Explorar o código

Add a configurable default user group

This adds a configuration parameter to the useradmin application, which allows
a default group to be specified. The group will be created automatically, and
may not be deleted (although if the name of the configured group is changed,
a previous default group may be deleted). When adding a user, or logging in via
the LDAP or PAM authentication backends, this group will be selected as a
default group for the user.
Jon Natkins %!s(int64=13) %!d(string=hai) anos
pai
achega
c9b0aaec4f

+ 9 - 0
apps/useradmin/src/useradmin/conf.py

@@ -17,3 +17,12 @@
 """
 """
 Configuration options for the "user admin" application
 Configuration options for the "user admin" application
 """
 """
+
+from desktop.lib.conf import Config
+
+DEFAULT_USER_GROUP = Config(
+    key="default_user_group",
+    help="The name of a default group for users at creation time, or at first login "
+         "if the server is configured to authenticate against an external source.",
+    type=str,
+    default=None)

+ 12 - 0
apps/useradmin/src/useradmin/models.py

@@ -57,6 +57,8 @@ from desktop import appmanager
 from desktop.lib.django_util import PopupException
 from desktop.lib.django_util import PopupException
 from enum import Enum
 from enum import Enum
 
 
+import useradmin.conf
+
 LOG = logging.getLogger(__name__)
 LOG = logging.getLogger(__name__)
 
 
 class UserProfile(models.Model):
 class UserProfile(models.Model):
@@ -188,6 +190,15 @@ class HuePermission(models.Model):
   def get_app_permission(cls, hue_app, action):
   def get_app_permission(cls, hue_app, action):
     return HuePermission.objects.get(app=hue_app, action=action)
     return HuePermission.objects.get(app=hue_app, action=action)
 
 
+def get_default_user_group(**kwargs):
+  default_user_group = useradmin.conf.DEFAULT_USER_GROUP.get()
+  if default_user_group is not None:
+    group, created = auth_models.Group.objects.get_or_create(name=default_user_group)
+    if created:
+      group.save()
+
+    return group
+
 def update_app_permissions(**kwargs):
 def update_app_permissions(**kwargs):
   """
   """
   Inserts missing permissions into the database table.
   Inserts missing permissions into the database table.
@@ -243,4 +254,5 @@ def update_app_permissions(**kwargs):
             available - len(added) - updated - uptodate))
             available - len(added) - updated - uptodate))
 
 
 models.signals.post_syncdb.connect(update_app_permissions)
 models.signals.post_syncdb.connect(update_app_permissions)
+models.signals.post_syncdb.connect(get_default_user_group)
 
 

+ 3 - 0
apps/useradmin/src/useradmin/tests.py

@@ -32,6 +32,7 @@ from django.utils.encoding import smart_unicode
 from useradmin.models import HuePermission, GroupPermission, LdapGroup, UserProfile
 from useradmin.models import HuePermission, GroupPermission, LdapGroup, UserProfile
 from useradmin.models import get_profile
 from useradmin.models import get_profile
 
 
+import useradmin.conf
 from views import sync_ldap_users_and_groups, import_ldap_user, import_ldap_group
 from views import sync_ldap_users_and_groups, import_ldap_user, import_ldap_group
 import ldap_access
 import ldap_access
 
 
@@ -42,6 +43,8 @@ def reset_all_users():
 
 
 def reset_all_groups():
 def reset_all_groups():
   """Reset to a clean state by deleting all users"""
   """Reset to a clean state by deleting all users"""
+
+  useradmin.conf.DEFAULT_USER_GROUP.set_for_testing(None)
   for grp in Group.objects.all():
   for grp in Group.objects.all():
     grp.delete()
     grp.delete()
 
 

+ 19 - 12
apps/useradmin/src/useradmin/views.py

@@ -32,7 +32,7 @@ from desktop.lib.django_util import get_username_re_rule, get_groupname_re_rule,
 from django.core import urlresolvers
 from django.core import urlresolvers
 
 
 from useradmin.models import GroupPermission, HuePermission, UserProfile, LdapGroup
 from useradmin.models import GroupPermission, HuePermission, UserProfile, LdapGroup
-from useradmin.models import get_profile
+from useradmin.models import get_profile, get_default_user_group
 import ldap_access
 import ldap_access
 
