Class: Decidim::Suomifi::OmniauthCallbacksController

Inherits:
Devise::OmniauthRegistrationsController
  • Object
show all
Defined in:
app/controllers/decidim/suomifi/omniauth_callbacks_controller.rb

Instance Method Summary collapse

Instance Method Details

#failure ⇒ Object 



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
# File 'app/controllers/decidim/suomifi/omniauth_callbacks_controller.rb', line 53

def failure
  strategy = failed_strategy
  saml_response = strategy.response_object if strategy
  return super unless saml_response

  # In case we want more info about the returned status codes, use the
  # code below.
  #
  # Status codes:
  #   Requester = A problem with the request OR the user cancelled the
  #               request at the identity provider.
  #   Responder = The handling of the request failed.
  #   VersionMismatch = Wrong version in the request.
  #
  # Additional state codes:
  #   AuthnFailed = The authentication failed OR the user cancelled
  #                 the process at the identity provider.
  #   RequestDenied = The authenticating endpoint (which the
  #                   identity provider redirects to) rejected the
  #                   authentication.
  # if !saml_response.send(:validate_success_status) && !saml_response.status_code.nil?
  #   codes = saml_response.status_code.split(" | ").map do |full_code|
  #     full_code.split(":").last
  #   end
  # end

  # Some extra validation checks
  validations = [
    # The success status validation fails in case the response status
    # code is something else than "Success". This is most likely because
    # of one the reasons explained above. In general there are few
    # possible explanations for this:
    # 1. The user cancelled the request and returned to the service.
    # 2. The underlying identity service the IdP redirects to rejected
    #    the request for one reason or another. E.g. the user cancelled
    #    the request at the identity service.
    # 3. There is some technical problem with the identity provider
    #    service or the XML request sent to there is malformed.
    :success_status,
    # Checks if the local session should be expired, i.e. if the user
    # took too long time to go through the authorization endpoint.
    :session_expiration,
    # The NotBefore and NotOnOrAfter conditions failed, i.e. whether the
    # request is handled within the allowed timeframe by the IdP.
    :conditions
  ]
  validations.each do |key|
    next if saml_response.send("validate_#{key}")

    flash[:alert] = t(".#{key}")
    return redirect_to after_omniauth_failure_path_for(resource_name)
  end

  super
end

#sign_in_and_redirect(resource_or_scope, *args) ⇒ Object

This is overridden method from the Devise controller helpers This is called when the user is successfully authenticated which means that we also need to add the authorization for the user automatically because a succesful Suomi.fi authentication means the user has been successfully authorized as well.



114
115
116
117
118
119
120
121
 
# File 'app/controllers/decidim/suomifi/omniauth_callbacks_controller.rb', line 114

def (resource_or_scope, *args)
  # Add authorization for the user
  if resource_or_scope.is_a?(::Decidim::User)
    return fail_authorize unless authorize_user(resource_or_scope)
  end

  super
end

#suomifi ⇒ Object

This is called always after the user returns from the authentication flow from the Suomi.fi identity provider.



15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'app/controllers/decidim/suomifi/omniauth_callbacks_controller.rb', line 15

def suomifi
  session["decidim-suomifi.signed_in"] = true

  authenticator.validate!

  if user_signed_in?
    # The user is most likely returning from an authorization request
    # because they are already signed in. In this case, add the
    # authorization and redirect the user back to the authorizations view.

    # Make sure the user has an identity created in order to aid future
    # Suomi.fi sign ins. In case this fails, it will raise a
    # Decidim::Suomifi::Authentication::IdentityBoundToOtherUserError
    # which is handled below.
    authenticator.identify_user!(current_user)

    # Add the authorization for the user
    return fail_authorize unless authorize_user(current_user)

    # Show the success message and redirect back to the authorizations
    flash[:notice] = t(
      "authorizations.create.success",
      scope: "decidim.suomifi.verification"
    )
    return redirect_to(
      stored_location_for(resource || :user) ||
      decidim_verifications.authorizations_path
    )
  end

  # Normal authentication request, proceed with Decidim's internal logic.
  send(:create)
rescue Decidim::Suomifi::Authentication::ValidationError => e
  fail_authorize(e.validation_key)
rescue Decidim::Suomifi::Authentication::IdentityBoundToOtherUserError
  fail_authorize(:identity_bound_to_other_user)
end