Actions
Workbench authentication process » History » Revision 24
« Previous |
Revision 24/26
(diff)
| Next »
Peter Amstutz, 11/21/2014 07:51 PM
Workbench authentication process¶
- In workbench, when the browser goes to a page, it checks for a session or
?api_token=xxx
in the URL for the API token. If no API token is found, the brower is directed to the workbench "welcome" pageworkbench/app/views/users/welcome.html.erb
- In workbench, the "welcome" page has a "log in" button that directs the browser to the API server login URL, with a
?return_to=xxx
link embedded in the URL.- Workbench may provide a
auth_provider
parameter in the "log in" button form in order to select an SSO provider, such as "Google OAuth2" or "Google OpenId"
- Workbench may provide a
- In API server, the 'login' endpoint goes to
UserSessionsController#login
in the API server. This redirects the browser to/auth/joshid?return_to=xxx?auth_provider=zzz
- In API server,
/auth/joshid
is intercepted by the OmniAuth Rack middleware and invokes thejosh_id
OmniAuth strategy.- The
josh_id
OmniAuth strategy is implemented inarvados/services/api/lib/josh_id.rb
and is a subclass ofOmniAuth::Strategies::OAuth2
- OmniAuth starts the "request_phase" of
OmniAuth::Strategies::OAuth2
. This redirects the browser to#{options[:custom_provider_url]}/auth/josh_id/authorize?return_to=xxx?auth_provider=zzz
using CUSTOM_PROVIDER_URL defined inarvados/services/api/config/initializers/omniauth.rb
- The
- In sso-provider,
/auth/josh_id/authorize
is routed toAuthController#authorize
, and is intercepted bybefore_filter :authenticate_user!
(part of the devise gem)save_auth_provider
records the:auth_provider
parameters in the sessiondevise :omniauthable, :omniauth_providers => [:google_oauth2]
configuressso-provider/app/models/user.rb
to use the "google_oauth2" strategyauthenticate_user!
is not explicitly defined but instead monkey patched into the controller indevise/lib/devise/controllers/helper.rb
authenticate_user!
callswarden.authenticate!
(warden/lib/warden/proxy.rb
) with a scope of:user
(warden is another Rack-based authentication gem)- Warden proxy tries the TokenAuthenticatable and DatabaseAuthenticatable strategies, but these strategies fail and it raises a :warden exception. This causes it to call
failure_app
which is set up indevise/lib/devise.rb
to beDevise::Delegator.new
- This calls
devise/lib/devise/failure_app.rb
which saves the attempted path in the session ("user_return_to") usingstore_location!
, then redirects the browser tonew_user_session_path
(/users/sign_in
)
- In sso-provider
/users/sign_in
routes to the SSOSessionsController#new
which subclassesDevise::SessionsController
SessionsController#new
redirects the browser to/users/auth/#{session[:auth_provider]}
- In sso-provider, OmniAuth intercepts
/users/auth/:auth_provider
- OmniAuth is configured with a path prefix of
/users/auth
by devise sso-provider/config/initializers/devise.rb
configures the auth_providers- :google_oauth2
- Redirects to
client_options.site
+client_options.authorize_url
which is https://accounts.google.com/o/oauth2/auth
- Redirects to
- :google (OpenId 2.0) (deprecated)
sso-provider/config/initializers/devise.rb
configures a:open_id
omniauth strategy named 'google')- This enters the request phase at
omniauth-open-id/lib/omniauth/strategies/open_id.rb
- This creates a rack layer with
Rack::OpenID.new
(therack-openid
gem) executes it withcall
- The Rack layer passes through the request to the underlying
@app
and checks for a 401 response code, if so it callsbegin_authentication
begin_authentication
constructs an::OpenID::Consumer
object and calls redirects the browser toopen_id_redirect_url
, which finally takes us to a Google login page (after some redirects within Google).
- OmniAuth is configured with a path prefix of
- Google presents the user with a login page, and directs the browser to the sso-server at
/users/auth/:auth_provider/callback
after a successful login (after more redirects within Google) - In sso-provider, Omniauth intercepts this and calls
callback_phase
in the provider's omniauth module- :google_oauth2
- This uses the callback code to initiate a request for an access token and other user information from https://accounts.google.com/o/oauth2/token
- It uses the response to provision the Rack environment with the user information
- :google (OpenId 2.0) (deprecated)
- The callback phase calls
openid_response
openid_response
creates a rack layer withRack::OpenID.new
(therack-openid
gem) executes it withcall
. This provisions the Rack environment with info from the OpenID callback.
- The callback phase calls
- Request handling continues to sso-provider where it routes to
Users::OmniauthCallbacksController#google
- This calls
find_for_identity
on theUser
model which finds a user record with a matching omniauthuid
(theidentity_url
column in the users table), or creates and saves a new user record with theuid
. - The callback also saves the first_name and last_name of the user.
- This calls
sign_in_and_redirect
defined indevise/lib/devise/controllers/helpers.rb
- This calls set_user in Warden, which uses
Warden::SessionSerializer
to save the user associated with the session - This redirects the browser to
stored_location_for
which returns the value ofuser_return_to
in the session, which is/auth/josh_id/authorize
from step 5.
- :google_oauth2
- In sso-provider,
/auth/josh_id/authorize
routes toAuthController#authorize
, and passesauthenticate_user!
because the there is now a user associated with the session.authorize
builds anAccessGrant
using thestate
token from the requestauthorize
redirects the browser toparams[:redirect_uri]
which is/auth/josh_id/callback
(this is the oauth callback on the API server, saved from step 5)
- In API server,
/auth/josh_id/callback
is intercepted byOmniAuth::Strategies::OAuth2
and callscallback_phase
.OmniAuth::Strategies::OAuth2
creates a::OAuth2::Client
and callsget_token
to convert the "authorization_code" into a "oauth_token"- The API server makes a request to the sso-provider at
/oauth/token
- In the sso-provider,
/oauth/token
is routed toAuthController#access_token
- This first checks
Client.authenticate
which verifies thatclient_id
(app_id
) andclient_secret
(app_secret
) are recognized - Next it calls
AccessGrant.authenticate
which verifies thatcode
andclient_id
are recognized - This renders an JSON API response with the
access_token
,refresh_token
andexpires_in
fields which are returned to the API server.
- This first checks
- The API server, back in OmniAuth::Strategies::OAuth2, receives the response and saves the
access_token
.- Request processing continues and routes to
UserSessionsController#create
- API server gets the OmniAuth object and looks up the Arvados API user by
identity_url
- The session is provisioned with the Arvados user id
if params.has_key?(:return_to)
then it callssend_api_token_to
send_api_token_to
creates a new ApiClientAuthorization- It redirects the browser to the
:return_to
after addingapi_token=xxx
to the query portion of return_to
- Request processing continues and routes to
- The browser is finally redirected to workbench to with
api_token=xxx
- Workbench adds the api_token to the session, and redirects the browser one last time to the same location with
?api_token
stripped from the URL
- Workbench adds the api_token to the session, and redirects the browser one last time to the same location with
Updated by Peter Amstutz almost 10 years ago · 24 revisions