Merge branch 'funglaub-master'

Dmitriy Zaporozhets
2 parents 40eec08c 048d47e6
Showing 23 changed files with 381 additions and 82 deletions Show diff stats
Gemfile
Gemfile.lock
app/assets/stylesheets/gitlab_bootstrap/blocks.scss
app/assets/stylesheets/main.scss
app/controllers/omniauth_callbacks_controller.rb
app/helpers/application_helper.rb
app/models/user.rb
app/views/devise/sessions/new.html.haml
app/views/layouts/profile.html.haml
app/views/profile/password.html.haml
app/views/profile/show.html.haml
config/gitlab.yml.example
config/initializers/1_settings.rb
config/initializers/devise.rb
config/initializers/omniauth.rb.sample
lib/gitlab/auth.rb
spec/lib/auth_spec.rb
vendor/assets/images/authbuttons/github_32.png
vendor/assets/images/authbuttons/github_64.png
vendor/assets/images/authbuttons/google_32.png
@@ -16,6 +16,10 @@ gem &quot;mysql2&quot;
 # Auth
 gem "devise", "~> 2.1.0"
+gem 'omniauth'
+gem 'omniauth-google-oauth2'
+gem 'omniauth-twitter'
+gem 'omniauth-github'
 # GITLAB patched libs
 gem "grit",          :git => "https://github.com/gitlabhq/grit.git",            :ref => "7f35cb98ff17d534a07e3ce6ec3d580f67402837"
@@ -158,6 +158,8 @@ GEM
     factory_girl_rails (4.0.0)
       factory_girl (~> 4.0.0)
       railties (>= 3.0.0)
+    faraday (0.8.4)
+      multipart-post (~> 1.1)
     ffaker (1.14.0)
     ffi (1.0.11)
     foreman (0.47.0)
@@ -194,6 +196,7 @@ GEM
     httparty (0.8.3)
       multi_json (~> 1.0)
       multi_xml
+    httpauth (0.1)
     i18n (0.6.1)
     journey (1.0.4)
     jquery-rails (2.0.2)
@@ -203,6 +206,8 @@ GEM
       jquery-rails
       railties (>= 3.1.0)
     json (1.7.5)
+    jwt (0.1.5)
+      multi_json (>= 1.0)
     kaminari (0.14.0)
       actionpack (>= 3.0.0)
       activesupport (>= 3.0.0)
@@ -225,12 +230,35 @@ GEM
       sprockets (~> 2.0)
     multi_json (1.3.6)
     multi_xml (0.5.1)
+    multipart-post (1.1.5)
     mysql2 (0.3.11)
     net-ldap (0.2.2)
     nokogiri (1.5.3)
+    oauth (0.4.7)
+    oauth2 (0.8.0)
+      faraday (~> 0.8)
+      httpauth (~> 0.1)
+      jwt (~> 0.1.4)
+      multi_json (~> 1.0)
+      rack (~> 1.2)
     omniauth (1.1.0)
       hashie (~> 1.2)
       rack
+    omniauth-github (1.0.3)
+      omniauth (~> 1.0)
+      omniauth-oauth2 (~> 1.1)
+    omniauth-google-oauth2 (0.1.13)
+      omniauth (~> 1.0)
+      omniauth-oauth2
+    omniauth-oauth (1.0.1)
+      oauth
+      omniauth (~> 1.0)
+    omniauth-oauth2 (1.1.0)
+      oauth2 (~> 0.8.0)
+      omniauth (~> 1.0)
+    omniauth-twitter (0.0.13)
+      multi_json (~> 1.3)
+      omniauth-oauth (~> 1.0)
     orm_adapter (0.3.0)
     polyglot (0.3.3)
     posix-spawn (0.3.6)
@@ -420,7 +448,11 @@ DEPENDENCIES
   linguist (~> 1.0.0)!
   modernizr (= 2.5.3)
   mysql2
+  omniauth
+  omniauth-github
+  omniauth-google-oauth2
   omniauth-ldap!
+  omniauth-twitter
   pry
   pygments.rb!
   rack-mini-profiler
@@ -142,4 +142,8 @@
       border:none;
     }
   }
+
+  .ui-box-body {
+    padding:10px;
+  }
 }
@@ -135,7 +135,6 @@ $hover: #fdf5d9;
  */
 @import "common.scss";
-
 /**
  * Styles related to specific part of app
  */
 class OmniauthCallbacksController < Devise::OmniauthCallbacksController
+  Gitlab.config.omniauth_providers.each do |provider|
+    define_method provider['name'] do
+      handle_omniauth
+    end
+  end
   # Extend the standard message generation to accept our custom exception
   def failure_message
@@ -9,7 +14,7 @@ class OmniauthCallbacksController &lt; Devise::OmniauthCallbacksController
