Class/Module Index [+]

Quicksearch

OpenShift::Controller::Authentication

Protected Instance Methods

auth_service() click to toggle source

Same note as for broker_key_auth

# File lib/openshift/controller/authentication.rb, line 124
def auth_service
  @auth_service ||= OpenShift::AuthService.instance
end
authenticate_user!() click to toggle source

Filter a request to require an authenticated user

FIXME Handle exceptions more consistently, gracefully recover from misbehaving

services
# File lib/openshift/controller/authentication.rb, line 34
def authenticate_user!
  return @cloud_user if @cloud_user

  #
  # Each authentication type may return nil if no auth info is present,
  # false if the user failed authentication (may optionally render a response),
  # or a Hash with the following keys:
  #
  #   :user
  #     If present, use this user as the current request.  The current_identity
  #     field on the user will be used as the current identity, and will not
  #     be persisted.
  #
  #   :username
  #   :provider (CURRENTLY IGNORED)
  #     A user unique identifier, and a scoping provider.  The default provider
  #     is nil. :username must be unique within the provider scope.
  #
  info = authentication_types.find{ |i| not i.nil? }

  return if response_body
  unless info && (info[:username].present? || info[:user].present?)
    request_http_basic_authentication
    return
  end

  scopes = info[:scopes] || Scope::SESSION
  user = info[:user] ?
    info[:user] :
    impersonate(CloudUser.find_or_create_by_identity(info[:provider], info[:username]))

  raise "Service did not set the user login attribute" unless user.login.present?

  user.auth_method = info[:auth_method] || :login
  user.scopes = @current_user_scopes = scopes
  @cloud_user = user
  log_actions_as(user)

  headers['X-OpenShift-Identity'] = user.login
  headers['X-OpenShift-Identity-Id'] = user._id.to_s
  headers['X-OAuth-Scopes'] = scopes

  log_action("AUTHENTICATE", nil, true, "Authenticated", 'IP' => request.remote_ip, 'SCOPES' => scopes)

  return unless check_controller_scopes

  user

rescue OpenShift::AccessDeniedException => e
  render_error(:unauthorized, e.message, 1)
end
authenticate_user_from_credentials(username, password) click to toggle source

Attempt to locate a user by their credentials. No impersonation is allowed.

This method is intended to be used from specific endpoints that must challenge authentication with credentials only. It is not used at this time.

# File lib/openshift/controller/authentication.rb, line 94
def authenticate_user_from_credentials(username, password)
  info =
    if auth_service.respond_to?(:authenticate) && auth_service.method(:authenticate).arity == 2
      auth_service.authenticate(username, password).tap do |info|
        log_action("CREDENTIAL_AUTHENTICATE", nil, true, "Access denied by auth service", {'IP' => request.remote_ip, 'LOGIN' => username}) unless info
      end
    end || nil

  if info
    raise "Authentication service must return a username with its response" if info[:username].nil?

    user = CloudUser.find_or_create_by_identity(info[:provider], info[:username])
    log_action("CREDENTIAL_AUTHENTICATE", nil, true, "Authenticated via credentials", {'LOGIN' => username, 'IP' => request.remote_ip})
    user
  end
rescue OpenShift::AccessDeniedException => e
  logger.debug "Service rejected credentials #{e.message} (#{e.class})\n  #{e.backtrace.join("\n  ")}"
  log_action("CREDENTIAL_AUTHENTICATE", nil, true, "Access denied by auth service", {'LOGIN' => username, 'IP' => request.remote_ip, 'ERROR' => e.message})
  nil
end
broker_key_auth() click to toggle source

This should be abstracted to an OpenShift.config service implementation that allows the product to easily reuse these without having to be exposed as helpers.

# File lib/openshift/controller/authentication.rb, line 120
def broker_key_auth
  @broker_key_auth ||= OpenShift::Auth::BrokerKey.new
end
check_controller_scopes() click to toggle source
# File lib/openshift/controller/authentication.rb, line 128
def check_controller_scopes
  if current_user_scopes.empty?
    render_error(:forbidden, "You are not authorized to perform any operations.", 1)
    false
  elsif !current_user_scopes.any?{ |s| s.allows_action?(self) }
    render_error(:forbidden, "This action is not allowed with your current authorization.", 1)
    false
  else
    true
  end
end
current_user() click to toggle source

Return the currently authenticated user or nil

# File lib/openshift/controller/authentication.rb, line 15
def current_user
  @cloud_user
end
current_user_scopes() click to toggle source
# File lib/openshift/controller/authentication.rb, line 25
def current_user_scopes
  @current_user_scopes || Scope::NONE
end
user_signed_in?() click to toggle source

True if the user is currently authenticated

# File lib/openshift/controller/authentication.rb, line 21
def user_signed_in?
  current_user.present?
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.