|
|
@@ -28,54 +28,57 @@ Because Django's models are sometimes unfriendly, you'll want
|
|
|
User to remain a django.contrib.auth.models.User object.
|
|
|
"""
|
|
|
|
|
|
+import sys
|
|
|
+import logging
|
|
|
from builtins import object
|
|
|
from importlib import import_module
|
|
|
from pwd import getpwnam
|
|
|
|
|
|
-import logging
|
|
|
-import sys
|
|
|
+import requests
|
|
|
+import django.contrib.auth.backends
|
|
|
+from django.contrib import auth
|
|
|
+from django.core.exceptions import ImproperlyConfigured, PermissionDenied
|
|
|
+from django.forms import ValidationError
|
|
|
+from django.http import HttpResponseRedirect
|
|
|
+from django.urls import reverse
|
|
|
+
|
|
|
+from desktop import metrics
|
|
|
+from desktop.conf import AUTH, ENABLE_ORGANIZATIONS, LDAP, OIDC
|
|
|
+from desktop.settings import LOAD_BALANCER_COOKIE
|
|
|
+from liboauth.metrics import oauth_authentication_time
|
|
|
+from useradmin import ldap_access
|
|
|
+from useradmin.models import User, UserProfile, get_default_user_group, get_profile, install_sample_user
|
|
|
+from useradmin.organization import get_organization
|
|
|
+
|
|
|
LOG = logging.getLogger()
|
|
|
|
|
|
try:
|
|
|
import ldap
|
|
|
except ImportError:
|
|
|
LOG.warning('ldap module not found')
|
|
|
+
|
|
|
try:
|
|
|
import pam
|
|
|
except ImportError:
|
|
|
LOG.warning('pam module not found')
|
|
|
-import requests
|
|
|
-
|
|
|
-import django.contrib.auth.backends
|
|
|
-from django.contrib import auth
|
|
|
-from django.core.exceptions import ImproperlyConfigured, PermissionDenied
|
|
|
-from django.http import HttpResponseRedirect
|
|
|
-from django.forms import ValidationError
|
|
|
-from django.urls import reverse
|
|
|
|
|
|
try:
|
|
|
from django_auth_ldap.backend import LDAPBackend
|
|
|
from django_auth_ldap.config import LDAPSearch
|
|
|
except ImportError:
|
|
|
LOG.warning('django_auth_ldap module not found')
|
|
|
- class LDAPSearch: pass
|
|
|
- class LDAPSearch: pass
|
|
|
-from liboauth.metrics import oauth_authentication_time
|
|
|
+ class LDAPSearch:
|
|
|
+ pass
|
|
|
+ class LDAPSearch:
|
|
|
+ pass
|
|
|
+
|
|
|
try:
|
|
|
from mozilla_django_oidc.auth import OIDCAuthenticationBackend, default_username_algo
|
|
|
from mozilla_django_oidc.utils import absolutify, import_from_settings
|
|
|
except ImportError:
|
|
|
LOG.warning('mozilla_django_oidc module not found')
|
|
|
- class OIDCAuthenticationBackend: pass
|
|
|
-
|
|
|
-from desktop import metrics
|
|
|
-from desktop.conf import AUTH, LDAP, OIDC, ENABLE_ORGANIZATIONS
|
|
|
-from desktop.settings import LOAD_BALANCER_COOKIE
|
|
|
-
|
|
|
-from filebrowser.conf import REMOTE_STORAGE_HOME
|
|
|
-from useradmin import ldap_access
|
|
|
-from useradmin.models import get_profile, get_default_user_group, install_sample_user, UserProfile, User
|
|
|
-from useradmin.organization import get_organization
|
|
|
+ class OIDCAuthenticationBackend:
|
|
|
+ pass
|
|
|
|
|
|
|
|
|
# TODO: slowly move those utils to the useradmin module
|
|
|
@@ -93,12 +96,14 @@ def load_augmentation_class():
|
|
|
klass = getattr(mod, attr)
|
|
|
LOG.info("Augmenting users with class: %s" % (klass,))
|
|
|
return klass
|
|
|
- except:
|
|
|
+ except Exception:
|
|
|
LOG.exception('failed to augment class')
