summaryrefslogtreecommitdiffstats
path: root/models/login_source.go
Commit message (Collapse)AuthorAgeFilesLines
* Move login related structs and functions to models/login (#17093)Lunny Xiao2021-09-241-386/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Move login related structs and functions to models/login * Fix test * Fix lint * Fix lint * Fix lint of windows * Fix lint * Fix test * Fix test * Only load necessary fixtures when preparing unit tests envs * Fix lint * Fix test * Fix test * Fix error log * Fix error log * Fix error log * remove unnecessary change * fix error log * merge main branch
* DBContext is just a Context (#17100)zeripath2021-09-231-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | * DBContext is just a Context This PR removes some of the specialness from the DBContext and makes it context This allows us to simplify the GetEngine code to wrap around any context in future and means that we can change our loadRepo(e Engine) functions to simply take contexts. Signed-off-by: Andrew Thornton <art27@cantab.net> * fix unit tests Signed-off-by: Andrew Thornton <art27@cantab.net> * another place that needs to set the initial context Signed-off-by: Andrew Thornton <art27@cantab.net> * avoid race Signed-off-by: Andrew Thornton <art27@cantab.net> * change attachment error Signed-off-by: Andrew Thornton <art27@cantab.net>
* Move db related basic functions to models/db (#17075)Lunny Xiao2021-09-191-15/+20
| | | | | | | | | | | | | | | | | | | | | | | | | * Move db related basic functions to models/db * Fix lint * Fix lint * Fix test * Fix lint * Fix lint * revert unnecessary change * Fix test * Fix wrong replace string * Use *Context * Correct committer spelling and fix wrong replaced words Co-authored-by: zeripath <art27@cantab.net>
* Fix add authentication page (#16543)zeripath2021-07-251-0/+13
| | | | | | | | | | | | | | | * Fix add authentication page There is a regression in #16199 whereby the add authentication page fails to react to the change in selected type. This is due to the String() method on the LoginSourceType which is ameliorated with an Int() function being added. Following on from this there are a few other related bugs. Fix #16541 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Refactor: Move login out of models (#16199)zeripath2021-07-241-640/+115
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `models` does far too much. In particular it handles all `UserSignin`. It shouldn't be responsible for calling LDAP, SMTP or PAM for signing in. Therefore we should move this code out of `models`. This code has to depend on `models` - therefore it belongs in `services`. There is a package in `services` called `auth` and clearly this functionality belongs in there. Plan: - [x] Change `auth.Auth` to `auth.Method` - as they represent methods of authentication. - [x] Move `models.UserSignIn` into `auth` - [x] Move `models.ExternalUserLogin` - [x] Move most of the `LoginVia*` methods to `auth` or subpackages - [x] Move Resynchronize functionality to `auth` - Involved some restructuring of `models/ssh_key.go` to reduce the size of this massive file and simplify its files. - [x] Move the rest of the LDAP functionality in to the ldap subpackage - [x] Re-factor the login sources to express an interfaces `auth.Source`? - I've done this through some smaller interfaces Authenticator and Synchronizable - which would allow us to extend things in future - [x] Now LDAP is out of models - need to think about modules/auth/ldap and I think all of that functionality might just be moveable - [x] Similarly a lot Oauth2 functionality need not be in models too and should be moved to services/auth/source/oauth2 - [x] modules/auth/oauth2/oauth2.go uses xorm... This is naughty - probably need to move this into models. - [x] models/oauth2.go - mostly should be in modules/auth/oauth2 or services/auth/source/oauth2 - [x] More simplifications of login_source.go may need to be done - Allow wiring in of notify registration - *this can now easily be done - but I think we should do it in another PR* - see #16178 - More refactors...? - OpenID should probably become an auth Method but I think that can be left for another PR - Methods should also probably be cleaned up - again another PR I think. - SSPI still needs more refactors.* Rename auth.Auth auth.Method * Restructure ssh_key.go - move functions from models/user.go that relate to ssh_key to ssh_key - split ssh_key.go to try create clearer function domains for allow for future refactors here. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add basic edit ldap auth test & actually fix #16252 (#16465)zeripath2021-07-201-8/+28