     error ||= env["omniauth.error.type"].to_s
     error.to_s.humanize if error
   end
- 
+
   def ldap
     # We only find ourselves here if the authentication to LDAP was successful.
     @user = User.find_for_ldap_auth(request.env["omniauth.auth"], current_user)
@@ -19,4 +24,27 @@ class OmniauthCallbacksController &lt; Devise::OmniauthCallbacksController
     sign_in_and_redirect @user
   end
+  private
+
+  def handle_omniauth
+    oauth = request.env['omniauth.auth']
+    provider, uid = oauth['provider'], oauth['uid']
+
+    if current_user
+      # Change a logged-in user's authentication method:
+      current_user.extern_uid = uid
+      current_user.provider = provider
+      current_user.save
+      redirect_to profile_path
+    else
+      @user = User.find_or_new_for_omniauth(oauth)
+
+      if @user
+        sign_in_and_redirect @user
+      else
+        flash[:notice] = "There's no such user!"
+        redirect_to new_user_session_path
+      end
+    end
+  end
 end
@@ -135,4 +135,10 @@ module ApplicationHelper
       "Never"
     end
   end
+
+  def authbutton(provider, size = 64)
+    file_name = "#{provider.to_s.split('_').first}_#{size}.png"
+    image_tag("authbuttons/#{file_name}",
+              alt: "Sign in with #{provider.to_s.titleize}")
+  end
 end
@@ -86,33 +86,20 @@ class User &lt; ActiveRecord::Base
     where('id NOT IN (SELECT DISTINCT(user_id) FROM users_projects)')
   end
-  def self.find_for_ldap_auth(auth, signed_in_resource=nil)
-    uid = auth.info.uid
-    provider = auth.provider
-    name = auth.info.name.force_encoding("utf-8")
-    email = auth.info.email.downcase unless auth.info.email.nil?
-    raise OmniAuth::Error, "LDAP accounts must provide an uid and email address" if uid.nil? or email.nil?
-
-    if @user = User.find_by_extern_uid_and_provider(uid, provider)
-      @user
-    # workaround for backward compatibility
-    elsif @user = User.find_by_email(email)
-      logger.info "Updating legacy LDAP user #{email} with extern_uid => #{uid}"
-      @user.update_attributes(:extern_uid => uid, :provider => provider)
-      @user
-    else
-      logger.info "Creating user from LDAP login {uid => #{uid}, name => #{name}, email => #{email}}"
-      password = Devise.friendly_token[0, 8].downcase
-      @user = User.create(
-        :extern_uid => uid,
-        :provider => provider,
-        :name => name,
-        :email => email,
-        :password => password,
-        :password_confirmation => password,
-        :projects_limit => Gitlab.config.default_projects_limit
-      )
-    end
+  def self.create_from_omniauth(auth, ldap = false)
+    gitlab_auth.create_from_omniauth(auth, ldap)
+  end
+
+  def self.find_or_new_for_omniauth(auth)
+    gitlab_auth.find_or_new_for_omniauth(auth)
+  end
+
+  def self.find_for_ldap_auth(auth, signed_in_resource = nil)
+    gitlab_auth.find_for_ldap_auth(auth, signed_in_resource)
+  end
+
+  def self.gitlab_auth
+    Gitlab::Auth.new
   end
   def self.search query
@@ -148,4 +135,3 @@ end
 #  bio                    :string(255)
 #  blocked                :boolean(1)      default(FALSE), not null
 #
-
@@ -15,7 +15,8 @@
     .right
       = render :partial => "devise/shared/links"
     - if devise_mapping.omniauthable?
-      - resource_class.omniauth_providers.each do |provider|
-        %hr/
-        = link_to "Sign in with #{provider.to_s.titleize}", omniauth_authorize_path(resource_name, provider), :class => "btn primary"
-        %br/
+      %hr/
+      %ul.unstyled
+        - resource_class.omniauth_providers.each do |provider|
+          %li
+            = link_to authbutton(provider, 32), omniauth_authorize_path(resource_name, provider)
@@ -10,7 +10,7 @@
           = link_to "Profile", profile_path
         %li{class: tab_class(:password)}
-          = link_to "Password", profile_password_path
+          = link_to "Authentication", profile_password_path
         %li{class: tab_class(:ssh_keys)}
           = link_to keys_path do
 %h3.page_title Password
 %hr
+
 = form_for @user, url: profile_password_path, method: :put do |f|
-  .data
-    %p.slead After successful password update you will be redirected to login page where you should login with new password
-    -if @user.errors.any?
-      .alert-message.block-message.error
-        %ul
-          - @user.errors.full_messages.each do |msg|
-            %li= msg
+  .row
+    .span7
+      .data
+        %p.slead After successful password update you will be redirected to login page where you should login with new password
+        -if @user.errors.any?