|
|
|
raise ImproperlyConfigured("Could not find user_augmentation_class: %s" % (class_name,))
|
|
|
|
|
|
|
|
|
_user_augmentation_class = None
|
|
|
+
|
|
|
+
|
|
|
def get_user_augmentation_class():
|
|
|
global _user_augmentation_class
|
|
|
|
|
|
@@ -218,12 +223,14 @@ def create_user(username, password, is_superuser=True):
|
|
|
|
|
|
return user
|
|
|
|
|
|
+
|
|
|
def find_or_create_user(username, password=None, is_superuser=True):
|
|
|
user = find_user(username)
|
|
|
if user is None:
|
|
|
user = create_user(username, password, is_superuser)
|
|
|
return user
|
|
|
|
|
|
+
|
|
|
def ensure_has_a_group(user):
|
|
|
default_group = get_default_user_group(user=user)
|
|
|
|
|
|
@@ -231,6 +238,7 @@ def ensure_has_a_group(user):
|
|
|
user.groups.add(default_group)
|
|
|
user.save()
|
|
|
|
|
|
+
|
|
|
def force_username_case(username):
|
|
|
if AUTH.FORCE_USERNAME_LOWERCASE.get():
|
|
|
username = username.lower()
|
|
|
@@ -238,6 +246,7 @@ def force_username_case(username):
|
|
|
username = username.upper()
|
|
|
return username
|
|
|
|
|
|
+
|
|
|
def knox_login_headers(request):
|
|
|
userprofile = get_profile(request.user)
|
|
|
try:
|
|
|
@@ -248,9 +257,10 @@ def knox_login_headers(request):
|
|
|
try:
|
|
|
userprofile.update_data({'X-CSRF-TOKEN': request.META['CSRF_COOKIE']})
|
|
|
userprofile.save()
|
|
|
- except:
|
|
|
+ except Exception:
|
|
|
LOG.error("X-CSRF-TOKEN header not found")
|
|
|
|
|
|
+
|
|
|
class DesktopBackendBase(object):
|
|
|
"""
|
|
|
Abstract base class for providing external authentication schemes.
|
|
|
@@ -481,7 +491,7 @@ class LdapBackend(object):
|
|
|
username = force_username_case(username)
|
|
|
|
|
|
try:
|
|
|
- #Avoid circular import from is_admin
|
|
|
+ # Avoid circular import from is_admin
|
|
|
from useradmin.forms import validate_username
|
|
|
validate_username(username)
|
|
|
|
|
|
@@ -634,7 +644,7 @@ class LdapBackend(object):
|
|
|
return user
|
|
|
|
|
|
def check_ldap_access_groups(self, server, username):
|
|
|
- #Avoid circular import from is_admin
|
|
|
+ # Avoid circular import from is_admin
|
|
|
from useradmin.views import get_find_groups_filter
|
|
|
allowed_group = False
|
|
|
|
|
|
@@ -657,14 +667,14 @@ class LdapBackend(object):
|
|
|
return True
|
|
|
|
|
|
else:
|
|
|
- #Login groups not set default to True
|
|
|
+ # Login groups not set default to True
|
|
|
allowed_group = True
|
|
|
|
|
|
return allowed_group
|
|
|
|
|
|
def import_groups(self, server, user):
|
|
|
connection = ldap_access.get_connection_from_server(server)
|
|
|
- #Avoid circular import from is_admin
|
|
|
+ # Avoid circular import from is_admin
|
|
|
from useradmin.views import import_ldap_users
|
|
|
import_ldap_users(connection, user.username, sync_groups=True, import_by_dn=False, server=server)
|
|
|
|
|
|
@@ -853,7 +863,7 @@ class OIDCBackend(OIDCAuthenticationBackend):
|
|
|
user = rewrite_user(user)
|
|
|
|
|
|
ensure_has_a_group(user)
|
|
|
-
|
|
|
+
|
|
|
return user
|
|
|
|
|
|
return None
|
|
|
@@ -968,6 +978,7 @@ class OIDCBackend(OIDCAuthenticationBackend):
|
|
|
|
|
|
# def verify_claims(self, claims):
|
|
|
|
|
|
+
|
|
|
def delete_oidc_session_tokens(session):
|
|
|
if session:
|
|
|
if 'oidc_access_token' in session:
|