[ADD] This module initialize the session by looking for the field HTTP_REMOTE_USER in the HEADER of the HTTP request and trying^Co bind the given value to a user
Laurent Mignon
parent
f83737f6e8
commit
7dd5bc685e
|
|
@ -0,0 +1,24 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
from . import controllers
|
||||||
|
from . import res_config
|
||||||
|
from . import res_users
|
||||||
|
|
@ -0,0 +1,133 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
{
|
||||||
|
'name': 'Authenticate via HTTP Remote User',
|
||||||
|
'version': '1.0',
|
||||||
|
'category': 'Tools',
|
||||||
|
'description': """
|
||||||
|
Allow users to be automatically logged in.
|
||||||
|
==========================================
|
||||||
|
|
||||||
|
This module initialize the session by looking for the field HTTP_REMOTE_USER in
|
||||||
|
the HEADER of the HTTP request and trying to bind the given value to a user
|
||||||
|
This module must be loaded at startup; Add the *--load* parameter to the startup
|
||||||
|
command: ::
|
||||||
|
|
||||||
|
--load=web,web_kanban,auth_from_http_remote_user, ...
|
||||||
|
|
||||||
|
If the field is not found or no user matches the given one, it can lets the
|
||||||
|
system redirect to the login page (default) or issue a login error page depending
|
||||||
|
of the configuration.
|
||||||
|
|
||||||
|
How to test the module with Apache [#]_
|
||||||
|
----------------------------------------
|
||||||
|
|
||||||
|
Apache can be used as a reverse proxy providing the authentication and adding the
|
||||||
|
required field in the Http headers.
|
||||||
|
|
||||||
|
Install apache: ::
|
||||||
|
|
||||||
|
$ sudo apt-get install apache2
|
||||||
|
|
||||||
|
|
||||||
|
Define a new vhost to Apache by putting a new file in /etc/apache2/sites-available: ::
|
||||||
|
|
||||||
|
$ sudo vi /etc/apache2/sites-available/MY_VHOST.com
|
||||||
|
|
||||||
|
with the following content: ::
|
||||||
|
|
||||||
|
<VirtualHost *:80>
|
||||||
|
ServerName MY_VHOST.com
|
||||||
|
ProxyRequests Off
|
||||||
|
<Location />
|
||||||
|
AuthType Basic
|
||||||
|
AuthName "Test OpenErp auth_from_http_remote_user"
|
||||||
|
AuthBasicProvider file
|
||||||
|
AuthUserFile /etc/apache2/MY_VHOST.htpasswd
|
||||||
|
Require valid-user
|
||||||
|
|
||||||
|
RewriteEngine On
|
||||||
|
RewriteCond %{LA-U:REMOTE_USER} (.+)
|
||||||
|
RewriteRule . - [E=RU:%1]
|
||||||
|
RequestHeader set Remote-User "%{RU}e" env=RU
|
||||||
|
</Location>
|
||||||
|
|
||||||
|
ProxyPass / http://127.0.0.1:8069/ retry=10
|
||||||
|
ProxyPassReverse / http://127.0.0.1:8069/
|
||||||
|
ProxyPreserveHost On
|
||||||
|
</VirtualHost>
|
||||||
|
|
||||||
|
.. important:: The *RequestHeader* directive is used to add the *Remote-User* field
|
||||||
|
in the http headers. By default an *'Http-'* prefix is added to the field name.