+          .alert-message.block-message.error
+            %ul
+              - @user.errors.full_messages.each do |msg|
+                %li= msg
+
+        .clearfix
+          = f.label :password
+          .input= f.password_field :password
+        .clearfix
+          = f.label :password_confirmation
+          .input= f.password_field :password_confirmation
-    .clearfix
-      = f.label :password
-      .input= f.password_field :password
-    .clearfix
-      = f.label :password_confirmation
-      .input= f.password_field :password_confirmation
+    - if Gitlab.config.omniauth_enabled?
+      .span5.right
+        .alert.alert-info
+          %strong Tip: Use one of the following sites to login
+          %ul.unstyled
+            - User.omniauth_providers.each do |provider|
+              %li= link_to authbutton(provider), |
+                   omniauth_authorize_path(User, provider) |
   .actions
     = f.submit 'Save', class: "btn save-btn"
@@ -50,21 +50,34 @@
           %strong Tip:
           You can change your avatar at gravatar.com
-      %h4
-        Personal projects:
-        %small.right
-          %span= current_user.my_own_projects.count
-          of
-          %span= current_user.projects_limit
-      .progress
-        .bar{style: "width: #{current_user.projects_limit_percent}%;"}
+      - @user.provider = 'twitter'
+      - if Gitlab.config.omniauth_enabled? && @user.provider?
+        .ui-box
+          .ui-box-body
+            %h4
+              Omniauth Providers:
+            = link_to "Change", profile_password_path, class: "btn small right"
+            You can login through #{@user.provider.titleize}!
+            = authbutton(@user.provider, 32)
-      %h4
-        SSH public keys:
-        %small.right
-          %span= link_to current_user.keys.count, keys_path
+      .ui-box
+        .ui-box-body
+          %h4
+            Personal projects:
+            %small.right
+              %span= current_user.my_own_projects.count
+              of
+              %span= current_user.projects_limit
+          .progress
+            .bar{style: "width: #{current_user.projects_limit_percent}%;"}
-      = link_to "Add Public Key", new_key_path, class: "btn small right"
+      .ui-box
+        .ui-box-body
+          %h4
+            SSH public keys:
+            %strong.right= link_to current_user.keys.count, keys_path
+
+          = link_to "Add Public Key", new_key_path, class: "btn small"
   .form-actions
     = f.submit 'Save', class: "btn save-btn"
@@ -25,8 +25,45 @@ app:
   # backup_keep_time: 604800      # default: 0 (forever) (in seconds)
   # disable_gravatar: true        # default: false - Disable user avatars from Gravatar.com
+
+
+
+#
+# 2. Auth settings
+# ==========================
+ldap: 
+  enabled: false
+  host: '_your_ldap_server'
+  base: '_the_base_where_you_search_for_users'
+  port: 636
+  uid: 'sAMAccountName'
+  method: 'ssl' # plain
+  bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
+  password: '_the_password_of_the_bind_user'
+
+omniauth:
+  # Enable ability for users
+  # to login via twitter, google ..
+  enabled: true
+
+  # IMPORTANT! 
+  # It allows user to login without having user account
+  allow_single_sign_on: false
+  block_auto_created_users: true
+
+  # Auth providers 
+  providers:
+    # - { name: 'google_oauth2', app_id: 'YOUR APP ID',
+    #     app_secret: 'YOUR APP SECRET',
+    #     args: { access_type: 'offline', approval_prompt: '' } }
+    # - { name: 'twitter', app_id: 'YOUR APP ID',
+    #     app_secret: 'YOUR APP SECRET'}
+    # - { name: 'github', app_id: 'YOUR APP ID',
+    #     app_secret: 'YOUR APP SECRET' }
+
+
 #
-# 2. Advanced settings:
+# 3. Advanced settings:
 # ==========================
 # Git Hosting configuration
@@ -6,7 +6,7 @@ class Settings &lt; Settingslogic
       self.web['protocol'] ||= web.https ? "https" : "http"
     end
-    def web_host 
+    def web_host
       self.web['host'] ||= 'localhost'
     end
@@ -14,11 +14,11 @@ class Settings &lt; Settingslogic
       self.email['from'] ||= ("notify@" + web_host)
     end
-    def url 
+    def url
       self['url'] ||= build_url
-    end 
+    end
-    def web_port 
+    def web_port
       if web.https
         web['port'] = 443
       else
@@ -36,7 +36,7 @@ class Settings &lt; Settingslogic
       raw_url << web_host
       if web_custom_port?
-        raw_url << ":#{web_port}" 
+        raw_url << ":#{web_port}"
       end
       raw_url
@@ -120,6 +120,22 @@ class Settings &lt; Settingslogic
       app['backup_keep_time'] || 0
     end
+    def ldap_enabled?
