浏览代码

To map userID: 12345678 to OS user: a2345678 using python PWD module when there is pam service like Centrify configured at OS level (#2261)

PR: #2261
Ref: CDPD-21262
Mahesh Balakrishnan 4 年之前
父节点
当前提交
5918f2017a

+ 4 - 0
desktop/conf.dist/hue.ini

@@ -364,6 +364,10 @@
     # The service to use when querying PAM.
     ## pam_service=login
 
+    # To use Python unix pwd module to get the username from the entered credentials in Hue if Centrify like PAM service is in use.
+    # This will set the username to what is being returned by the pwd module.
+    ## pam_use_pwd_module=false
+
     # When using the desktop.auth.backend.RemoteUserDjangoBackend, this sets
     # the normalized name of the header that contains the remote user.
     # The HTTP header in the request is converted to a key by converting

+ 4 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -368,6 +368,10 @@
     # The service to use when querying PAM.
     ## pam_service=login
 
+    # To use Python unix pwd module to get the username from the entered credentials in Hue if Centrify like PAM service is in use.
+    # This will set the username to what is being returned by the pwd module.
+    ## pam_use_pwd_module=false
+
     # When using the desktop.auth.backend.RemoteUserDjangoBackend, this sets
     # the normalized name of the header that contains the remote user.
     # The HTTP header in the request is converted to a key by converting

+ 5 - 0
desktop/core/src/desktop/auth/backend.py

@@ -30,6 +30,7 @@ User to remain a django.contrib.auth.models.User object.
 
 from builtins import object
 from importlib import import_module
+from pwd import getpwnam
 
 import logging
 import sys
@@ -420,6 +421,10 @@ class PamBackend(DesktopBackendBase):
   def authenticate(self, request=None, username=None, password=None):
     username = force_username_case(username)
 
+    if AUTH.PAM_USE_PWD_MODULE.get():
+      LOG.debug('setting username to %s using pam pwd module for user %s' % (getpwnam(username).pw_name, username))
+      username = getpwnam(username).pw_name
+
     if pam.authenticate(username, password, AUTH.PAM_SERVICE.get()):
       is_super = False
       if User.objects.exclude(id=install_sample_user().id).count() == 0:

+ 5 - 0
desktop/core/src/desktop/conf.py

@@ -1085,6 +1085,11 @@ AUTH = ConfigSection(
                   default="login",
                   help=_("The service to use when querying PAM. "
                          "The service usually corresponds to a single filename in /etc/pam.d")),
+    PAM_USE_PWD_MODULE=Config("pam_use_pwd_module",
+                       help=_("To use python unix pwd module to get the username from the entered credentials in hue if Centrify like pam service is in use. "
+                              "This will set the username to what is being returned by the pwd module."),
+                       type=coerce_bool,
+                       default=False),
     REMOTE_USER_HEADER=Config("remote_user_header",
                         default="HTTP_REMOTE_USER",
                         help=_("When using the desktop.auth.backend.RemoteUserDjangoBackend, this sets "