// FetchUser will go to Steam and access basic info about the user.
173004
func (p *Provider) FetchUser(session goth.Session) (goth.User, error) {
	s := session.(*Session)
	u := goth.User{
		Provider:    p.Name(),
		AccessToken: s.ResponseNonce,
	}

	if s.SteamID == "" {
		// data is not yet retrieved since SteamID is still empty
		return u, fmt.Errorf("%s cannot get user information without SteamID", p.providerName)
	}

	apiURL := fmt.Sprintf(apiUserSummaryEndpoint, p.APIKey, s.SteamID)
	req, err := http.NewRequest("GET", apiURL, nil)
	if err != nil {
		return u, err
	}
	req.Header.Add("Accept", "application/json")
	resp, err := p.Client().Do(req)
	if err != nil {
		if resp != nil {
			resp.Body.Close()
		}
		return u, err
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return u, fmt.Errorf("%s responded with a %d trying to fetch user information", p.providerName, resp.StatusCode)
	}

	u, err = buildUserObject(resp.Body, u)

	return u, err
}
410351
func GetUser(req *restful.Request) *user.User {
	raw := req.Attribute(AttrUserKey)
	if raw == nil {
		panic("GetUser attribute is nil")
	}
	u, ok := raw.(*user.User)
	if !ok {
		panic(fmt.Sprintf("GetUser attribute isn't a user type, but %#v", raw))
	}
	return u
}
1073462
func (p *Provider) FetchUser(session goth.Session) (goth.User, error) {
	s := session.(*Session)
	user := goth.User{
		AccessToken:  s.AccessToken,
		Provider:     p.Name(),
		RefreshToken: s.RefreshToken,
		ExpiresAt:    s.ExpiresAt,
	}

	if user.AccessToken == "" {
		// data is not yet retrieved since accessToken is still empty
		return user, fmt.Errorf("%s cannot get user information without accessToken", p.providerName)
	}

	userProfileURL := protocol + p.Domain + endpointProfile
	req, err := http.NewRequest("GET", userProfileURL, nil)
	if err != nil {
		return user, err
	}
	req.Header.Set("Authorization", "Bearer "+s.AccessToken)
	resp, err := p.Client().Do(req)
	if err != nil {
		if resp != nil {
			resp.Body.Close()
		}
		return user, err
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return user, fmt.Errorf("%s responded with a %d trying to fetch user information", p.providerName, resp.StatusCode)
	}

	err = userFromReader(resp.Body, &user)
	return user, err
}
742927
func (api *Client) GetUserInfo(user string) (*User, error) {
	return api.GetUserInfoContext(context.Background(), user)
}
1087336
func (b MongodbAuthBackend) User(username string) (user UserData, e error) {
	var result UserData

	c := b.connect()
	defer c.Database.Session.Close()

	err := c.Find(bson.M{"Username": username}).One(&result)
	if err != nil {
		return result, ErrMissingUser
	}
	return result, nil
}
1100659
func (r User_Customer_External_Binding) GetUser() (resp datatypes.User_Customer, err error) {
	err = r.Session.DoRequest("SoftLayer_User_Customer_External_Binding", "getUser", nil, &r.Options, &resp)
	return
}
424636
func (a *AuthServer) GetUser(name string) (user services.User, err error) {
	return a.GetCache().GetUser(name)
}
1007769
func (c *client) User(ctx context.Context, name string) (User, error) {
	escapedName := pathEscape(name)
	req, err := c.conn.NewRequest("GET", path.Join("_api/user", escapedName))
	if err != nil {
		return nil, WithStack(err)
	}
	resp, err := c.conn.Do(ctx, req)
	if err != nil {
		return nil, WithStack(err)
	}
	if err := resp.CheckStatus(200); err != nil {
		return nil, WithStack(err)
	}
	var data userData
	if err := resp.ParseBody("", &data); err != nil {
		return nil, WithStack(err)
	}
	u, err := newUser(data, c.conn)
	if err != nil {
		return nil, WithStack(err)
	}
	return u, nil
}
531249
func (a *AuthMiddleware) GetUser(r *http.Request) (interface{}, error) {
	peers := r.TLS.PeerCertificates
	if len(peers) > 1 {
		// when turning intermediaries on, don't forget to verify
		// https://github.com/kubernetes/kubernetes/pull/34524/files#diff-2b283dde198c92424df5355f39544aa4R59
		return nil, trace.AccessDenied("access denied: intermediaries are not supported")
	}
	localClusterName, err := a.AccessPoint.GetClusterName()
	if err != nil {
		return nil, trace.Wrap(err)
	}
	// with no client authentication in place, middleware
	// assumes not-privileged Nop role.
	// it theoretically possible to use bearer token auth even
	// for connections without auth, but this is not active use-case
	// therefore it is not allowed to reduce scope
	if len(peers) == 0 {
		return BuiltinRole{
			GetClusterConfig: a.AccessPoint.GetClusterConfig,
			Role:             teleport.RoleNop,
			Username:         string(teleport.RoleNop),
			ClusterName:      localClusterName.GetClusterName(),
		}, nil
	}
	clientCert := peers[0]
	certClusterName, err := tlsca.ClusterName(clientCert.Issuer)
	if err != nil {
		log.Warnf("Failed to parse client certificate %v.", err)
		return nil, trace.AccessDenied("access denied: invalid client certificate")
	}

