ets-berkeley-edu/calcentral — pull request #2392 by chikoon (2014-04-16 20:21:20+00:00)
Title: CLC-3414 "Implement: Re-authenticate when accessing View As"

https://jira.ets.berkeley.edu/jira/browse/CLC-3414

Created a before filter in the application controller (:check_reauthentication)
that checks that the authenticated user is an admin, and in the case
that they haven't reauthenticated yet, and the renew=true param is present,
reauthentication is performed by calling /auth/cas?renew=true

Had to do a monkey patch on the omniauth-cas gem for the login_url method:
It checks that if the renew=ture parameter exists, and if the reauthenticated
cookie doesn't, it merges the renew=true parameter into it's login_options
that end up building the CAS url.

Upon callback from CAS, the SessionController#lookup method sets the :reauthenticated
cookie if the user is acting_as and the renew parameter is present.

The renew=true parameter is generated on the client side in the callback method
designated to receive a success from the SessionController#act_as method.

This functionality has been implemented with the Settings.features.reauthentication flag

This PR is not ready to be merged yet, pending Chris's comments.

Current problems:

1. the UI calls (app/assets/javascripts/angular/controllers/widgets/adminController.js)
calls /auth/cas?renew=true after every act as.
- The check_reauthentication before filter can eventually end up calling the reauthenticate method which redirects to /auth/cas?renew=true
Both of these probably shouldn't exist. I'm pretty sure the UI call is not necessary
since the BootstrapController skips the check_reauthentication filter for the index action.

2. There are lots of "auth helper" methods added to the application_controller.
Mayb these could be moved into an AuthHelper module that could be included so as to make it less noisy.

3. All tests are green, but no specific integration tests have been written to test this functionality.

4. the reauthenticated cookie is destroyed on logout. it's supposed to have an 8 hour expiration date, and currently has none.