Adding an exception for forgery token for external auth.

[martinpovolny]

should fix https://bugzilla.redhat.com/show_bug.cgi?id=1429011

basically we need to skip the csrf token check for all the methods that the login page can lead to

I hope I listed all, and I hope I have not put in any extra method

@jvlcek : please, test
ping @abellotti

what about about :saml_login and :initiate_saml_login ?

EUWE: should go to euwe together with #451

[miq-bot]

Checked commit martinpovolny@6b65095 with ruby 2.2.6, rubocop 0.47.1, and haml-lint 0.20.0
1 file checked, 1 offense detected

app/controllers/application_controller.rb

• ❕ - Line 19, Col 121 - Metrics/LineLength - Line is too long. [201/120]

[imtayadeway]

@martinpovolny what I don't understand about this bug is why excluding an action from this hook caused the issue, and why excluding more actions is the solution. Can you explain a little more in your description?

[martinpovolny]

@imtayadeway : actually this line is causing the problem:

https://github.com/ManageIQ/manageiq-ui-classic/pull/451/files#diff-61341e9220760b0baf1ccde49150f8d1L13

Explanation: excluding the authenticate action resolved the original BZ. But the "housecleaning" -- removing the token from the login page -- broke the other actions that check for the token too.

There's no reason to check for the token in those pages. Actually they would exhibit the same bug as the "normal" login (when the session expires). So I am fixing this by excluding all the actions from the check.

[abellotti]

Just finished testing with @jvlcek, all 👍 for external authentication (ldap, ipa), SSO (kerberos_authenticate), as well as ye-old SAML (keycloak).

Thanks @martinpovolny for this PR.

[simaishi]

Euwe backport (to manageiq repo) details:

$ git log -1
commit 337e83a28256a149aa8a61bec71cb2af2e57796f
Author: Milan Zázrivec <mzazrivec@redhat.com>
Date:   Wed Mar 8 09:42:12 2017 +0100

    Merge pull request #595 from martinpovolny/csrf_skip
    
    Adding an exception for forgery token for external auth.
    (cherry picked from commit 5fa64da998d2d758e289afb6a19d626ea3bc6f3d)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1430835