|
||||||
|
In OpenErp, header's fields name are normalized. As result of this normalization,
|
||||||
|
the 'Http-Remote-User' is available as 'HTTP_REMOTE_USER'. If you don't know how
|
||||||
|
your specified field is seen by OpenErp, run your server in debug mode once the
|
||||||
|
module is activated and look for an entry like: ::
|
||||||
|
|
||||||
|
DEBUG openerp1 openerp.addons.auth_from_http_remote_user.controllers.session:
|
||||||
|
Field 'HTTP_MY_REMOTE_USER' not found in http headers
|
||||||
|
{'HTTP_AUTHORIZATION': 'Basic YWRtaW46YWRtaW4=', ..., 'HTTP_REMOTE_USER': 'demo')
|
||||||
|
|
||||||
|
Enable the required apache modules: ::
|
||||||
|
|
||||||
|
$ sudo a2enmod headers
|
||||||
|
$ sudo a2enmod proxy
|
||||||
|
$ sudo a2enmod rewrite
|
||||||
|
$ sudo a2enmod proxy_http
|
||||||
|
|
||||||
|
Enable your new vhost: ::
|
||||||
|
|
||||||
|
$ sudo a2ensite MY_VHOST.com
|
||||||
|
|
||||||
|
Create the *htpassword* file used by the configured basic authentication: ::
|
||||||
|
|
||||||
|
$ sudo htpasswd -cb /etc/apache2/MY_VHOST.htpasswd admin admin
|
||||||
|
$ sudo htpasswd -b /etc/apache2/MY_VHOST.htpasswd demo demo
|
||||||
|
|
||||||
|
For local test, add the *MY_VHOST.com* in your /etc/vhosts file.
|
||||||
|
|
||||||
|
Finally reload the configuration: ::
|
||||||
|
|
||||||
|
$ sudo service apache2 reload
|
||||||
|
|
||||||
|
Open your browser and go to MY_VHOST.com. If everything is well configured, you are prompted
|
||||||
|
for a login and password outside OpenErp and are automatically logged in the system.
|
||||||
|
|
||||||
|
.. [#] Based on a ubuntu 12.04 env
|
||||||
|
|
||||||
|
""",
|
||||||
|
'author': 'Acsone SA/NV',
|
||||||
|
'maintainer': 'ACSONE SA/NV',
|
||||||
|
'website': 'http://www.acsone.eu',
|
||||||
|
'depends': ['web'],
|
||||||
|
"license": "AGPL-3",
|
||||||
|
"js": ['static/src/js/auth_from_http_remote_user.js'],
|
||||||
|
'data': [
|
||||||
|
'res_config_view.xml',
|
||||||
|
'res_config_data.xml'],
|
||||||
|
"demo": [],
|
||||||
|
"test": [],
|
||||||
|
"active": False,
|
||||||
|
"license": "AGPL-3",
|
||||||
|
"installable": True,
|
||||||
|
"auto_install": False,
|
||||||
|
"application": False,
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
from . import session
|
||||||
|
|
@ -0,0 +1,129 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
from openerp import SUPERUSER_ID
|
||||||
|
|
||||||
|
from openerp.addons.web import http
|
||||||
|
from openerp.addons.web.controllers import main
|
||||||
|
from openerp.modules.registry import RegistryManager
|
||||||
|
from .. import utils
|
||||||
|
|
||||||
|
import random
|
||||||
|
import logging
|
||||||
|
import openerp.tools.config as config
|
||||||
|
|
||||||
|
_logger = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
|
||||||
|
class Session(main.Session):
|
||||||
|
_cp_path = "/web/session"
|
||||||
|
|
||||||
|
_REQUIRED_ATTRIBUTES = ['HTTP_REMOTE_USER']
|
||||||
|
_OPTIONAL_ATTRIBUTES = []
|
||||||
|
|
||||||
|
def _get_db(self, db):
|
||||||
|
if db is not None and len(db) > 0:
|
||||||
|
return db
|
||||||
|
db = config['db_name']
|
||||||
|
if db is None or len(db) == 0:
|
||||||
|
_logger.error("No db found for SSO. Specify one in the URL using parameter "
|
||||||
|
"db=? or provide a default one in the configuration")
|
||||||
|
raise http.AuthenticationError()
|
||||||
|
|
||||||
|
def _get_user_id_from_attributes(self, res_users, cr, attrs):
|
||||||
|
login = attrs.get('HTTP_REMOTE_USER', None)
|
||||||
|
user_ids = res_users.search(cr, SUPERUSER_ID, [('login', '=', login), ('active', '=', True)])
|
||||||
|
assert len(user_ids) < 2
|
||||||
|
