ets-berkeley-edu/calcentral — pull request #2400 by chikoon (2014-04-17 18:50:20+00:00)
Title: CLC-3414 "Implement: Re-authenticate when accessing View As"

https://jira.ets.berkeley.edu/jira/browse/CLC-3414

created a before filter in the application controller (:check_reauthentication)

that checks that the authenticated user is an admin and in the case
that they haven't reautenticated yet, and the renew=true param is present,
reauthentication is performed by calling /auth/cas?renew=true

Had to do a monkey patch on the omniauth-cas gem for the login_url method:
It checks that if the renew=ture parameter exists, and if the reauthenticated
cookie doesn't, it merges the renew=true parameter into it's login_options
that end up building the CAS url.

Upon callback from CAS, the SessionController#lookup method sets the :reauthenticated
cookie if the user is acting_as and the renew parameter is present.

The renew=true parameter is generated on the client side in the callback method
designated to receive a success from the SessionController#act_as method.

This functionality has been implemented with the Settings.features.reauthentication flag

This PR should be reviewed by Chris Tweney

Changes made since last PR:

- Removed any special redirects from the UI. The check_reauthentication skip_before_filter
is the only place that makes the redirect to cas with the renew=true parameter

- Removed some unnecessary functions that were only called in one place
- authenticated?
- Simplified the is_admin functions
- Removed erroneous check for pending_reauthentication? in the reauthenticated method
- Simplified the check_reauthentication before filter
- Removed skip_before_filter from all controller actions except for SessionsController#lookup
- Added 8 hour expiration to the reauthenticated cookie
- Removed check for reauthenticated cookie from the omniauth-cas monkey-patch since it
should only care about whether or not it receives the renew parameter.

Known to-dos:
1. All tests are green, but no specific integration tests have been written to test this functionality.