/gitlabhq!2296 (cherry picked from commit 4936650427ffc88e6ee927aedbb2c724d24b094c) a0f9d222 Prevents login with disabled OAuth providers
2018-01-11Adds Rubocop rule for line break around conditionals🙈 jacopo beschi 🙉
2017-11-23Allow password authentication to be disabled entirelyMarkus Koller
2017-11-17Changing OAuth lookup to be case insensitiveFrancisco Javier López
2017-08-24Define ldap methods at runtimeBob Van Landuyt
This avoids loading the `OmniAuthCallbacksController` at boot time so it doesn't mess up the `before_action`-chain
2017-08-15Enable Layout/TrailingWhitespace cop and auto-correct offensesRobert Speicher
2017-08-07[EE Backport] Update log audit event in omniauth_callbacks_controller.rbJames Lopez
2017-07-06Fix build for !11963.Timothy Andrew
- Don't use `request.env['omniauth.params']` if it isn't present. - Remove the `saml` section from the `gitlab.yml` test section. Some tests depend on this section not being initially present, so it can be overridden in the test. This MR doesn't add any tests for SAML, so we didn't really need this in the first place anyway. - Clean up the test -> omniauth section of `gitlab.yml`
2017-07-06Implement "remember me" for OAuth-based login.Timothy Andrew
- Pass a `remember_me` query parameter along with the initial OAuth request, and pick this parameter up during the omniauth callback from request.env['omniauth.params']`. - For 2FA-based login, copy the `remember_me` param from `omniauth.params` to `params`, which the 2FA process will pick up. - For non-2FA-based login, simply call the `remember_me` devise method to set the session cookie.
2017-06-21Enable Style/DotPosition Rubocop :cop:Grzegorz Bizon
2017-05-05Update design of auth error pageAnnabel Dunstone Gray
2017-02-22No more and/orDouwe Maan
2017-02-20Added support for Authentiq Back-Channel LogoutAlexandros Keramidas
2016-07-04Added tests for 2FA check on OAuth requestPatricio Cano
2016-06-29Add 2FA check to the OAuth authentication mechanismPatricio Cano
2016-05-30Enable Style/MethodDefParentheses rubocop copGrzegorz Bizon
Use def with parentheses when there are parameters. See #17478
2016-04-08Add missing proper nil and error handling to SAML login process.Patricio Cano
2016-04-05Avoid saving again if the user attributes haven't changedPatricio Cano
2016-02-19Decouple SAML authentication from the default Omniauth logicPatricio Cano
2016-02-19Revert "Merge branch 'saml-decoupling' into 'master' "Douwe Maan
This reverts commit c04e22fba8d130a58f498ff48127712d7dae17ee, reversing changes made to 0feab326d52222dc0ab5bd0a6b15dab297f44aa9.
2016-02-18Decouple SAML authentication from the default Omniauth logicPatricio Cano
2016-02-03Support Two-factor Authentication for LDAP usersRobert Speicher
Closes #12653
2016-01-28Backport LDAP user assignment changes from EERobert Speicher
See https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/146
2015-12-15add CAS authentication supporttduehr
2015-10-03Fix rubocop warnings in appGuilherme Garnier
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-16 02:02:26 +0300