if user_ids:
|
||||||
|
return user_ids[0]
|
||||||
|
return None
|
||||||
|
|
||||||
|
def _get_attributes_form_header(self, req):
|
||||||
|
attrs = {}
|
||||||
|
|
||||||
|
all_attrs = self._REQUIRED_ATTRIBUTES + self._OPTIONAL_ATTRIBUTES
|
||||||
|
|
||||||
|
headers = req.httprequest.headers.environ
|
||||||
|
|
||||||
|
for attr in all_attrs:
|
||||||
|
value = headers.get(attr, None)
|
||||||
|
if value is not None:
|
||||||
|
attrs[attr] = value
|
||||||
|
|
||||||
|
attrs_found = set(attrs.keys())
|
||||||
|
attrs_missing = set(all_attrs) - attrs_found
|
||||||
|
if len(attrs_found) > 0:
|
||||||
|
_logger.debug("Fields '%s' not found in http headers\n %s", attrs_missing, headers)
|
||||||
|
|
||||||
|
missings = set(self._REQUIRED_ATTRIBUTES) - attrs_found
|
||||||
|
if len(missings) > 0:
|
||||||
|
_logger.error("Required fields '%s' not found in http headers\n %s", missings, headers)
|
||||||
|
return attrs
|
||||||
|
|
||||||
|
def _bind_http_remote_user(self, req, db_name):
|
||||||
|
db_name = self._get_db(db_name)
|
||||||
|
try:
|
||||||
|
registry = RegistryManager.get(db_name)
|
||||||
|
with registry.cursor() as cr:
|
||||||
|
modules = registry.get('ir.module.module')
|
||||||
|
installed = modules.search_count(cr, SUPERUSER_ID, ['&',
|
||||||
|
('name', '=', 'auth_from_http_remote_user'),
|
||||||
|
('state', '=', 'installed')]) == 1
|
||||||
|
if not installed:
|
||||||
|
return
|
||||||
|
config = registry.get('auth_from_http_remote_user.config.settings')
|
||||||
|
# get parameters for SSO
|
||||||
|
default_login_page_disabled = config.is_default_login_page_disabled(cr, SUPERUSER_ID, None)
|
||||||
|
|
||||||
|
# get the user
|
||||||
|
res_users = registry.get('res.users')
|
||||||
|
attrs = self._get_attributes_form_header(req)
|
||||||
|
user_id = self._get_user_id_from_attributes(res_users, cr, attrs)
|
||||||
|
|
||||||
|
if user_id is None:
|
||||||
|
if default_login_page_disabled:
|
||||||
|
raise http.AuthenticationError()
|
||||||
|
return
|
||||||
|
|
||||||
|
# generate a specific key for authentication
|
||||||
|
key = randomString(utils.KEY_LENGTH, '0123456789abcdef')
|
||||||
|
res_users.write(cr, SUPERUSER_ID, [user_id], {'sso_key': key})
|
||||||
|
login = res_users.browse(cr, SUPERUSER_ID, user_id).login
|
||||||
|
req.session.bind(db_name, user_id, login, key)
|
||||||
|
except http.AuthenticationError, e:
|
||||||
|
raise e
|
||||||
|
except Exception, e:
|
||||||
|
_logger.error("Error binding Http Remote User session", exc_info=True)
|
||||||
|
raise e
|
||||||
|
|
||||||
|
@http.jsonrequest
|
||||||
|
def get_http_remote_user_session_info(self, req, db):
|
||||||
|
if not req.session._login:
|
||||||
|
self._bind_http_remote_user(req, db)
|
||||||
|
return self.session_info(req)
|
||||||
|
|
||||||
|
randrange = random.SystemRandom().randrange
|
||||||
|
|
||||||
|
|
||||||
|
def randomString(length, chrs):
|
||||||
|
"""Produce a string of length random bytes, chosen from chrs."""
|
||||||
|
n = len(chrs)
|
||||||
|
return ''.join([chrs[randrange(n)] for _ in xrange(length)])
|
||||||
|
|
@ -0,0 +1,60 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
from openerp.osv import orm, fields
|
||||||
|
from openerp.tools.safe_eval import safe_eval
|
||||||
|
import types
|
||||||
|
|
||||||
|
|
||||||
|
class auth_from_http_remote_user_configuration(orm.TransientModel):
|
||||||
|
_name = 'auth_from_http_remote_user.config.settings'
|
||||||
|
_inherit = 'res.config.settings'
|
||||||
|
|
||||||
|
_columns = {
|
||||||
|
'default_login_page_disabled': fields.boolean("Disable login page",
|
||||||
|
help="""
|
||||||
|
Disable the default login page.
