|
@@ -50,7 +50,6 @@ from desktop.log.access import access_log, access_warn, last_access_map
|
|
|
from desktop.settings import LOAD_BALANCER_COOKIE
|
|
from desktop.settings import LOAD_BALANCER_COOKIE
|
|
|
|
|
|
|
|
if sys.version_info[0] > 2:
|
|
if sys.version_info[0] > 2:
|
|
|
- import urllib.request, urllib.error
|
|
|
|
|
from urllib.parse import urlencode as urllib_urlencode
|
|
from urllib.parse import urlencode as urllib_urlencode
|
|
|
else:
|
|
else:
|
|
|
from urllib import urlencode as urllib_urlencode
|
|
from urllib import urlencode as urllib_urlencode
|
|
@@ -73,7 +72,7 @@ def get_current_users():
|
|
|
if uid is not None:
|
|
if uid is not None:
|
|
|
try:
|
|
try:
|
|
|
userobj = User.objects.get(pk=uid)
|
|
userobj = User.objects.get(pk=uid)
|
|
|
- current_users[userobj] = last_access_map.get(userobj.username, { })
|
|
|
|
|
|
|
+ current_users[userobj] = last_access_map.get(userobj.username, {})
|
|
|
except User.DoesNotExist:
|
|
except User.DoesNotExist:
|
|
|
LOG.debug("User with id=%d does not exist" % uid)
|
|
LOG.debug("User with id=%d does not exist" % uid)
|
|
|
|
|
|
|
@@ -87,11 +86,14 @@ def first_login_ever():
|
|
|
return True
|
|
return True
|
|
|
return False
|
|
return False
|
|
|
|
|
|
|
|
-# We want unique method name to represent HUE-3 vs HUE-4 method call. This is required because of urlresolvers.reverse('desktop.auth.views.dt_login') below which needs uniqueness to work correctly
|
|
|
|
|
|
|
+
|
|
|
|
|
+# We want unique method name to represent HUE-3 vs HUE-4 method call.
|
|
|
|
|
+# This is required because of urlresolvers.reverse('desktop.auth.views.dt_login') below which needs uniqueness to work correctly.
|
|
|
@login_notrequired
|
|
@login_notrequired
|
|
|
def dt_login_old(request, from_modal=False):
|
|
def dt_login_old(request, from_modal=False):
|
|
|
return dt_login(request, from_modal)
|
|
return dt_login(request, from_modal)
|
|
|
|
|
|
|
|
|
|
+
|
|
|
@login_notrequired
|
|
@login_notrequired
|
|
|
@watch_login
|
|
@watch_login
|
|
|
def dt_login(request, from_modal=False):
|
|
def dt_login(request, from_modal=False):
|
|
@@ -102,8 +104,8 @@ def dt_login(request, from_modal=False):
|
|
|
is_first_login_ever = first_login_ever()
|
|
is_first_login_ever = first_login_ever()
|
|
|
backend_names = auth_forms.get_backend_names()
|
|
backend_names = auth_forms.get_backend_names()
|
|
|
is_active_directory = auth_forms.is_active_directory()
|
|
is_active_directory = auth_forms.is_active_directory()
|
|
|
- is_ldap_option_selected = 'server' not in request.POST or request.POST.get('server') == 'LDAP' \
|
|
|
|
|
- or request.POST.get('server') in auth_forms.get_ldap_server_keys()
|
|
|
|
|
|
|
+ is_ldap_option_selected = 'server' not in request.POST or request.POST.get('server') == 'LDAP' or \
|
|
|
|
|
+ request.POST.get('server') in auth_forms.get_ldap_server_keys()
|
|
|
|
|
|
|
|
if is_active_directory and is_ldap_option_selected:
|
|
if is_active_directory and is_ldap_option_selected:
|
|
|
UserCreationForm = auth_forms.LdapUserCreationForm
|
|
UserCreationForm = auth_forms.LdapUserCreationForm
|
|
@@ -132,7 +134,7 @@ def dt_login(request, from_modal=False):
|
|
|
auth_form = AuthenticationForm(data=request.POST)
|
|
auth_form = AuthenticationForm(data=request.POST)
|
|
|
|
|
|
|
|
if auth_form.is_valid():
|
|
if auth_form.is_valid():
|
|
|
- # Must login by using the AuthenticationForm. It provides 'backends' on the User object.
|
|
|
|
|
|
|
+ # Must login by using the AuthenticationForm. It provides 'backend' on the User object.