	identity, err := tlsca.FromSubject(clientCert.Subject)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	// If there is any restriction on the certificate usage
	// reject the API server request. This is done so some classes
	// of certificates issued for kubernetes usage by proxy, can not be used
	// against auth server. Later on we can extend more
	// advanced cert usage, but for now this is the safest option.
	if len(identity.Usage) != 0 && !utils.StringSlicesEqual(a.AcceptedUsage, identity.Usage) {
		log.Warningf("Restricted certificate of user %q with usage %v rejected while accessing the auth endpoint with acceptable usage %v.",
			identity.Username, identity.Usage, a.AcceptedUsage)
		return nil, trace.AccessDenied("access denied: invalid client certificate")
	}

	// this block assumes interactive user from remote cluster
	// based on the remote certificate authority cluster name encoded in
	// x509 organization name. This is a safe check because:
	// 1. Trust and verification is established during TLS handshake
	// by creating a cert pool constructed of trusted certificate authorities
	// 2. Remote CAs are not allowed to have the same cluster name
	// as the local certificate authority
	if certClusterName != localClusterName.GetClusterName() {
		// make sure that this user does not have system role
		// the local auth server can not truste remote servers
		// to issue certificates with system roles (e.g. Admin),
		// to get unrestricted access to the local cluster
		systemRole := findSystemRole(identity.Groups)
		if systemRole != nil {
			return RemoteBuiltinRole{
				Role:        *systemRole,
				Username:    identity.Username,
				ClusterName: certClusterName,
			}, nil
		}
		return RemoteUser{
			ClusterName:      certClusterName,
			Username:         identity.Username,
			Principals:       identity.Principals,
			KubernetesGroups: identity.KubernetesGroups,
			RemoteRoles:      identity.Groups,
		}, nil
	}
	// code below expects user or service from local cluster, to distinguish between
	// interactive users and services (e.g. proxies), the code below
	// checks for presence of system roles issued in certificate identity
	systemRole := findSystemRole(identity.Groups)
	// in case if the system role is present, assume this is a service
	// agent, e.g. Proxy, connecting to the cluster
	if systemRole != nil {
		return BuiltinRole{
			GetClusterConfig: a.AccessPoint.GetClusterConfig,
			Role:             *systemRole,
			Username:         identity.Username,
			ClusterName:      localClusterName.GetClusterName(),
		}, nil
	}
	// otherwise assume that is a local role, no need to pass the roles
	// as it will be fetched from the local database
	return LocalUser{
		Username: identity.Username,
	}, nil
}
662130
func GetUser(db *sqlx.DB, req *Request) (*User, error) {
	u := &User{}
	u.FlexID = req.FlexID
	u.FlexIDType = req.FlexIDType
	if req.UserID == 0 {
		if req.FlexID == "" {
			return nil, ErrMissingFlexID
		}
		switch req.FlexIDType {
		case FIDTEmail, FIDTPhone, FIDTSession:
			// Do nothing
		default:
			return nil, ErrInvalidFlexIDType
		}
		log.Debug("searching for user from", req.FlexID, req.FlexIDType)
		q := `SELECT userid
		      FROM userflexids
		      WHERE flexid=$1 AND flexidtype=$2
		      ORDER BY createdat DESC`
		err := db.Get(&req.UserID, q, req.FlexID, req.FlexIDType)
		if err == sql.ErrNoRows {
			return u, nil
		}
		log.Debug("got uid", req.UserID)
		if err != nil {
			return nil, err
		}
	}
	q := `SELECT id, name, email FROM users WHERE id=$1`
	if err := db.Get(u, q, req.UserID); err != nil {
		if err == sql.ErrNoRows {
			return u, nil
		}
		return nil, err
	}
	return u, nil
}
746022
func GetUserInfo(client ClientInterface) (*User, error) {
	response, err := client.Get("/user/info")
	if err != nil {
		return nil, err
	}
	result := struct {
		Response struct {
			User User `json:"user"`
		} `json:"response"`
	}{}
	if err = json.Unmarshal(response.body, &result); err != nil {
		return nil, err
	}
	return &result.Response.User, nil
}
409871
func (p *Provider) FetchUser(session goth.Session) (_ goth.User, err error) {
	var (
		sess = session.(*Session)
		user = goth.User{
			AccessToken:  sess.AccessToken,
			RefreshToken: sess.RefreshToken,
			Provider:     p.Name(),
			ExpiresAt:    sess.ExpiresAt,
		}
	)