|
||||||
|
If the HTTP_REMOTE_HEADER field is not found or no user matches the given one,
|
||||||
|
the system will display a login error page if the login page is disabled.
|
||||||
|
Otherwise the normal login page will be displayed.
|
||||||
|
"""),
|
||||||
|
}
|
||||||
|
|
||||||
|
def is_default_login_page_disabled(self, cr, uid, fields, context=None):
|
||||||
|
ir_config_obj = self.pool['ir.config_parameter']
|
||||||
|
default_login_page_disabled = ir_config_obj.get_param(cr,
|
||||||
|
uid,
|
||||||
|
'auth_from_http_remote_user.default_login_page_disabled')
|
||||||
|
if isinstance(default_login_page_disabled, types.BooleanType):
|
||||||
|
return default_login_page_disabled
|
||||||
|
return safe_eval(default_login_page_disabled)
|
||||||
|
|
||||||
|
def get_default_default_login_page_disabled(self, cr, uid, fields, context=None):
|
||||||
|
default_login_page_disabled = self.is_default_login_page_disabled(cr, uid, fields, context)
|
||||||
|
return {'default_login_page_disabled': default_login_page_disabled}
|
||||||
|
|
||||||
|
def set_default_default_login_page_disabled(self, cr, uid, ids, context=None):
|
||||||
|
config = self.browse(cr, uid, ids[0], context)
|
||||||
|
ir_config_parameter_obj = self.pool['ir.config_parameter']
|
||||||
|
ir_config_parameter_obj.set_param(cr,
|
||||||
|
uid,
|
||||||
|
'auth_from_http_remote_user.default_login_page_disabled',
|
||||||
|
repr(config.default_login_page_disabled))
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
<?xml version="1.0"?>
|
||||||
|
<openerp>
|
||||||
|
<data noupdate="1">
|
||||||
|
<record model="ir.config_parameter" id="auth_from_http_remote_user.default_login_page_disabled">
|
||||||
|
<field name="key">auth_from_http_remote_user.default_login_page_disabled</field>
|
||||||
|
<field name="value">False</field>
|
||||||
|
</record>
|
||||||
|
</data>
|
||||||
|
</openerp>
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<openerp>
|
||||||
|
<data>
|
||||||
|
<record model="ir.ui.view" id="help_view_config_settings">
|
||||||
|
<field name="name">Auth HTTP_REMOTE_USER settings</field>
|
||||||
|
<field name="model">auth_from_http_remote_user.config.settings</field>
|
||||||
|
<field name="priority" eval="20" />
|
||||||
|
<field name="arch" type="xml">
|
||||||
|
<form string="Configure Auth HTTP_REMOTE_USER" version="7.0"
|
||||||
|
class="oe_form_configuration">
|
||||||
|
<header>
|
||||||
|
<header>
|
||||||
|
<button string="Apply" type="object" name="execute" class="oe_highlight"/>
|
||||||
|
or
|
||||||
|
<button string="Cancel" type="object" name="cancel" class="oe_link"/>
|
||||||
|
</header>
|
||||||
|
</header>
|
||||||
|
<separator string="Auth HTTP_REMOTE_USER" />
|
||||||
|
<group>
|
||||||
|
<field name="default_login_page_disabled" />
|
||||||
|
</group>
|
||||||
|
</form>
|
||||||
|
</field>
|
||||||
|
</record>
|
||||||
|
|
||||||
|
<record model="ir.actions.act_window" id="auth_from_http_remote_user_action_config_settings">
|
||||||
|
<field name="name">Configure Auth HTTP_REMOTE_USER</field>
|
||||||
|
<field name="type">ir.actions.act_window</field>
|
||||||
|
<field name="res_model">auth_from_http_remote_user.config.settings</field>
|
||||||
|
<field name="view_mode">form</field>
|
||||||
|
<field name="target">inline</field>
|
||||||
|
</record>
|
||||||
|
|
||||||
|