+      ldap['enabled']
+    rescue
+      false
+    end
+
+    def omniauth_enabled?
+      omniauth && omniauth['enabled']
+    rescue
+      false
+    end
+
+    def omniauth_providers
+      omniauth['providers'] || []
+    end
+
     def disable_gravatar?
       app['disable_gravatar'] || false
     end
@@ -204,4 +204,21 @@ Devise.setup do |config|
   #   manager.intercept_401 = false
   #   manager.default_strategies(:scope => :user).unshift :some_external_strategy
   # end
+
+  gl = Gitlab.config
+
+  if gl.ldap_enabled?
+    config.omniauth :ldap,
+      :host     => gl.ldap['host'],
+      :base     => gl.ldap['base'],
+      :uid      => gl.ldap['uid'],
+      :port     => gl.ldap['port'],
+      :method   => gl.ldap['method'],
+      :bind_dn  => gl.ldap['bind_dn'],
+      :password => gl.ldap['password']
+  end
+
+  gl.omniauth_providers.each do |gl_provider|
+    config.omniauth gl_provider['name'].to_sym, gl_provider['app_id'], gl_provider['app_secret']
+  end
 end
@@ -1,15 +0,0 @@
-# Copy this file to 'omniauth.rb' and configure it as necessary.
-# The wiki has further details on configuring each provider.
-
-Devise.setup do |config|
-  # config.omniauth :github, 'APP_ID', 'APP_SECRET', :scope => 'user,public_repo'
-
-  # config.omniauth :ldap, 
-  #     :host => 'YOUR_LDAP_SERVER',
-  #     :base => 'THE_BASE_WHERE_YOU_SEARCH_FOR_USERS',
-  #     :uid => 'sAMAccountName',
-  #     :port => 389,
-  #     :method => :plain,
-  #     :bind_dn => 'THE_FULL_DN_OF_THE_USER_YOU_WILL_BIND_WITH',
-  #     :password => 'THE_PASSWORD_OF_THE_BIND_USER'
-end
@@ -0,0 +1,66 @@
+module Gitlab
+  class Auth
+    def find_for_ldap_auth(auth, signed_in_resource = nil)
+      uid = auth.info.uid
+      provider = auth.provider
+      email = auth.info.email.downcase unless auth.info.email.nil?
+      raise OmniAuth::Error, "LDAP accounts must provide an uid and email address" if uid.nil? or email.nil?
+
+      if @user = User.find_by_extern_uid_and_provider(uid, provider)
+        @user
+      elsif @user = User.find_by_email(email)
+        log.info "Updating legacy LDAP user #{email} with extern_uid => #{uid}"
+        @user.update_attributes(:extern_uid => uid, :provider => provider)
+        @user
+      else
+        create_from_omniauth(auth, true)
+      end
+    end
+
+    def create_from_omniauth auth, ldap = false
+      provider = auth.provider
+      uid = auth.info.uid || auth.uid
+      name = auth.info.name.force_encoding("utf-8")
+      email = auth.info.email.downcase unless auth.info.email.nil?
+
+      ldap_prefix = ldap ? '(LDAP) ' : ''
+      raise OmniAuth::Error, "#{ldap_prefix}#{provider} does not provide an email"\
+        " address" if auth.info.email.blank?
+
+      log.info "#{ldap_prefix}Creating user from #{provider} login"\
+        " {uid => #{uid}, name => #{name}, email => #{email}}"
+      password = Devise.friendly_token[0, 8].downcase
+      @user = User.new(
+        extern_uid: uid,
+        provider: provider,
+        name: name,
+        email: email,
+        password: password,
+        password_confirmation: password,
+        projects_limit: Gitlab.config.default_projects_limit,
+      )
+      if Gitlab.config.omniauth.block_auto_created_users && !ldap
+        @user.blocked = true
+      end
+      @user.save!