|
|
|
user = auth_form.get_user()
|
|
user = auth_form.get_user()
|
|
|
userprofile = get_profile(user)
|
|
userprofile = get_profile(user)
|
|
|
|
|
|
|
@@ -170,12 +172,14 @@ def dt_login(request, from_modal=False):
|
|
|
access_warn(request, msg)
|
|
access_warn(request, msg)
|
|
|
if from_modal or request.GET.get('fromModal', 'false') == 'true':
|
|
if from_modal or request.GET.get('fromModal', 'false') == 'true':
|
|
|
return JsonResponse({'auth': False})
|
|
return JsonResponse({'auth': False})
|
|
|
-
|
|
|
|
|
else:
|
|
else:
|
|
|
first_user_form = None
|
|
first_user_form = None
|
|
|
auth_form = AuthenticationForm()
|
|
auth_form = AuthenticationForm()
|
|
|
# SAML/OIDC user is already authenticated in djangosaml2.views.login
|
|
# SAML/OIDC user is already authenticated in djangosaml2.views.login
|
|
|
- if hasattr(request,'fs') and ('KnoxSpnegoDjangoBackend' in backend_names or 'SpnegoDjangoBackend' in backend_names or 'OIDCBackend' in backend_names or 'SAML2Backend' in backend_names) and request.user.is_authenticated():
|
|
|
|
|
|
|
+ if hasattr(request,'fs') and (
|
|
|
|
|
+ 'KnoxSpnegoDjangoBackend' in backend_names or 'SpnegoDjangoBackend' in backend_names or 'OIDCBackend' in backend_names or
|
|
|
|
|
+ 'SAML2Backend' in backend_names
|
|
|
|
|
+ ) and request.user.is_authenticated():
|
|
|
try:
|
|
try:
|
|
|
ensure_home_directory(request.fs, request.user)
|
|
ensure_home_directory(request.fs, request.user)
|
|
|
except (IOError, WebHdfsException) as e:
|
|
except (IOError, WebHdfsException) as e:
|
|
@@ -184,7 +188,7 @@ def dt_login(request, from_modal=False):
|
|
|
return HttpResponseRedirect(redirect_to)
|
|
return HttpResponseRedirect(redirect_to)
|
|
|
|
|
|
|
|
if is_active_directory and not is_ldap_option_selected and \
|
|
if is_active_directory and not is_ldap_option_selected and \
|
|
|
- request.method == 'POST' and request.user.username != request.POST.get('username'):
|
|
|
|
|
|
|
+ request.method == 'POST' and request.user.username != request.POST.get('username'):
|
|
|
# local user login failed, give the right auth_form with 'server' field
|
|
# local user login failed, give the right auth_form with 'server' field
|
|
|
auth_form = auth_forms.LdapAuthenticationForm()
|
|
auth_form = auth_forms.LdapAuthenticationForm()
|
|
|
|
|
|
|
@@ -224,7 +228,7 @@ def dt_logout(request, next_page=None):
|
|
|
# Close Impala session on logout
|
|
# Close Impala session on logout
|
|
|
session_app = "impala"
|
|
session_app = "impala"
|
|
|
if request.user.has_hue_permission(action='access', app=session_app):
|
|
if request.user.has_hue_permission(action='access', app=session_app):
|
|
|
- session = {"type":session_app,"sourceMethod":"dt_logout"}
|
|
|
|
|
|
|
+ session = {"type": session_app, "sourceMethod":" dt_logout"}
|
|
|
try:
|
|
try:
|
|
|
get_api(request, session).close_session(session)
|
|
get_api(request, session).close_session(session)
|
|
|
except Exception as e:
|
|
except Exception as e:
|
|
@@ -261,7 +265,8 @@ def _profile_dict(user):
|
|
|
first_name=user.first_name,
|
|
first_name=user.first_name,
|
|
|
last_name=user.last_name,
|
|
last_name=user.last_name,
|
|
|
last_login=str(user.last_login), # datetime object needs to be converted
|
|
last_login=str(user.last_login), # datetime object needs to be converted
|
|
|
- email=user.email)
|
|
|
|
|
|
|
+ email=user.email
|
|
|
|
|
+ )
|
|
|
|
|
|
|
|
|
|
|
|
|
# OAuth is based on Twitter as example.
|
|
# OAuth is based on Twitter as example.
|
|
@@ -272,9 +277,10 @@ def oauth_login(request):
|
|
|
|
|
|
|
|
consumer = oauth.Consumer(OAUTH.CONSUMER_KEY.get(), OAUTH.CONSUMER_SECRET.get())
|
|
consumer = oauth.Consumer(OAUTH.CONSUMER_KEY.get(), OAUTH.CONSUMER_SECRET.get())
|
|
|
client = oauth.Client(consumer)
|
|
client = oauth.Client(consumer)
|
|
|
- resp, content = client.request(OAUTH.REQUEST_TOKEN_URL.get(), "POST", body=urllib_urlencode({
|
|
|
|
|
- 'oauth_callback': 'http://' + request.get_host() + '/login/oauth_authenticated/'
|
|
|
|
|
- }))
|
|
|
|
|
|
|
+ resp, content = client.request(
|
|
|
|
|
+ OAUTH.REQUEST_TOKEN_URL.get(), "POST", body=urllib_urlencode({
|
|
|
|
|
+ 'oauth_callback': 'http://' + request.get_host() + '/login/oauth_authenticated/'
|
|
|
|
|
+ }))
|
|
|
|
|
|
|
|
if resp['status'] != '200':
|
|
if resp['status'] != '200':
|
|
|
raise Exception(_("Invalid response from OAuth provider: %s") % resp)
|
|
raise Exception(_("Invalid response from OAuth provider: %s") % resp)
|
|
@@ -304,6 +310,7 @@ def oauth_authenticated(request):
|
|
|
redirect_to = request.GET.get('next', '/')
|
|
redirect_to = request.GET.get('next', '/')
|
|
|
return HttpResponseRedirect(redirect_to)
|
|
return HttpResponseRedirect(redirect_to)
|
|
|
|
|
|
|
|
|
|
+
|
|
|
@login_notrequired
|
|
@login_notrequired
|
|
|
def oidc_failed(request):
|
|
def oidc_failed(request):
|
|
|
if request.user.is_authenticated():
|
|
if request.user.is_authenticated():
|