From 73c0dfd265e7d0fd0f8df16fa63eecd6ecf202b4 Mon Sep 17 00:00:00 2001
From: Valery Sizov <vsv2711@gmail.com>
Date: Mon, 15 Dec 2014 17:44:06 +0200
Subject: [PATCH] Kerberos: username as identifier

---
 doc/integration/README.md                       |  2 +-
 doc/integration/kerberos.md                     |  2 +-
 lib/gitlab/kerberos/authentication.rb           | 11 ++++++++---
 spec/lib/gitlab/kerberos/authentication_spec.rb | 14 ++------------
 4 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/doc/integration/README.md b/doc/integration/README.md
index ccf3911bf5..00131a8d50 100644
--- a/doc/integration/README.md
+++ b/doc/integration/README.md
@@ -10,7 +10,7 @@ See the documentation below for details on how to configure these services.
 - [OmniAuth](omniauth.md) Sign in via Twitter, GitHub, and Google via OAuth.
 - [Jenkins](jenkins.md) Integrate with the Jenkins CI
 - [Slack](slack.md) Integrate with the Slack chat service
-- [Kerberos](kerberos.md) Integrate with the Slack chat service
+- [Kerberos](kerberos.md) Integrate with Kerberos
 
 ## Project services
 
diff --git a/doc/integration/kerberos.md b/doc/integration/kerberos.md
index e0bcc972df..42252f64e4 100644
--- a/doc/integration/kerberos.md
+++ b/doc/integration/kerberos.md
@@ -9,7 +9,7 @@ Kerberos integration can be enabled as a regular omniauth provider, edit [gitlab
 
 You still need to configure your system for Kerberos usage, such as specifying realms. GitLab will make use of the system's Kerberos settings.
 
-The first time a user signs in with Kerberos credentials, GitLab will create a new GitLab user associated with the email, which is built from the kerberos username and realm. This also means that the system realm you want to use and the email addresses of existing GitLab users should match, meaning the domain part of the email addresses and the realm should match. Existing GitLab users can go to profile > account and attach a Kerberos account. If the email and realm match, the Kerberos account will be linked to the user.
+The first time a user signs in with Kerberos credentials, GitLab will create a new GitLab user associated with the email, which is built from the kerberos username and realm. Existing GitLab users can go to profile > account and attach a Kerberos account.
 
 ## HTTP git access
 
diff --git a/lib/gitlab/kerberos/authentication.rb b/lib/gitlab/kerberos/authentication.rb
index ad99ebf204..6e9a2e6216 100644
--- a/lib/gitlab/kerberos/authentication.rb
+++ b/lib/gitlab/kerberos/authentication.rb
@@ -25,11 +25,16 @@ module Gitlab
       end
 
       def login
-        valid? && User.find_by(email: email)
+        valid? && find_by_login(@login)
       end
 
-      def email
-        @login + "@" + @krb5.get_default_realm.downcase
+      private
+
+      def find_by_login(login)
+        identity = ::Identity.
+          where(provider: :kerberos).
+          where('lower(extern_uid) = ?', login).last
+        identity && identity.user
       end
     end
   end
diff --git a/spec/lib/gitlab/kerberos/authentication_spec.rb b/spec/lib/gitlab/kerberos/authentication_spec.rb
index 0e20d11062..f75c4d0b23 100644
--- a/spec/lib/gitlab/kerberos/authentication_spec.rb
+++ b/spec/lib/gitlab/kerberos/authentication_spec.rb
@@ -2,7 +2,7 @@ require 'spec_helper'
 
 describe Gitlab::Kerberos::Authentication do
   let(:klass) { Gitlab::Kerberos::Authentication }
-  let(:user) { create(:user) }
+  let(:user) { create(:omniauth_user, provider: :kerberos, extern_uid: 'gitlab') }
   let(:login) { 'john' }
   let(:password) { 'password' }
 
@@ -12,12 +12,11 @@ describe Gitlab::Kerberos::Authentication do
     end
 
     it "finds the user if authentication is successful" do
-      kerberos_login = user.email.sub(/@.*/, '')
       kerberos_realm = user.email.sub(/.*@/, '')
       ::Krb5Auth::Krb5.any_instance.stub(get_init_creds_password: true)
       ::Krb5Auth::Krb5.any_instance.stub(get_default_realm: kerberos_realm)
 
-      expect(klass.login(kerberos_login, password)).to be_true
+      expect(klass.login('gitlab', password)).to be_true
     end
 
     it "returns false if there is no such user in kerberos" do
@@ -28,14 +27,5 @@ describe Gitlab::Kerberos::Authentication do
 
       expect(klass.login(kerberos_login, password)).to be_false
     end
-
-    it "returns false if kerberos user is valid but system has wrong realm" do
-      kerberos_login = user.email.sub(/@.*/, '')
-      kerberos_realm = "some-realm.com"
-      ::Krb5Auth::Krb5.any_instance.stub(get_init_creds_password: true)
-      ::Krb5Auth::Krb5.any_instance.stub(get_default_realm: kerberos_realm)
-
-      expect(klass.login(kerberos_login, password)).to be_false
-    end
   end
 end
\ No newline at end of file