+      @user
+    end
+
+    def find_or_new_for_omniauth(auth)
+      provider, uid = auth.provider, auth.uid
+
+      if @user = User.find_by_provider_and_extern_uid(provider, uid)
+        @user
+      else
+        if Gitlab.config.omniauth.allow_single_sign_on
+          @user = create_from_omniauth(auth)
+          @user
+        end
+      end
+    end
+
+    def log
+      Gitlab::AppLogger
+    end
+  end
+end
@@ -0,0 +1,93 @@
+require 'spec_helper'
+
+describe Gitlab::Auth do
+  let(:gl_auth) { Gitlab::Auth.new }
+
+  before do
+    @info = mock(
+      uid: '12djsak321',
+      name: 'John',
+      email: 'john@mail.com'
+    )
+  end
+
+  describe :find_for_ldap_auth do
+    before do
+      @auth = mock(
+        uid: '12djsak321',
+        info: @info,
+        provider: 'ldap'
+      )
+    end
+
+    it "should find by uid & provider" do
+      User.should_receive :find_by_extern_uid_and_provider
+      gl_auth.find_for_ldap_auth(@auth)
+    end
+
+    it "should update credentials by email if missing uid" do
+      user = double('User')
+      User.stub find_by_extern_uid_and_provider: nil
+      User.stub find_by_email: user
+      user.should_receive :update_attributes
+      gl_auth.find_for_ldap_auth(@auth)
+    end
+
+
+    it "should create from auth if user doesnot exist"do
+      User.stub find_by_extern_uid_and_provider: nil
+      User.stub find_by_email: nil
+      gl_auth.should_receive :create_from_omniauth
+      gl_auth.find_for_ldap_auth(@auth)
+    end
+  end
+
+  describe :find_or_new_for_omniauth do
+    before do
+      @auth = mock(
+        info: @info,
+        provider: 'twitter',
+        uid: '12djsak321',
+      )
+    end
+
+    it "should find user"do
+      User.should_receive :find_by_provider_and_extern_uid
+      gl_auth.should_not_receive :create_from_omniauth
+      gl_auth.find_or_new_for_omniauth(@auth)
+    end
+
+    it "should not create user"do
+      User.stub find_by_provider_and_extern_uid: nil
+      gl_auth.should_not_receive :create_from_omniauth
+      gl_auth.find_or_new_for_omniauth(@auth)
+    end
+
+    it "should create user if single_sing_on"do
+      Gitlab.config.omniauth.stub allow_single_sign_on: true
+      User.stub find_by_provider_and_extern_uid: nil
+      gl_auth.should_receive :create_from_omniauth
+      gl_auth.find_or_new_for_omniauth(@auth)
+    end
+  end
+
+  describe :create_from_omniauth do
+    it "should create user from LDAP" do
+      @auth = mock(info: @info, provider: 'ldap')
+      user = gl_auth.create_from_omniauth(@auth, true)
+
+      user.should be_valid
+      user.extern_uid.should == @info.uid
+      user.provider.should == 'ldap'
+    end
+
+    it "should create user from Omniauth" do
+      @auth = mock(info: @info, provider: 'twitter')
+      user = gl_auth.create_from_omniauth(@auth, false)
+
+      user.should be_valid
+      user.extern_uid.should == @info.uid
+      user.provider.should == 'twitter'
+    end
+  end
+end
	@@ -158,6 +158,8 @@ GEM		@@ -158,6 +158,8 @@ GEM
158	factory_girl_rails (4.0.0)	158	factory_girl_rails (4.0.0)
159	factory_girl (~> 4.0.0)	159	factory_girl (~> 4.0.0)
160	railties (>= 3.0.0)	160	railties (>= 3.0.0)
		161	+ faraday (0.8.4)
		162	+ multipart-post (~> 1.1)
161	ffaker (1.14.0)	163	ffaker (1.14.0)
162	ffi (1.0.11)	164	ffi (1.0.11)
163	foreman (0.47.0)	165	foreman (0.47.0)
	@@ -194,6 +196,7 @@ GEM		@@ -194,6 +196,7 @@ GEM
194	httparty (0.8.3)	196	httparty (0.8.3)
195	multi_json (~> 1.0)	197	multi_json (~> 1.0)
196	multi_xml	198	multi_xml
		199	+ httpauth (0.1)
197	i18n (0.6.1)	200	i18n (0.6.1)
198	journey (1.0.4)	201	journey (1.0.4)
199	jquery-rails (2.0.2)	202	jquery-rails (2.0.2)
	@@ -203,6 +206,8 @@ GEM		@@ -203,6 +206,8 @@ GEM
203	jquery-rails	206	jquery-rails
204	railties (>= 3.1.0)	207	railties (>= 3.1.0)
205	json (1.7.5)	208	json (1.7.5)
		209	+ jwt (0.1.5)
		210	+ multi_json (>= 1.0)
206	kaminari (0.14.0)	211	kaminari (0.14.0)
207	actionpack (>= 3.0.0)	212	actionpack (>= 3.0.0)
