4915205678
* core: start migrating to flows for authorisation * sources/oauth: start type-hinting * core: create default user * core: only show user delete button if an unenrollment flow exists * flows: Correctly check initial policies on flow with context * policies: add more verbosity to engine * sources/oauth: migrate to flows * sources/oauth: fix typing errors * flows: add more tests * sources/oauth: start implementing unittests * sources/ldap: add option to disable user sync, move connection init to model * sources/ldap: re-add default PropertyMappings * providers/saml: re-add default PropertyMappings * admin: fix missing stage count * stages/identification: fix sources not being shown * crypto: fix being unable to save with private key * crypto: re-add default self-signed keypair * policies: rewrite cache_key to prevent wrong cache * sources/saml: migrate to flows for auth and enrollment * stages/consent: add new stage * admin: fix PropertyMapping widget not rendering properly * core: provider.authorization_flow is mandatory * flows: add support for "autosubmit" attribute on form * flows: add InMemoryStage for dynamic stages * flows: optionally allow empty flows from FlowPlanner * providers/saml: update to authorization_flow * sources/*: fix flow executor URL * flows: fix pylint error * flows: wrap responses in JSON object to easily handle redirects * flow: dont cache plan's context * providers/oauth: rewrite OAuth2 Provider to use flows * providers/*: update docstrings of models * core: fix forms not passing help_text through safe * flows: fix HttpResponses not being converted to JSON * providers/oidc: rewrite to use flows * flows: fix linting
68 lines
2.4 KiB
Python
68 lines
2.4 KiB
Python
"""OIDC Permission checking"""
|
|
from typing import Optional
|
|
|
|
from django.contrib import messages
|
|
from django.db.models.deletion import Collector
|
|
from django.http import HttpRequest, HttpResponse
|
|
from django.shortcuts import redirect
|
|
from oidc_provider.models import Client
|
|
from structlog import get_logger
|
|
|
|
from passbook.audit.models import Event, EventAction
|
|
from passbook.core.models import Application, Provider, User
|
|
from passbook.flows.planner import FlowPlan
|
|
from passbook.flows.views import SESSION_KEY_PLAN
|
|
from passbook.policies.engine import PolicyEngine
|
|
|
|
LOGGER = get_logger()
|
|
|
|
|
|
def client_related_provider(client: Client) -> Optional[Provider]:
|
|
"""Lookup related Application from Client"""
|
|
# because oidc_provider is also used by app_gw, we can't be
|
|
# sure an OpenIDProvider instance exists. hence we look through all related models
|
|
# and choose the one that inherits from Provider, which is guaranteed to
|
|
# have the application property
|
|
collector = Collector(using="default")
|
|
collector.collect([client])
|
|
for _, related in collector.data.items():
|
|
related_object = next(iter(related))
|
|
if isinstance(related_object, Provider):
|
|
return related_object
|
|
return None
|
|
|
|
|
|
def check_permissions(
|
|
request: HttpRequest, user: User, client: Client
|
|
) -> Optional[HttpResponse]:
|
|
"""Check permissions, used for
|
|
https://django-oidc-provider.readthedocs.io/en/latest/
|
|
sections/settings.html#oidc-after-userlogin-hook"""
|
|
provider = client_related_provider(client)
|
|
if not provider:
|
|
return redirect("passbook_providers_oauth:oauth2-permission-denied")
|
|
try:
|
|
application = provider.application
|
|
except Application.DoesNotExist:
|
|
return redirect("passbook_providers_oauth:oauth2-permission-denied")
|
|
LOGGER.debug(
|
|
"Checking permissions for application", user=user, application=application
|
|
)
|
|
policy_engine = PolicyEngine(application, user, request)
|
|
policy_engine.build()
|
|
|
|
# Check permissions
|
|
result = policy_engine.result
|
|
if not result.passing:
|
|
for policy_message in result.messages:
|
|
messages.error(request, policy_message)
|
|
return redirect("passbook_providers_oauth:oauth2-permission-denied")
|
|
|
|
plan: FlowPlan = request.session[SESSION_KEY_PLAN]
|
|
Event.new(
|
|
EventAction.AUTHORIZE_APPLICATION,
|
|
authorized_application=application,
|
|
flow=plan.flow_pk,
|
|
).from_http(request)
|
|
return None
|