	if user.AccessToken == "" {
		return user, fmt.Errorf("%s cannot get user information without access token", p.name)
	}

	var (
		sig = fmt.Sprintf(
			"app_id=%smethod=users.getInfosecure=1session_key=%s%s",
			p.oauthConfig.ClientID, sess.AccessToken, p.oauthConfig.ClientSecret,
		)
		hasher = md5.New()
	)

	if _, err = io.WriteString(hasher, sig); err != nil {
		return user, err
	}

	var reqURL = fmt.Sprintf(
		"%s?app_id=%s&method=users.getInfo&secure=1&session_key=%s&sig=%x",
		endpointUser, p.oauthConfig.ClientID, sess.AccessToken, hasher.Sum(nil),
	)

	res, err := p.Client().Get(reqURL)
	if err != nil {
		return user, err
	}

	defer res.Body.Close()

	if res.StatusCode != http.StatusOK {
		return user, fmt.Errorf("%s responded with a %d trying to fetch user information", p.name, res.StatusCode)
	}

	buf, err := ioutil.ReadAll(res.Body)
	if err != nil {
		return user, err
	}

	var raw []json.RawMessage
	if err = json.Unmarshal(buf, &raw); err != nil {
		return user, err
	}

	if len(raw) == 0 {
		return user, fmt.Errorf("%s cannot get user information", p.name)
	}

	if err = json.Unmarshal(raw[0], &user.RawData); err != nil {
		return user, err
	}

	// extract and ignore all errors
	user.UserID, _ = user.RawData["uid"].(string)
	user.FirstName, _ = user.RawData["first_name"].(string)
	user.LastName, _ = user.RawData["last_name"].(string)
	user.NickName, _ = user.RawData["nick"].(string)
	user.Email, _ = user.RawData["email"].(string)
	user.AvatarURL, _ = user.RawData["pic_big"].(string)

	return user, err
}
1367046
func (c *UsersProfileGetCall) User(user string) *UsersProfileGetCall {
	c.user = user
	return c
}
1325650
func (p *Provider) FetchUser(session goth.Session) (goth.User, error) {
	sess := session.(*Session)
	user := goth.User{
		AccessToken:  sess.AccessToken,
		Provider:     p.Name(),
		RefreshToken: sess.RefreshToken,
		ExpiresAt:    sess.ExpiresAt,
	}

	if user.AccessToken == "" {
		// data is not yet retrieved since accessToken is still empty
		return user, fmt.Errorf("%s cannot get user information without accessToken", p.providerName)
	}

	req, err := http.NewRequest("GET", profileEndpoint, nil)
	if err != nil {
		return user, err
	}
	req.Header.Set("Authorization", "OAuth " + sess.AccessToken)
	resp, err := p.Client().Do(req)
	if err != nil {
		if resp != nil {
			resp.Body.Close()
		}
		return user, err
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return user, fmt.Errorf("%s responded with a %d trying to fetch user information", p.providerName, resp.StatusCode)
	}

	bits, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return user, err
	}

	err = json.NewDecoder(bytes.NewReader(bits)).Decode(&user.RawData)
	if err != nil {
		return user, err
	}

	err = userFromReader(bytes.NewReader(bits), &user)
	return user, err
}
605891
func (r *AdminService) GetUser(userName string) *AdminGetUserCall {
	c := &AdminGetUserCall{s: r.s, urlParams_: make(gensupport.URLParams)}
	c.userName = userName
	return c
}
373391
func (h *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	req, err := decodeGetUserRequest(ctx, r)
	if err != nil {
		EncodeError(ctx, err, w)
		return
	}

	b, err := h.UserService.FindUserByID(ctx, req.UserID)
	if err != nil {
		EncodeError(ctx, err, w)
		return
	}

	if err := encodeResponse(ctx, w, http.StatusOK, newUserResponse(b)); err != nil {
		EncodeError(ctx, err, w)
		return
	}
}
461146
func (r *usersResource) getUser(request *restful.Request, response *restful.Response, user schema.User) (error, interface{}) {
	email := request.PathParameter("email")

	if email == "" {
		return app.ErrInvalid, nil
	}

	user, err := r.users.GetUserByEmail(email)
	if err != nil {
		return err, nil
	}

	return nil, &user
}