208	activesupport (>= 3.0.0)	213	activesupport (>= 3.0.0)
	@@ -225,12 +230,35 @@ GEM		@@ -225,12 +230,35 @@ GEM
225	sprockets (~> 2.0)	230	sprockets (~> 2.0)
226	multi_json (1.3.6)	231	multi_json (1.3.6)
227	multi_xml (0.5.1)	232	multi_xml (0.5.1)
		233	+ multipart-post (1.1.5)
228	mysql2 (0.3.11)	234	mysql2 (0.3.11)
229	net-ldap (0.2.2)	235	net-ldap (0.2.2)
230	nokogiri (1.5.3)	236	nokogiri (1.5.3)
		237	+ oauth (0.4.7)
		238	+ oauth2 (0.8.0)
		239	+ faraday (~> 0.8)
		240	+ httpauth (~> 0.1)
		241	+ jwt (~> 0.1.4)
		242	+ multi_json (~> 1.0)
		243	+ rack (~> 1.2)
231	omniauth (1.1.0)	244	omniauth (1.1.0)
232	hashie (~> 1.2)	245	hashie (~> 1.2)
233	rack	246	rack
		247	+ omniauth-github (1.0.3)
		248	+ omniauth (~> 1.0)
		249	+ omniauth-oauth2 (~> 1.1)
		250	+ omniauth-google-oauth2 (0.1.13)
		251	+ omniauth (~> 1.0)
		252	+ omniauth-oauth2
		253	+ omniauth-oauth (1.0.1)
		254	+ oauth
		255	+ omniauth (~> 1.0)
		256	+ omniauth-oauth2 (1.1.0)
		257	+ oauth2 (~> 0.8.0)
		258	+ omniauth (~> 1.0)
		259	+ omniauth-twitter (0.0.13)
		260	+ multi_json (~> 1.3)
		261	+ omniauth-oauth (~> 1.0)
234	orm_adapter (0.3.0)	262	orm_adapter (0.3.0)
235	polyglot (0.3.3)	263	polyglot (0.3.3)
236	posix-spawn (0.3.6)	264	posix-spawn (0.3.6)
	@@ -420,7 +448,11 @@ DEPENDENCIES		@@ -420,7 +448,11 @@ DEPENDENCIES
420	linguist (~> 1.0.0)!	448	linguist (~> 1.0.0)!
421	modernizr (= 2.5.3)	449	modernizr (= 2.5.3)
422	mysql2	450	mysql2
		451	+ omniauth
		452	+ omniauth-github
		453	+ omniauth-google-oauth2
423	omniauth-ldap!	454	omniauth-ldap!
		455	+ omniauth-twitter
424	pry	456	pry
425	pygments.rb!	457	pygments.rb!
426	rack-mini-profiler	458	rack-mini-profiler
	@@ -142,4 +142,8 @@		@@ -142,4 +142,8 @@
142	border:none;	142	border:none;
143	}	143	}
144	}	144	}
		145	+
		146	+ .ui-box-body {
		147	+ padding:10px;
		148	+ }
145	}	149	}
	@@ -135,7 +135,6 @@ $hover: #fdf5d9;		@@ -135,7 +135,6 @@ $hover: #fdf5d9;
135	*/	135	*/
136	@import "common.scss";	136	@import "common.scss";
137		137
138	-
139	/**	138	/**
140	* Styles related to specific part of app	139	* Styles related to specific part of app
141	*/	140	*/
1	class OmniauthCallbacksController < Devise::OmniauthCallbacksController	1	class OmniauthCallbacksController < Devise::OmniauthCallbacksController
		2	+ Gitlab.config.omniauth_providers.each do \|provider\|
		3	+ define_method provider['name'] do
		4	+ handle_omniauth
		5	+ end
		6	+ end
2		7
3	# Extend the standard message generation to accept our custom exception	8	# Extend the standard message generation to accept our custom exception
4	def failure_message	9	def failure_message
	@@ -9,7 +14,7 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController		@@ -9,7 +14,7 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
9	error \|\|= env["omniauth.error.type"].to_s	14	error \|\|= env["omniauth.error.type"].to_s
10	error.to_s.humanize if error	15	error.to_s.humanize if error
11	end	16	end
12	-	17	+
13	def ldap	18	def ldap
14	# We only find ourselves here if the authentication to LDAP was successful.	19	# We only find ourselves here if the authentication to LDAP was successful.
15	@user = User.find_for_ldap_auth(request.env["omniauth.auth"], current_user)	20	@user = User.find_for_ldap_auth(request.env["omniauth.auth"], current_user)
	@@ -19,4 +24,27 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController		@@ -19,4 +24,27 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
19	sign_in_and_redirect @user	24	sign_in_and_redirect @user
20	end	25	end
21		26
		27	+ private
		28	+
		29	+ def handle_omniauth
		30	+ oauth = request.env['omniauth.auth']
		31	+ provider, uid = oauth['provider'], oauth['uid']
		32	+
		33	+ if current_user
		34	+ # Change a logged-in user's authentication method:
		35	+ current_user.extern_uid = uid
		36	+ current_user.provider = provider
		37	+ current_user.save
		38	+ redirect_to profile_path
		39	+ else
		40	+ @user = User.find_or_new_for_omniauth(oauth)
		41	+
		42	+ if @user
		43	+ sign_in_and_redirect @user
		44	+ else
		45	+ flash[:notice] = "There's no such user!"
