Same note as for broker_key_auth
# File lib/openshift/controller/authentication.rb, line 125 def auth_service @auth_service ||= OpenShift::AuthService.instance end
Filter a request to require an authenticated user
FIXME Handle exceptions more consistently, gracefully recover from misbehaving
services
# File lib/openshift/controller/authentication.rb, line 34 def authenticate_user! return @cloud_user if @cloud_user # # Each authentication type may return nil if no auth info is present, # false if the user failed authentication (may optionally render a response), # or a Hash with the following keys: # # :user # If present, use this user as the current request. The current_identity # field on the user will be used as the current identity, and will not # be persisted. # # :username # :provider (CURRENTLY IGNORED) # A user unique identifier, and a scoping provider. The default provider # is nil. :username must be unique within the provider scope. # info = authentication_types.find{ |i| not i.nil? } return if response_body unless info && (info[:username].present? || info[:user].present?) request_http_basic_authentication return end scopes = info[:scopes] || Scope::SESSION user = info[:user] ? info[:user] : impersonate(CloudUser.find_or_create_by_identity(info[:provider], info[:username])) raise "Service did not set the user login attribute" unless user.login.present? user.auth_method = info[:auth_method] || :login @current_user_scopes = scopes @cloud_user = user log_actions_as(user) headers['X-OpenShift-Identity'] = user.login headers['X-OAuth-Scopes'] = scopes log_action("AUTHENTICATE", true, "Authenticated", 'IP' => request.remote_ip, 'SCOPES' => scopes) return unless check_controller_scopes user rescue OpenShift::AccessDeniedException => e render_error(:unauthorized, e.message, 1, "AUTHENTICATE") rescue => e render_exception(e) end
Attempt to locate a user by their credentials. No impersonation is allowed.
This method is intended to be used from specific endpoints that must challenge authentication with credentials only. It is not used at this time.
# File lib/openshift/controller/authentication.rb, line 95 def authenticate_user_from_credentials(username, password) info = if auth_service.respond_to?(:authenticate) && auth_service.method(:authenticate).arity == 2 auth_service.authenticate(username, password).tap do |info| log_action("CREDENTIAL_AUTHENTICATE", true, "Access denied by auth service", {'IP' => request.remote_ip, 'LOGIN' => username}) unless info end end || nil if info raise "Authentication service must return a username with its response" if info[:username].nil? user = CloudUser.find_or_create_by_identity(info[:provider], info[:username]) log_action("CREDENTIAL_AUTHENTICATE", true, "Authenticated via credentials", {'LOGIN' => username, 'IP' => request.remote_ip}) user end rescue OpenShift::AccessDeniedException => e logger.debug "Service rejected credentials #{e.message} (#{e.class})\n #{e.backtrace.join("\n ")}" log_action("CREDENTIAL_AUTHENTICATE", true, "Access denied by auth service", {'LOGIN' => username, 'IP' => request.remote_ip, 'ERROR' => e.message}) nil end
This should be abstracted to an OpenShift.config service implementation that allows the product to easily reuse these without having to be exposed as helpers.
# File lib/openshift/controller/authentication.rb, line 121 def broker_key_auth @broker_key_auth ||= OpenShift::Auth::BrokerKey.new end
# File lib/openshift/controller/authentication.rb, line 129 def check_controller_scopes if current_user_scopes.empty? render_error(:forbidden, "You are not authorized to perform any operations.", 1, "AUTHORIZE") false elsif !current_user_scopes.any?{ |s| s.allows_action?(self) } render_error(:forbidden, "This action is not allowed with your current authorization.", 1, "AUTHORIZE") false else true end end
Return the currently authenticated user or nil
# File lib/openshift/controller/authentication.rb, line 15 def current_user @cloud_user end
Generated with the Darkfish Rdoc Generator 2.