<menuitem id="base.menu_auth_from_http_remote_user_config" name="Auth HTTP_REMOTE_USER"
|
||||||
|
parent="base.menu_config" sequence="10"
|
||||||
|
action="auth_from_http_remote_user_action_config_settings" />
|
||||||
|
|
||||||
|
</data>
|
||||||
|
</openerp>
|
||||||
|
|
@ -0,0 +1,64 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
from openerp.modules.registry import RegistryManager
|
||||||
|
from openerp.osv import orm, fields
|
||||||
|
from openerp import SUPERUSER_ID
|
||||||
|
import openerp.exceptions
|
||||||
|
from openerp.addons.auth_from_http_remote_user import utils
|
||||||
|
|
||||||
|
|
||||||
|
class res_users(orm.Model):
|
||||||
|
_inherit = 'res.users'
|
||||||
|
|
||||||
|
_columns = {
|
||||||
|
'sso_key': fields.char('SSO Key', size=utils.KEY_LENGTH,
|
||||||
|
readonly=True),
|
||||||
|
}
|
||||||
|
|
||||||
|
def copy(self, cr, uid, rid, defaults=None, context=None):
|
||||||
|
defaults = defaults or {}
|
||||||
|
defaults['sso_key'] = False
|
||||||
|
return super(res_users, self).copy(cr, uid, rid, defaults, context)
|
||||||
|
|
||||||
|
def check_credentials(self, cr, uid, password):
|
||||||
|
try:
|
||||||
|
return super(res_users, self).check_credentials(cr, uid, password)
|
||||||
|
except openerp.exceptions.AccessDenied:
|
||||||
|
res = self.search(cr, SUPERUSER_ID, [('id', '=', uid), ('sso_key', '=', password)])
|
||||||
|
if not res:
|
||||||
|
raise openerp.exceptions.AccessDenied()
|
||||||
|
|
||||||
|
def check(self, db, uid, passwd):
|
||||||
|
try:
|
||||||
|
return super(res_users, self).check(db, uid, passwd)
|
||||||
|
except openerp.exceptions.AccessDenied:
|
||||||
|
if not passwd:
|
||||||
|
raise
|
||||||
|
with RegistryManager.get(db).cursor() as cr:
|
||||||
|
cr.execute('''SELECT COUNT(1)
|
||||||
|
FROM res_users
|
||||||
|
WHERE id=%s
|
||||||
|
AND sso_key=%s
|
||||||
|
AND active=%s''', (int(uid), passwd, True))
|
||||||
|
if not cr.fetchone()[0]:
|
||||||
|
raise
|
||||||
|
self._uid_cache.setdefault(db, {})[uid] = passwd
|
||||||
|
|
@ -0,0 +1,36 @@
|
||||||
|
openerp.auth_from_http_remote_user = function(instance) {
|
||||||
|
|
||||||
|
instance.web.Session.include({
|
||||||
|
session_load_response : function(response) {
|
||||||
|
//unregister the event since it must be called only if the rpc call
|
||||||
|
//is made by session_reload
|
||||||
|
this.off('response', this.session_load_response);
|
||||||
|
if (response.error && response.error.data.type === "session_invalid") {
|
||||||
|
$("body").html("<h1>Access Denied</h1>");
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("session_load_response called");
|
||||||
|
},
|
||||||
|
|
||||||
|
session_reload : function() {
|
||||||
|
var self = this;
|
||||||
|
// we need to register an handler for 'response' since
|
||||||
|
// by default, the rpc doesn't call callback function
|
||||||
|
// if the response is of error type 'session_invalid'
|
||||||
|
this.on('response', this, this.session_load_response);
|
||||||
|
return this.rpc("/web/session/get_http_remote_user_session_info", {
|
||||||
|
db : $.deparam.querystring().db
|
||||||
|
}).done(function(result) {
|
||||||
|
// If immediately follows a login (triggered by trying to
|
||||||
|
// restore
|
||||||
|
// an invalid session or no session at all), refresh session
|
||||||
|
// data
|
||||||
|
// (should not change, but just in case...)