| | | | | | | | | | | | | | | | | | | | One of the reasons why #16447 was needed and why #16268 was needed in the first place was because it appears that editing ldap configuration doesn't get tested. This PR therefore adds a basic test that will run the edit pipeline. In doing so it's now clear that #16447 and #16268 aren't actually solving #16252. It turns out that what actually happens is that is that the bytes are actually double encoded. This PR now changes the json unmarshal wrapper to handle this double encode. Fix #16252 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* Fix crash following ldap authentication update (#16447)zeripath2021-07-151-2/+2
| | | | | | | | | | | Unfortunately #16268 contained a terrible error, whereby there was a double indirection taken when unmarshalling the source data. This fatally breaks authentication configuration reading. Fix #16342 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix various documentation, user-facing, and source comment typos (#16367)luzpaz2021-07-081-1/+1
| | | | | * Fix various doc, user-facing, and source comment typos Found via `codespell -q 3 -S ./options/locale,./vendor -L ba,pullrequest,pullrequests,readby`
* Handle misencoding of login_source cfg in mssql (#16268)zeripath2021-06-271-10/+16
| | | | | | | | | | | | | | | | * Handle misencoding of login_source cfg in mssql Unfortunately due a bug in xorm (see https://gitea.com/xorm/xorm/pulls/1957) updating loginsources on MSSQL causes them to become corrupted. (#16252) Whilst waiting for the referenced PR to be merged and to handle the corrupted loginsources correctly we need to add a wrapper to the `FromDB()` methods to look for and ignore the misplaced BOMs that have been added. Fix #16252 Signed-off-by: Andrew Thornton <art27@cantab.net> * Update models/login_source.go
* Don't WARN log UserNotExist errors on ExternalUserLogin failure (#16238)zeripath2021-06-231-1/+5
| | | | | | | Instead log these at debug - with warn logging for other errors. Fix #16235 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Encrypt LDAP bind password in db with SECRET_KEY (#15547)zeripath2021-05-201-1/+16
| | | | | | | | | | | | | | | * Encrypt LDAP bind password in db with SECRET_KEY The LDAP source bind password are currently stored in plaintext in the db This PR simply encrypts them with the setting.SECRET_KEY. Fix #15460 Signed-off-by: Andrew Thornton <art27@cantab.net> * remove ui warning regarding unencrypted password Co-authored-by: silverwind <me@silverwind.io>
* Restore PAM user autocreation functionality (#15825)zeripath2021-05-131-1/+14
| | | | | | | | | | | | | | | | | * Restore PAM user autocreation functionality PAM autoregistration of users currently fails due to email invalidity. This PR adds a new setting to PAM to allow an email domain to be set or just sets the email to the noreply address and if that fails falls back to uuid@localhost Fix #15702 Signed-off-by: Andrew Thornton <art27@cantab.net> * As per KN4CKER Signed-off-by: Andrew Thornton <art27@cantab.net>
* chore(models): rewrite code format. (#14754)Bo-Yi Wu2021-03-141-1/+1
| | | | | | | | | | | | | | | * chore: rewrite format. * chore: update format Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> * chore: update format Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com> * chore: Adjacent parameters with the same type should be grouped together * chore: update format.
* Migrate to use jsoniter instead of encoding/json (#14841)zeripath2021-03-011-1/+11
| | | | | | | | | | * Migrate to use jsoniter * fix tests * update gitea.com/go-chi/binding Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* [Refactor] Passwort Hash/Set (#14282)65432021-01-101-2/+4
| | | | | | | | | * move SaltGeneration into HashPasswort and rename it to what it does * Migration: Where Password is Valid with Empty String delete it * prohibit empty password hash * let SetPassword("") unset pwd stuff
* Custom icons for OAuth sources (#14161)Timo Ley2020-12-281-0/+1
| | | | | | | | | | | | | * Add Icon URL to Backend * Template for Icon URL * Localization & Edit Icon URL * Improve Custom Icon URL * Removed not working else Co-authored-by: 6543 <6543@obermui.de>
* migrate from com.* to alternatives (#14103)65432020-12-251-4/+7
| | | | | | | | | | | | | | | * remove github.com/unknwon/com from models * dont use "com.ToStr()" * replace "com.ToStr" with "fmt.Sprint" where its easy to do * more refactor * fix test * just "proxy" Copy func for now * as per @lunny
* Use ID or Where to instead directly use Get when load object from database ↵Lunny Xiao2020-06-171-1/+1
| | | | | | | | | | | | (#11925) * Use ID or Where to instead directly use Get when load object from database * Apply suggestions from code review Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: zeripath <art27@cantab.net>
