ets-berkeley-edu/calcentral — pull request #2434 by chikoon (2014-04-28 17:52:14+00:00)
Title: CLC-3415: Require re-authentication when accessing admin level functions

https://jira.ets.berkeley.edu/jira/browse/CLC-3415

For admins who have not reauthenticated in the last 8 hours who
try to access ccadmin, they are redirected to the CAS login page.

At that point, they are reauthorized for the next 8 hours and may
enter ccadmin _and_ as-as another user without being asked to
reauthenticate.

How to test v1:
1. log out of calcentral
2. log into calcentral as an admin
3. try accessing /ccadmin
4. you should be asked to reauthenticate on the CAS single sign-on page
5. after that you should enter the rails admin (ccadmin) page
6. go back to the dashboard
7. try accessing /ccadmin
8. you should not be asked to authenticate
9. go to the settings page
10. try viewing as any user (oski, for example)
11. you should view-as as oski without having to reauthenticate

How to test v2.
1. log out of calcentral
2. log into calcentral as an admin
3. try viewing as another user
4. you should be asked to reauthenticate on the CAS single sign-on page
5. after that you should be viewing-as the given user
6. hit the stop viewing as page
7. try accessing /ccadmin
8. you should access the rails_admin site administration page without being asked to authenticate

Reauthentication cookie is deleted on manual logouts. Otherwise, they hang around for 8 hours.

This is all behind the Settings.features.reauthentication feature flag.