globuzma/canaille-globuzma
1
0
Fork 0
forked from Github-Mirrors/canaille
Code Pull requests Activity

LDAPHelper shortcut

Browse source
This commit is contained in:
Éloi Rivard 2020-08-17 09:45:35 +02:00
parent 5efec79e21
commit 77f6600de7
4 changed files with 14 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
oauth2-openldap.ldif
View file

@ -25,7 +25,6 @@ olcAttributeTypes: ( 1.3.6.1.4.1.56207.1.1.3 NAME 'oauthRedirectURI'
ORDERING caseIgnoreOrderingMatch ORDERING caseIgnoreOrderingMatch
SUBSTR caseIgnoreSubstringsMatch SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
USAGE userApplications USAGE userApplications
X-ORIGIN 'OAuth 2.0' ) X-ORIGIN 'OAuth 2.0' )
olcAttributeTypes: ( 1.3.6.1.4.1.56207.1.1.4 NAME 'oauthResponseType' olcAttributeTypes: ( 1.3.6.1.4.1.56207.1.1.4 NAME 'oauthResponseType'

9
website/models.py
View file

@ -12,6 +12,7 @@ from authlib.oauth2.rfc6749 import (
class LDAPObjectHelper: class LDAPObjectHelper:
_object_class_by_name = None _object_class_by_name = None
_attribute_type_by_name = None
may = None may = None
must = None must = None
base = None base = None
@ -127,7 +128,7 @@ class LDAPObjectHelper:
if (not self.may or name not in self.may) and (not self.must or name not in self.must): if (not self.may or name not in self.may) and (not self.must or name not in self.must):
return super().__getattribute__(name) return super().__getattribute__(name)
if not self._attribute_type_by_name[name].single_value: if not self.attr_type_by_name() or not self.attr_type_by_name()[name].single_value:
return self.attrs.get(name, []) return self.attrs.get(name, [])
return self.attrs.get(name, [None])[0] return self.attrs.get(name, [None])[0]
@ -137,7 +138,7 @@ class LDAPObjectHelper:
if not isinstance(value, list): if not isinstance(value, list):
value = [value] value = [value]
if (self.may and name in self.may) or (self.must and name in self.must): if (self.may and name in self.may) or (self.must and name in self.must):
if self._attribute_type_by_name[name].single_value: if self.attr_type_by_name()[name].single_value:
self.attrs[name] = [value] self.attrs[name] = [value]
else: else:
self.attrs[name] = value self.attrs[name] = value
@ -149,7 +150,7 @@ class User(LDAPObjectHelper):
id = "cn" id = "cn"
def __repr__(self): def __repr__(self):
return self.cn return self.cn[0]
def check_password(self, password): def check_password(self, password):
return password == "valid" return password == "valid"
@ -173,7 +174,7 @@ class Client(LDAPObjectHelper, ClientMixin):
return redirect_uri in self.oauthRedirectURI return redirect_uri in self.oauthRedirectURI
def has_client_secret(self): def has_client_secret(self):
return self.oauthClientSecret and self.oauthClientSecret return bool(self.oauthClientSecret)
def check_client_secret(self, client_secret): def check_client_secret(self, client_secret):
return client_secret == self.oauthClientSecret return client_secret == self.oauthClientSecret

2
website/oauth2.py
View file

@ -138,7 +138,7 @@ def save_token(token, request):
oauthRefreshToken=token["refresh_token"], oauthRefreshToken=token["refresh_token"],
oauthIssueDate=now.strftime("%Y%m%d%H%M%SZ"), oauthIssueDate=now.strftime("%Y%m%d%H%M%SZ"),
oauthTokenLifetime=str(token["expires_in"]), oauthTokenLifetime=str(token["expires_in"]),
oauthScope=token["scope"].split(" "), oauthScope=token["scope"],
oauthClientID=request.client.oauthClientID[0], oauthClientID=request.client.oauthClientID[0],
) )
token.save() token.save()

8
website/routes.py
View file

@ -25,13 +25,16 @@ def home():
if not user: if not user:
user = User(cn=username, sn=username) user = User(cn=username, sn=username)
user.save() user.save()
session["user_dn"] = user.dn session["user_dn"] = user.dn
return redirect("/") return redirect("/")
user = current_user() user = current_user()
if user: if user:
clients = Client.filter() clients = Client.filter()
else: else:
clients = [] clients = []
return render_template("home.html", user=user, clients=clients) return render_template("home.html", user=user, clients=clients)
@ -44,8 +47,10 @@ def create_client():
user = current_user() user = current_user()
if not user: if not user:
return redirect("/") return redirect("/")
if request.method == "GET": if request.method == "GET":
return render_template("create_client.html") return render_template("create_client.html")
form = request.form form = request.form
client_id = gen_salt(24) client_id = gen_salt(24)
client_id_issued_at = datetime.datetime.now().strftime("%Y%m%d%H%M%SZ") client_id_issued_at = datetime.datetime.now().strftime("%Y%m%d%H%M%SZ")
@ -76,13 +81,16 @@ def authorize():
except OAuth2Error as error: except OAuth2Error as error:
return jsonify(dict(error.get_body())) return jsonify(dict(error.get_body()))
return render_template("authorize.html", user=user, grant=grant) return render_template("authorize.html", user=user, grant=grant)
if not user and "username" in request.form: if not user and "username" in request.form:
username = request.form.get("username") username = request.form.get("username")
user = User.get(username) user = User.get(username)
if request.form["confirm"]: if request.form["confirm"]:
grant_user = user grant_user = user
else: else:
grant_user = None grant_user = None
return authorization.create_authorization_response(grant_user=grant_user) return authorization.create_authorization_response(grant_user=grant_user)