|
||||||
|
_.extend(self, result);
|
||||||
|
}).fail(function(result){
|
||||||
|
$("body").html("<h1>Server error</h1>");
|
||||||
|
});
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
};
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
from . import test_res_users
|
||||||
|
fast_suite = [
|
||||||
|
]
|
||||||
|
|
||||||
|
checks = [
|
||||||
|
test_res_users,
|
||||||
|
]
|
||||||
|
|
@ -0,0 +1,83 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
from openerp.tests import common
|
||||||
|
import mock
|
||||||
|
import os
|
||||||
|
from contextlib import contextmanager
|
||||||
|
import unittest
|
||||||
|
|
||||||
|
|
||||||
|
@contextmanager
|
||||||
|
def mock_cursor(cr):
|
||||||
|
with mock.patch('openerp.sql_db.Connection.cursor') as mocked_cursor_call:
|
||||||
|
org_close = cr.close
|
||||||
|
org_autocommit = cr.autocommit
|
||||||
|
try:
|
||||||
|
cr.close = mock.Mock()
|
||||||
|
cr.autocommit = mock.Mock()
|
||||||
|
mocked_cursor_call.return_value = cr
|
||||||
|
yield
|
||||||
|
finally:
|
||||||
|
cr.close = org_close
|
||||||
|
cr.autocommit = org_autocommit
|
||||||
|
|
||||||
|
|
||||||
|
class test_res_users(common.TransactionCase):
|
||||||
|
|
||||||
|
def test_login(self):
|
||||||
|
res_users_obj = self.registry('res.users')
|
||||||
|
uid = res = res_users_obj.login(common.DB, 'admin', 'admin')
|
||||||
|
self.assertTrue(res, "Basic login must works as expected")
|
||||||
|
token = "123456"
|
||||||
|
res = res_users_obj.login(common.DB, 'admin', token)
|
||||||
|
self.assertFalse(res)
|
||||||
|
# mimic what the new controller do when it find a value in
|
||||||
|
# the http header (HTTP_REMODE_USER)
|
||||||
|
res_users_obj.write(self.cr, self.uid, uid, {'sso_key': token})
|
||||||
|
|
||||||
|
# Here we need to mock the cursor since the login is natively done inside
|
||||||
|
# its own connection
|
||||||
|
with mock_cursor(self.cr):
|
||||||
|
# We can verifies that the given (uid, token) is authorized for the database
|
||||||
|
res_users_obj.check(common.DB, uid, token)
|
||||||
|
|
||||||
|
# we are able to login with the new token
|
||||||
|
res = res_users_obj.login(common.DB, 'admin', token)
|
||||||
|
self.assertTrue(res)
|
||||||
|
|
||||||
|
@unittest.skipIf(os.environ.get('TRAVIS'),
|
||||||
|
'When run by travis, tests runs on a database with all required addons from server-tools and '
|
||||||
|
'their dependencies installed. Even if `auth_from_http_remote_user` does not require the `mail`'
|
||||||
|
'module, The previous installation of the mail module has created the column '
|
||||||
|
'`notification_email_send` as REQUIRED into the table res_partner. BTW, it\'s no more possible '
|
||||||
|
'to copy a res_user without an intefirty error')
|
||||||
|
def test_copy(self):
|
||||||
|
'''Check that the sso_key is not copied on copy
|
||||||
|
'''
|
||||||
|
res_users_obj = self.registry('res.users')
|
||||||
|
vals = {'sso_key': '123'}
|
||||||
|
res_users_obj.write(self.cr, self.uid, self.uid, vals)
|
||||||
|
read_vals = res_users_obj.read(self.cr, self.uid, self.uid, ['sso_key'])
|
||||||
|
self.assertDictContainsSubset(vals, read_vals)
|
||||||
|
copy = res_users_obj.copy(self.cr, self.uid, self.uid)
|
||||||
|
read_vals = res_users_obj.read(self.cr, self.uid, copy, ['sso_key'])
|
||||||
|
self.assertFalse(read_vals.get('sso_key'))
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# Author: Laurent Mignon
|
||||||
|
# Copyright 2014 'ACSONE SA/NV'
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU Affero General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 3 of the
|
||||||
|
# License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU Affero General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU Affero General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
KEY_LENGTH = 16
|
||||||
Loading…
Reference in New Issue