lib/gitlab/auth/saml/identity_linker.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

# frozen_string_literal: true

module Gitlab
  module Auth
    module Saml
      class IdentityLinker < OmniauthIdentityLinkerBase
        extend ::Gitlab::Utils::Override

        UnverifiedRequest = Class.new(StandardError)

        override :link
        def link
          raise_unless_request_is_gitlab_initiated! if unlinked?

          super
        end

        protected

        def raise_unless_request_is_gitlab_initiated!
          raise UnverifiedRequest unless valid_gitlab_initiated_request?
        end

        def valid_gitlab_initiated_request?
          OriginValidator.new(session).gitlab_initiated?(saml_response)
        end

        def saml_response
          oauth.fetch(:extra, {}).fetch(:response_object, {})
        end
      end
    end
  end
end

Gitlab::Auth::Saml::IdentityLinker.prepend_mod