* Upgrade xorm to v1.0.0 (#10646)Lunny Xiao2020-03-221-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Upgrade xorm to v1.0.0 * small nit * Fix tests * Update xorm * Update xorm * fix go.sum * fix test * Fix bug when dump * Fix bug * update xorm to latest * Fix migration test * update xorm to latest * Fix import order * Use xorm tag
* Add restricted user filter to LDAP authentication (#10600)Lauris BH2020-03-051-16/+27
| | | | | | * Add restricted user filter to LDAP authentification * Fix unit test cases
* Various fixes in login sources (#10428)guillep2k2020-02-231-14/+13
|
* Do not try to recreate ldap user if they are already created (#9900)zeripath2020-01-211-12/+12
| | | | | | | | * Do not try to recreate ldap user if they are already created * just remove autoregister Co-authored-by: techknowlogick <matti@mdranta.net>
* Check user != nil before checking values (#9881)zeripath2020-01-191-7/+15
| | | | | | * Check user != nil before checking values * Handle autoAdmin
* Add single sign-on support via SSPI on Windows (#8463)QuaSoft2019-11-231-2/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add single sign-on support via SSPI on Windows * Ensure plugins implement interface * Ensure plugins implement interface * Move functions used only by the SSPI auth method to sspi_windows.go * Field SSPISeparatorReplacement of AuthenticationForm should not be required via binding, as binding will insist the field is non-empty even if another login type is selected * Fix breaking of oauth authentication on download links. Do not create new session with SSPI authentication on download links. * Update documentation for the new 'SPNEGO with SSPI' login source * Mention in documentation that ROOT_URL should contain the FQDN of the server * Make sure that Contexter is not checking for active login sources when the ORM engine is not initialized (eg. when installing) * Always initialize and free SSO methods, even if they are not enabled, as a method can be activated while the app is running (from Authentication sources) * Add option in SSPIConfig for removing of domains from logon names * Update helper text for StripDomainNames option * Make sure handleSignIn() is called after a new user object is created by SSPI auth method * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Only make a query to the DB to check if SSPI is enabled on handlers that need that information for templates * Remove code duplication * Log errors in ActiveLoginSources Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert suffix of randomly generated E-mails for Reverse proxy authentication Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert unneeded white-space change in template Co-Authored-By: Lauris BH <lauris@nix.lv> * Add copyright comments at the top of new files * Use loopback name for randomly generated emails * Add locale tag for the SSPISeparatorReplacement field with proper casing * Revert casing of SSPISeparatorReplacement field in locale file, moving it up, next to other form fields * Update docs/content/doc/features/authentication.en-us.md Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com> * Remove Priority() method and define the order in which SSO auth methods should be executed in one place * Log authenticated username only if it's not empty * Rephrase helper text for automatic creation of users * Return error if more than one active SSPI auth source is found * Change newUser() function to return error, letting caller log/handle the error * Move isPublicResource, isPublicPage and handleSignIn functions outside SSPI auth method to allow other SSO methods to reuse them if needed * Refactor initialization of the list containing SSO auth methods * Validate SSPI settings on POST * Change SSPI to only perform authentication on its own login page, API paths and download links. Leave Toggle middleware to redirect non authenticated users to login page * Make 'Default language' in SSPI config empty, unless changed by admin * Show error if admin tries to add a second authentication source of type SSPI * Simplify declaration of global variable * Rebuild gitgraph.js on Linux * Make sure config values containing only whitespace are not accepted
* Drop Admin attribute based on LDAP when login (continue #1743) (#8849)65432019-11-141-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Update User information in Gitea based on LDAP when login * Update Admin Flag only if exist in settings * Fix affectation * Update models/login_source.go Co-Authored-By: JustKiddingCode <JustKiddingCode@users.noreply.github.com> * Better ident * Apply suggestions from code review Update user information Co-Authored-By: 6543 <24977596+6543@users.noreply.github.com> * Make fmt * add err handling * if user exist but login is Prohibit return return nil, and Prohibit err * keep login speed * User sync is implemented at #1478 - so only make sure that admin acces is drpoed if changed * handle error and still use async task * no async * only update admin if Sync is enabled * update two comments * add lafriks suggestions Co-Authored-By: Lauris BH <lauris@nix.lv> * if adminFilter is set - use it Co-Authored-By: Lauris BH <lauris@nix.lv> * Update models/login_source.go well - I should look more detaild at suggestions :D Co-Authored-By: Lauris BH <lauris@nix.lv> * make it work again * set is_admin value to user * look nicer
