154 lines
4.0 KiB
Ruby
154 lines
4.0 KiB
Ruby
require_dependency 'single_sign_on'
|
|
|
|
class DiscourseSingleSignOn < SingleSignOn
|
|
|
|
def self.sso_url
|
|
SiteSetting.sso_url
|
|
end
|
|
|
|
def self.sso_secret
|
|
SiteSetting.sso_secret
|
|
end
|
|
|
|
def self.generate_sso(return_path="/")
|
|
sso = new
|
|
sso.nonce = SecureRandom.hex
|
|
sso.register_nonce(return_path)
|
|
sso.return_sso_url = Discourse.base_url + "/session/sso_login"
|
|
sso
|
|
end
|
|
|
|
def self.generate_url(return_path="/")
|
|
generate_sso(return_path).to_url
|
|
end
|
|
|
|
def register_nonce(return_path)
|
|
if nonce
|
|
$redis.setex(nonce_key, NONCE_EXPIRY_TIME, return_path)
|
|
end
|
|
end
|
|
|
|
def nonce_valid?
|
|
nonce && $redis.get(nonce_key).present?
|
|
end
|
|
|
|
def return_path
|
|
$redis.get(nonce_key) || "/"
|
|
end
|
|
|
|
def expire_nonce!
|
|
if nonce
|
|
$redis.del nonce_key
|
|
end
|
|
end
|
|
|
|
def nonce_key
|
|
"SSO_NONCE_#{nonce}"
|
|
end
|
|
|
|
def lookup_or_create_user(ip_address=nil)
|
|
sso_record = SingleSignOnRecord.find_by(external_id: external_id)
|
|
|
|
if sso_record && user = sso_record.user
|
|
sso_record.last_payload = unsigned_payload
|
|
else
|
|
user = match_email_or_create_user(ip_address)
|
|
sso_record = user.single_sign_on_record
|
|
end
|
|
|
|
# ensure it's not staged anymore
|
|
user.staged = false
|
|
|
|
# if the user isn't new or it's attached to the SSO record we might be overriding username or email
|
|
unless user.new_record?
|
|
change_external_attributes_and_override(sso_record, user)
|
|
end
|
|
|
|
if sso_record && (user = sso_record.user) && !user.active && !require_activation
|
|
user.active = true
|
|
user.save!
|
|
user.enqueue_welcome_message('welcome_user') unless suppress_welcome_message
|
|
end
|
|
|
|
custom_fields.each do |k,v|
|
|
user.custom_fields[k] = v
|
|
end
|
|
|
|
user.ip_address = ip_address
|
|
|
|
user.admin = admin unless admin.nil?
|
|
user.moderator = moderator unless moderator.nil?
|
|
|
|
# optionally save the user and sso_record if they have changed
|
|
user.save!
|
|
|
|
unless admin.nil? && moderator.nil?
|
|
Group.refresh_automatic_groups!(:admins, :moderators, :staff)
|
|
end
|
|
|
|
sso_record.save!
|
|
|
|
sso_record && sso_record.user
|
|
end
|
|
|
|
private
|
|
|
|
def match_email_or_create_user(ip_address)
|
|
unless user = User.find_by_email(email)
|
|
try_name = name.presence
|
|
try_username = username.presence
|
|
|
|
user_params = {
|
|
email: email,
|
|
name: try_name || User.suggest_name(try_username || email),
|
|
username: UserNameSuggester.suggest(try_username || try_name || email),
|
|
ip_address: ip_address
|
|
}
|
|
|
|
user = User.create!(user_params)
|
|
end
|
|
|
|
if user
|
|
if sso_record = user.single_sign_on_record
|
|
sso_record.last_payload = unsigned_payload
|
|
sso_record.external_id = external_id
|
|
else
|
|
user.create_single_sign_on_record(last_payload: unsigned_payload,
|
|
external_id: external_id,
|
|
external_username: username,
|
|
external_email: email,
|
|
external_name: name)
|
|
end
|
|
end
|
|
|
|
user
|
|
end
|
|
|
|
def change_external_attributes_and_override(sso_record, user)
|
|
if SiteSetting.sso_overrides_email && user.email != email
|
|
user.email = email
|
|
end
|
|
|
|
if SiteSetting.sso_overrides_username && user.username != username && username.present?
|
|
user.username = UserNameSuggester.suggest(username || name || email, user.username)
|
|
end
|
|
|
|
if SiteSetting.sso_overrides_name && user.name != name && name.present?
|
|
user.name = name || User.suggest_name(username.blank? ? email : username)
|
|
end
|
|
|
|
if SiteSetting.sso_overrides_avatar && avatar_url.present? && (
|
|
avatar_force_update ||
|
|
sso_record.external_avatar_url != avatar_url)
|
|
|
|
UserAvatar.import_url_for_user(avatar_url, user)
|
|
end
|
|
|
|
# change external attributes for sso record
|
|
sso_record.external_username = username
|
|
sso_record.external_email = email
|
|
sso_record.external_name = name
|
|
sso_record.external_avatar_url = avatar_url
|
|
end
|
|
end
|