 
 LOG = logging.getLogger(__name__)
 LOG = logging.getLogger(__name__)
@@ -75,12 +75,16 @@ def delete_user(request, username):
 def delete_group(request, name):
 def delete_group(request, name):
   if not request.user.is_superuser:
   if not request.user.is_superuser:
     raise PopupException("You must be a superuser to delete groups.")
     raise PopupException("You must be a superuser to delete groups.")
+
   if request.method == 'POST':
   if request.method == 'POST':
     try:
     try:
       global groups_lock
       global groups_lock
       __groups_lock.acquire()
       __groups_lock.acquire()
       try:
       try:
         group = Group.objects.get(name=name)
         group = Group.objects.get(name=name)
+        default_group = get_default_user_group()
+        if default_group is not None and default_group.name == name:
+          raise PopupException("The default user group may not be deleted.")
         group.delete()
         group.delete()
       finally:
       finally:
         __groups_lock.release()
         __groups_lock.release()
@@ -141,17 +145,18 @@ class SuperUserChangeForm(UserChangeForm):
   class Meta(UserChangeForm.Meta):
   class Meta(UserChangeForm.Meta):
     fields = ["username", "is_active"] + UserChangeForm.Meta.fields + ["is_superuser", "groups"]
     fields = ["username", "is_active"] + UserChangeForm.Meta.fields + ["is_superuser", "groups"]
 
 
-    def __init__(self, *args, **kwargs):
-      """
-      Set the default for group membership in 'users' group.
-      """
-      super(SuperUserChangeForm, self).__init__(*args, **kwargs)
-      # Note that because of the way the template displays this,
-      # this isn't actually used.  But if it were using
-      # the normal django way, it would be.
-      if not self.instance.id:
-        self.initial["groups"] = []
-
+  def __init__(self, *args, **kwargs):
+    super(SuperUserChangeForm, self).__init__(*args, **kwargs)
+    if self.instance.id:
+      # If the user exists already, we'll use its current group memberships
+      self.initial['groups'] = set(self.instance.groups.all())
+    else:
+      # If his is a new user, suggest the default group
+      default_group = get_default_user_group()
+      if default_group is not None:
+        self.initial['groups'] = set([default_group])
+      else:
+        self.initial['groups'] = []
 
 
 def edit_user(request, username=None):
 def edit_user(request, username=None):
   """
   """
@@ -210,6 +215,7 @@ def edit_user(request, username=None):
       return list_users(request)
       return list_users(request)
   else:
   else:
     form = form_class(instance=instance)
     form = form_class(instance=instance)
+
   return render('edit_user.mako', request,
   return render('edit_user.mako', request,
     dict(form=form, action=request.path, username=username))
     dict(form=form, action=request.path, username=username))
 
 
@@ -465,6 +471,7 @@ class GroupEditForm(forms.ModelForm):
     super(GroupEditForm, self).__init__(*args, **kwargs)
     super(GroupEditForm, self).__init__(*args, **kwargs)
 
 
     if self.instance.id:
     if self.instance.id:
+      self.fields['name'].widget.attrs['readonly'] = True
       initial_members = User.objects.filter(groups=self.instance).order_by('username')
       initial_members = User.objects.filter(groups=self.instance).order_by('username')
       initial_perms = HuePermission.objects.filter(grouppermission__group=self.instance).order_by('app','description')
       initial_perms = HuePermission.objects.filter(grouppermission__group=self.instance).order_by('app','description')
     else:
     else:

+ 12 - 1
desktop/core/src/desktop/auth/backend.py

@@ -35,7 +35,7 @@ import logging
 import desktop.conf
 import desktop.conf
 from django.utils.importlib import import_module
 from django.utils.importlib import import_module
 from django.core.exceptions import ImproperlyConfigured
 from django.core.exceptions import ImproperlyConfigured
-from useradmin.models import get_profile, UserProfile
+from useradmin.models import get_profile, get_default_user_group, UserProfile
 
 
 import pam
 import pam
 from django_auth_ldap.backend import LDAPBackend, ldap_settings
 from django_auth_ldap.backend import LDAPBackend, ldap_settings
@@ -206,6 +206,11 @@ class PamBackend(DesktopBackendBase):
           profile.creation_method = UserProfile.EXTERNAL
           profile.creation_method = UserProfile.EXTERNAL
           profile.save()
           profile.save()
           user.is_superuser = is_super
           user.is_superuser = is_super
+
+          default_group = get_default_user_group()
+          if default_group is not None:
+            user.groups.add(default_group)
+
           user.save()
           user.save()
 
 
       user = rewrite_user(user)
       user = rewrite_user(user)
@@ -268,6 +273,12 @@ class LdapBackend(object):
       profile.save()
       profile.save()
       user.is_superuser = is_super
       user.is_superuser = is_super
       user = rewrite_user(user)
       user = rewrite_user(user)
+
+      default_group = get_default_user_group()
+      if default_group is not None:
+        user.groups.add(default_group)
+        user.save()
+
       return user
       return user
 
 
     return None
     return None