[ARVADOS] updated: 530b25ab14999d0407e39e1bf0a0e5595da2a028

[Git user]

Summary of changes:
 services/api/app/controllers/user_sessions_controller.rb | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

       via  530b25ab14999d0407e39e1bf0a0e5595da2a028 (commit)
      from  8424b5ef401ef05a8ca7bd0d6b4e635b7c0a8706 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.


commit 530b25ab14999d0407e39e1bf0a0e5595da2a028
Author: Tom Clegg <tclegg at veritasgenetics.com>
Date:   Mon Oct 30 16:56:32 2017 -0400

    11453: Do not generate local tokens for remote users.
    
    Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tclegg at veritasgenetics.com>

diff --git a/services/api/app/controllers/user_sessions_controller.rb b/services/api/app/controllers/user_sessions_controller.rb
index 5a90f4f..5de85bc 100644
--- a/services/api/app/controllers/user_sessions_controller.rb
+++ b/services/api/app/controllers/user_sessions_controller.rb
@@ -24,7 +24,11 @@ class UserSessionsController < ApplicationController
       return redirect_to login_failure_url
     end
 
-    user = User.find_by_identity_url(omniauth['info']['identity_url'])
+    # Only local users can create sessions, hence uuid_like_pattern
+    # here.
+    user = User.where('identity_url = ? and uuid like ?',
+                      omniauth['info']['identity_url'],
+                      User.uuid_like_pattern).first
     if not user
       # Check for permission to log in to an existing User record with
       # a different identity_url

-----------------------------------------------------------------------


hooks/post-receive
--