瀏覽代碼

Fix the logic determining the superuser when using the LdapBackend

The LdapBackend, like the default auth backend grants superuser access to the
first LDAP user to log in. This change makes sure that those changes will
persist properly.
Jon Natkins 13 年之前
父節點
當前提交
ba94a7b780
共有 1 個文件被更改,包括 11 次插入1 次删除
  1. 11 1
      desktop/core/src/desktop/auth/backend.py

+ 11 - 1
desktop/core/src/desktop/auth/backend.py

@@ -264,8 +264,18 @@ class LdapBackend(object):
   def authenticate(self, username=None, password=None):
     # Do this check up here, because the auth call creates a django user upon first login per user
     is_super = False
-    if User.objects.count() == 0:
+    if not UserProfile.objects.filter(creation_method=str(UserProfile.CreationMethod.EXTERNAL)).exists():
+      # If there are no LDAP users already in the system, the first one will
+      # become a superuser
       is_super = True
+    elif User.objects.filter(username=username).exists():
+      # If the user already exists, we shouldn't change its superuser
+      # privileges. However, if there's a naming conflict with a non-external
+      # user, we should do the safe thing and turn off superuser privs.
+      existing_user = User.objects.get(username=username)
+      existing_profile = get_profile(existing_user)
+      if existing_profile.creation_method == str(UserProfile.CreationMethod.EXTERNAL):
+        is_super = User.objects.get(username=username).is_superuser
 
     try:
       user = self._backend.authenticate(username, password)