		46	+ redirect_to new_user_session_path
		47	+ end
		48	+ end
		49	+ end
22	end	50	end
	@@ -135,4 +135,10 @@ module ApplicationHelper		@@ -135,4 +135,10 @@ module ApplicationHelper
135	"Never"	135	"Never"
136	end	136	end
137	end	137	end
		138	+
		139	+ def authbutton(provider, size = 64)
		140	+ file_name = "#{provider.to_s.split('_').first}_#{size}.png"
		141	+ image_tag("authbuttons/#{file_name}",
		142	+ alt: "Sign in with #{provider.to_s.titleize}")
		143	+ end
138	end	144	end
	@@ -86,33 +86,20 @@ class User < ActiveRecord::Base		@@ -86,33 +86,20 @@ class User < ActiveRecord::Base
86	where('id NOT IN (SELECT DISTINCT(user_id) FROM users_projects)')	86	where('id NOT IN (SELECT DISTINCT(user_id) FROM users_projects)')
87	end	87	end
88		88
89	- def self.find_for_ldap_auth(auth, signed_in_resource=nil)
90	- uid = auth.info.uid
91	- provider = auth.provider
92	- name = auth.info.name.force_encoding("utf-8")
93	- email = auth.info.email.downcase unless auth.info.email.nil?
94	- raise OmniAuth::Error, "LDAP accounts must provide an uid and email address" if uid.nil? or email.nil?
95	-
96	- if @user = User.find_by_extern_uid_and_provider(uid, provider)
97	- @user
98	- # workaround for backward compatibility
99	- elsif @user = User.find_by_email(email)
100	- logger.info "Updating legacy LDAP user #{email} with extern_uid => #{uid}"
101	- @user.update_attributes(:extern_uid => uid, :provider => provider)
102	- @user
103	- else
104	- logger.info "Creating user from LDAP login {uid => #{uid}, name => #{name}, email => #{email}}"
105	- password = Devise.friendly_token[0, 8].downcase
106	- @user = User.create(
107	- :extern_uid => uid,
108	- :provider => provider,
109	- :name => name,
110	- :email => email,
111	- :password => password,
112	- :password_confirmation => password,
113	- :projects_limit => Gitlab.config.default_projects_limit
114	- )
115	- end	89	+ def self.create_from_omniauth(auth, ldap = false)
		90	+ gitlab_auth.create_from_omniauth(auth, ldap)
		91	+ end
		92	+
		93	+ def self.find_or_new_for_omniauth(auth)
		94	+ gitlab_auth.find_or_new_for_omniauth(auth)
		95	+ end
		96	+
		97	+ def self.find_for_ldap_auth(auth, signed_in_resource = nil)
		98	+ gitlab_auth.find_for_ldap_auth(auth, signed_in_resource)
		99	+ end
		100	+
		101	+ def self.gitlab_auth
		102	+ Gitlab::Auth.new
116	end	103	end
117		104
118	def self.search query	105	def self.search query
	@@ -148,4 +135,3 @@ end		@@ -148,4 +135,3 @@ end
148	# bio :string(255)	135	# bio :string(255)
149	# blocked :boolean(1) default(FALSE), not null	136	# blocked :boolean(1) default(FALSE), not null
150	#	137	#
151	-
	@@ -10,7 +10,7 @@		@@ -10,7 +10,7 @@
10	= link_to "Profile", profile_path	10	= link_to "Profile", profile_path
11		11
12	%li{class: tab_class(:password)}	12	%li{class: tab_class(:password)}
13	- = link_to "Password", profile_password_path	13	+ = link_to "Authentication", profile_password_path
14		14
15	%li{class: tab_class(:ssh_keys)}	15	%li{class: tab_class(:ssh_keys)}
16	= link_to keys_path do	16	= link_to keys_path do
1	%h3.page_title Password	1	%h3.page_title Password
2	%hr	2	%hr
		3	+
3	= form_for @user, url: profile_password_path, method: :put do \|f\|	4	= form_for @user, url: profile_password_path, method: :put do \|f\|
4	- .data
5	- %p.slead After successful password update you will be redirected to login page where you should login with new password
6	- -if @user.errors.any?
7	- .alert-message.block-message.error
8	- %ul
9	- - @user.errors.full_messages.each do \|msg\|
10	- %li= msg	5	+ .row
		6	+ .span7
		7	+ .data
		8	+ %p.slead After successful password update you will be redirected to login page where you should login with new password
		9	+ -if @user.errors.any?
