瀏覽代碼

HUE-8420 [core] Fix multi LDAP servers with limiting login to list of ldap groups

Ying Chen 7 年之前
父節點
當前提交
b9246c3

+ 4 - 4
apps/useradmin/src/useradmin/views.py

@@ -759,8 +759,8 @@ def import_ldap_groups(connection, group_pattern, import_members, import_members
                              import_by_dn, failed_users=failed_users)
 
 
-def get_find_groups_filter(ldap_info):
-  return _get_find_groups_filter(ldap_info)
+def get_find_groups_filter(ldap_info, server=None):
+  return _get_find_groups_filter(ldap_info, server=server)
 
 
 def sync_ldap_users(connection, failed_users=None):
@@ -902,7 +902,7 @@ def _import_ldap_users(connection, username_pattern, sync_groups=False, import_b
   return _import_ldap_users_info(connection, user_info, sync_groups, import_by_dn, server, failed_users=failed_users)
 
 
-def _get_find_groups_filter(ldap_info):
+def _get_find_groups_filter(ldap_info, server=None):
   if desktop.conf.LDAP.LDAP_SERVERS.get():
     # Choose from multiple server configs
     ldap_config = desktop.conf.LDAP.LDAP_SERVERS.get()[server]
@@ -970,7 +970,7 @@ def _import_ldap_users_info(connection, user_info, sync_groups=False, import_by_
         new_groups = set()
         current_ldap_groups = set()
 
-        find_groups_filter = _get_find_groups_filter(ldap_info)
+        find_groups_filter = _get_find_groups_filter(ldap_info, server=server)
 
         group_ldap_info = connection.find_groups("*", group_filter=find_groups_filter)
         for group_info in group_ldap_info:

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -460,6 +460,9 @@
     # Synchronize a users groups when they login
     ## sync_groups_on_login=true
 
+    # A comma-separated list of Ldap groups with users that can login
+    ## login_groups=
+
     # Ignore the case of usernames when searching for existing users in Hue.
     ## ignore_username_case=true
 

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -464,6 +464,9 @@
     # Synchronize a users groups when they login
     ## sync_groups_on_login=true
 
+    # A comma-separated list of Ldap groups with users that can login
+    ## login_groups=
+
     # Ignore the case of usernames when searching for existing users in Hue.
     ## ignore_username_case=true
 

+ 5 - 5
desktop/core/src/desktop/auth/backend.py

@@ -504,18 +504,18 @@ class LdapBackend(object):
       connection = ldap_access.get_connection_from_server(server)
       try:
         user_info = connection.find_users(username, find_by_dn=False)
-      except LdapSearchException, e:
+      except Exception, e:
         LOG.warn("Failed to find LDAP user: %s" % e)
 
       if not user_info:
-        LOG.warn("Could not get LDAP details for users with pattern %s" % username_pattern)
-        return None
+        LOG.warn("Could not get LDAP details for users with pattern %s" % username)
+        return False
 
       ldap_info = user_info[0]
-      group_ldap_info = connection.find_groups("*", group_filter=get_find_groups_filter(ldap_info))
+      group_ldap_info = connection.find_groups("*", group_filter=get_find_groups_filter(ldap_info, server))
       for group in group_ldap_info:
         if group['name'] in login_groups:
-          allowed_group = True
+          return True
 
     else:
       #Login groups not set default to True

+ 1 - 0
desktop/core/src/desktop/auth/forms.py

@@ -123,6 +123,7 @@ class LdapAuthenticationForm(AuthenticationForm):
   def __init__(self, *args, **kwargs):
     super(LdapAuthenticationForm, self).__init__(*args, **kwargs)
     self.fields['server'] = ChoiceField(choices=get_server_choices())
+    self.error_messages['invalid_login'] = _t("Invalid username or password, or your LDAP groups not allowed")
 
   def authenticate(self):
     request = None

+ 1 - 1
desktop/core/src/desktop/conf.py

@@ -1044,7 +1044,7 @@ LDAP = ConfigSection(
       type=coerce_bool,
       default=False),
     LOGIN_GROUPS = Config("login_groups",
-      help=_("Define a list of Ldap groups in CSV with users that can login"),
+      help=_("A comma-separated list of Ldap groups with users that can login"),
       type=coerce_csv,
       default=[]),
     DEBUG = Config("debug",

+ 8 - 0
docs/admin-manual/manual.md

@@ -1179,6 +1179,14 @@ import groups from an LDAP directory.
 2.  Check the checkbox next to the group and click **Delete**.
 3.  Click **Yes** to confirm.
 
+#### Limit users can login only if they are belong to one of listed LDAP groups
+
+<pre>
+  [desktop]
+  [[ldap]]
+  login_groups=ldap_grp1,ldap_grp2,ldap_grp3
+</pre>
+
 #### Importing Groups from an LDAP Directory
 
 1.  From the **Groups** tab, click **Add/sync LDAP group**.