Parcourir la source

Fix the logic determining the superuser when using the LdapBackend

The LdapBackend, like the default auth backend grants superuser access to the
first LDAP user to log in. This change makes sure that those changes will
persist properly.
Jon Natkins il y a 13 ans
Parent
commit
ba94a7b780
1 fichiers modifiés avec 11 ajouts et 1 suppressions
  1. 11 1
      desktop/core/src/desktop/auth/backend.py

+ 11 - 1
desktop/core/src/desktop/auth/backend.py

@@ -264,8 +264,18 @@ class LdapBackend(object):
   def authenticate(self, username=None, password=None):
     # Do this check up here, because the auth call creates a django user upon first login per user
     is_super = False
-    if User.objects.count() == 0:
+    if not UserProfile.objects.filter(creation_method=str(UserProfile.CreationMethod.EXTERNAL)).exists():
+      # If there are no LDAP users already in the system, the first one will
+      # become a superuser
       is_super = True
+    elif User.objects.filter(username=username).exists():
+      # If the user already exists, we shouldn't change its superuser
+      # privileges. However, if there's a naming conflict with a non-external
+      # user, we should do the safe thing and turn off superuser privs.
+      existing_user = User.objects.get(username=username)
+      existing_profile = get_profile(existing_user)
+      if existing_profile.creation_method == str(UserProfile.CreationMethod.EXTERNAL):
+        is_super = User.objects.get(username=username).is_superuser
 
     try:
       user = self._backend.authenticate(username, password)