		10	+ .alert-message.block-message.error
		11	+ %ul
		12	+ - @user.errors.full_messages.each do \|msg\|
		13	+ %li= msg
		14	+
		15	+ .clearfix
		16	+ = f.label :password
		17	+ .input= f.password_field :password
		18	+ .clearfix
		19	+ = f.label :password_confirmation
		20	+ .input= f.password_field :password_confirmation
11		21
12	- .clearfix
13	- = f.label :password
14	- .input= f.password_field :password
15	- .clearfix
16	- = f.label :password_confirmation
17	- .input= f.password_field :password_confirmation	22	+ - if Gitlab.config.omniauth_enabled?
		23	+ .span5.right
		24	+ .alert.alert-info
		25	+ %strong Tip: Use one of the following sites to login
		26	+ %ul.unstyled
		27	+ - User.omniauth_providers.each do \|provider\|
		28	+ %li= link_to authbutton(provider), \|
		29	+ omniauth_authorize_path(User, provider) \|
18	.actions	30	.actions
19	= f.submit 'Save', class: "btn save-btn"	31	= f.submit 'Save', class: "btn save-btn"
	@@ -50,21 +50,34 @@		@@ -50,21 +50,34 @@
50	%strong Tip:	50	%strong Tip:
51	You can change your avatar at gravatar.com	51	You can change your avatar at gravatar.com
52		52
53	- %h4
54	- Personal projects:
55	- %small.right
56	- %span= current_user.my_own_projects.count
57	- of
58	- %span= current_user.projects_limit
59	- .progress
60	- .bar{style: "width: #{current_user.projects_limit_percent}%;"}	53	+ - @user.provider = 'twitter'
		54	+ - if Gitlab.config.omniauth_enabled? && @user.provider?
		55	+ .ui-box
		56	+ .ui-box-body
		57	+ %h4
		58	+ Omniauth Providers:
		59	+ = link_to "Change", profile_password_path, class: "btn small right"
		60	+ You can login through #{@user.provider.titleize}!
		61	+ = authbutton(@user.provider, 32)
61		62
62	- %h4
63	- SSH public keys:
64	- %small.right
65	- %span= link_to current_user.keys.count, keys_path	63	+ .ui-box
		64	+ .ui-box-body
		65	+ %h4
		66	+ Personal projects:
		67	+ %small.right
		68	+ %span= current_user.my_own_projects.count
		69	+ of
		70	+ %span= current_user.projects_limit
		71	+ .progress
		72	+ .bar{style: "width: #{current_user.projects_limit_percent}%;"}
66		73
67	- = link_to "Add Public Key", new_key_path, class: "btn small right"	74	+ .ui-box
		75	+ .ui-box-body
		76	+ %h4
		77	+ SSH public keys:
		78	+ %strong.right= link_to current_user.keys.count, keys_path
		79	+
		80	+ = link_to "Add Public Key", new_key_path, class: "btn small"
68		81
69	.form-actions	82	.form-actions
70	= f.submit 'Save', class: "btn save-btn"	83	= f.submit 'Save', class: "btn save-btn"
	@@ -25,8 +25,45 @@ app:		@@ -25,8 +25,45 @@ app:
25	# backup_keep_time: 604800 # default: 0 (forever) (in seconds)	25	# backup_keep_time: 604800 # default: 0 (forever) (in seconds)
26	# disable_gravatar: true # default: false - Disable user avatars from Gravatar.com	26	# disable_gravatar: true # default: false - Disable user avatars from Gravatar.com
27		27
		28	+
		29	+
		30	+
		31	+#
		32	+# 2. Auth settings
		33	+# ==========================
		34	+ldap:
		35	+ enabled: false
		36	+ host: '_your_ldap_server'
		37	+ base: '_the_base_where_you_search_for_users'
		38	+ port: 636
		39	+ uid: 'sAMAccountName'
		40	+ method: 'ssl' # plain
		41	+ bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
		42	+ password: '_the_password_of_the_bind_user'
		43	+
		44	+omniauth:
		45	+ # Enable ability for users
		46	+ # to login via twitter, google ..
		47	+ enabled: true
		48	+
		49	+ # IMPORTANT!
		50	+ # It allows user to login without having user account
		51	+ allow_single_sign_on: false
		52	+ block_auto_created_users: true
		53	+
		54	+ # Auth providers
		55	+ providers:
		56	+ # - { name: 'google_oauth2', app_id: 'YOUR APP ID',
		57	+ # app_secret: 'YOUR APP SECRET',
		58	+ # args: { access_type: 'offline', approval_prompt: '' } }
		59	+ # - { name: 'twitter', app_id: 'YOUR APP ID',
		60	+ # app_secret: 'YOUR APP SECRET'}
		61	+ # - { name: 'github', app_id: 'YOUR APP ID',
		62	+ # app_secret: 'YOUR APP SECRET' }
		63	+
		64	+
28	#	65	#
29	-# 2. Advanced settings:	66	+# 3. Advanced settings:
30	# ==========================	67	# ==========================
31		68
32	# Git Hosting configuration	69	# Git Hosting configuration