* Upgrade xorm to v0.8.0 (#8536)Lunny Xiao2019-10-171-1/+1
|
* Use gitea forked macaron (#7933)Tamal Saha2019-08-231-1/+1
| | | Signed-off-by: Tamal Saha <tamal@appscode.com>
* Display ui time with customize time location (#7792)Lunny Xiao2019-08-151-7/+7
| | | | | | | | | | | | | | | | | | * display ui time with customize time location * fix lint * rename UILocation to DefaultUILocation * move time related functions to modules/timeutil * fix tests * fix tests * fix build * fix swagger
* Add additional password hash algorithms (closes #5859) (#6023)EpicCoder2019-07-071-0/+10
|
* Fix error log when loading issues caused by a xorm bug (#7271)Lunny Xiao2019-06-231-1/+1
| | | | | | | | | | | | * fix error log when loading issues caused by a xorm bug * upgrade packages * fix fmt * fix Consistency * fix tests
* Add golangci (#6418)kolaente2019-06-121-9/+12
|
* Remove macaron dependent on models (#6940)Lunny Xiao2019-05-141-2/+6
|
* fix bug when user login and want to resend register confirmation email (#6482)Lunny Xiao2019-04-021-6/+6
|
* Fix prohibit login check on authorization (#6106)Lunny Xiao2019-02-191-4/+23
| | | | | | | | | | | | * fix bug prohibit login not applied on dashboard * fix tests * fix bug user status leak * fix typo * return after render
* Only allow local login if password is non-empty (#5906)zeripath2019-01-301-1/+1
|
* Synchronize SSH keys on login with LDAP + Fix SQLite deadlock on ldap ssh ↵zeripath2018-12-271-1/+14
| | | | | | | | key deletion (#5557) * Synchronize SSH keys on login with LDAP * BUG: Fix hang on sqlite during LDAP key deletion
* Refactor struct's time to remove unnecessary memory usage (#3142)Lunny Xiao2017-12-111-11/+3
| | | | | | | | | | | | | | * refactor struct's time to remove unnecessary memory usage * use AsTimePtr simple code * fix tests * fix time compare * fix template on gpg * use AddDuration instead of Add
* Replace deprecated Id method with ID (#2655)Ethan Koenig2017-10-051-5/+5
|
* Use AfterLoad instead of AfterSet on Structs (#2628)Lunny Xiao2017-10-011-8/+4
| | | | | | | | * use AfterLoad instead of AfterSet on Structs * fix the comments on AfterLoad * fix the comments on action AfterLoad
* Fix lint errors (#2547)Ethan Koenig2017-09-191-4/+1
|
* Use created & updated instead BeforeInsert & BeforeUpdate (#2482)Lunny Xiao2017-09-131-13/+2
| | | | | | | | | | | | * use created & updated instead BeforeInsert & BeforeUpdate * fix vendor checksum * only show generated SQL when development mode * remove extra update column updated_unix * remove trace config
* Replace calls to xorm UseBool with Where (#2237)G2017-08-011-1/+1
|
* fix bug not to trim space of login username (#1796)Lunny Xiao2017-05-251-1/+6
|
* LDAP user synchronization (#1478)Lauris BH2017-05-101-18/+23
|
* gofmt (#1662)Ethan Koenig2017-05-041-1/+1
|
* Additional OAuth2 providers (#1010)Willem van Dreumel2017-05-011-85/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add google+ * sort signin oauth2 providers based on the name so order is always the same * update auth tip for google+ * add gitlab provider * add bitbucket provider (and some go fmt) * add twitter provider * add facebook provider * add dropbox provider * add openid connect provider incl. new format of tips section in "Add New Source" * lower the amount of disk storage for each session to prevent issues while building cross platform (and disk overflow) * imports according to goimport and code style * make it possible to set custom urls to gitlab and github provider (only these could have a different host) * split up oauth2 into multiple files * small typo in comment * fix indention * fix indentation * fix new line before external import * fix layout of signin part * update "broken" dependency
* fix some typos (#1082)Lunny Xiao2017-02-281-1/+1
|
* fix 500 when use a duplicat email instead of giving an error tip (#1040)Lunny Xiao2017-02-251-11/+21
|
* Oauth2 consumer (#679)Willem van Dreumel2017-02-221-13/+147
| | | | | | | | | | | | | | | | | | | | | | | | | * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
* Create missing database indexes (#596)Andrey Nering2017-01-061-3/+3
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-02 22:04:06 +0000