globuzma/canaille-globuzma
1
0
Fork 0
forked from Github-Mirrors/canaille
Code Pull requests Activity

ACL group filter can be simple group name instead of full dn

Browse source
This commit is contained in:
Éloi Rivard 2023-05-02 16:21:29 +02:00
parent 4883548dc5
commit e8e6060c74
6 changed files with 28 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
canaille/backends/ldap/ldapobject.py
View file

@ -200,7 +200,11 @@ class LDAPObject(metaclass=LDAPObjectMetaclass):
@property @property
def dn(self): def dn(self):
return f"{self.rdn_attribute}={ldap.dn.escape_dn_chars(self.rdn_value)},{self.base},{self.root_dn}" return self.dn_for(self.rdn_value)
@classmethod
def dn_for(cls, rdn):
return f"{cls.rdn_attribute}={ldap.dn.escape_dn_chars(rdn)},{cls.base},{cls.root_dn}"
@classmethod @classmethod
def may(cls): def may(cls):

6
canaille/conf/config.sample.toml
View file

@ -104,8 +104,8 @@ GROUP_BASE = "ou=groups,dc=mydomain,dc=tld"
# Here are some examples # Here are some examples
# FILTER = {user_name = 'admin'} # FILTER = {user_name = 'admin'}
# FILTER = # FILTER =
# - {groups = 'cn=admins,ou=groups,dc=mydomain,dc=tld'} # - {groups = 'admins}
# - {groups = 'cn=moderators,ou=groups,dc=mydomain,dc=tld'} # - {groups = 'moderators'}
# #
# The 'PERMISSIONS' parameter that is an list of items the users in the access # The 'PERMISSIONS' parameter that is an list of items the users in the access
# control will be able to manage. 'PERMISSIONS' is optionnal. Values can be: # control will be able to manage. 'PERMISSIONS' is optionnal. Values can be:
@ -145,7 +145,7 @@ WRITE = [
] ]
[ACL.ADMIN] [ACL.ADMIN]
FILTER = {groups = "cn=admins,ou=groups,dc=mydomain,dc=tld"} FILTER = {groups = "admins"}
PERMISSIONS = [ PERMISSIONS = [
"manage_users", "manage_users",
"manage_groups", "manage_groups",

4
canaille/core/models.py
View file

@ -65,6 +65,10 @@ class User(LDAPObject):
@classmethod @classmethod
def acl_filter_to_ldap_filter(cls, filter_): def acl_filter_to_ldap_filter(cls, filter_):
if isinstance(filter_, dict): if isinstance(filter_, dict):
# not super generic, but how can we improve this? ¯\_(ツ)_/¯
if "groups" in filter_ and "=" not in filter_.get("groups"):
filter_["groups"] = Group.dn_for(filter_["groups"])
base = "".join( base = "".join(
f"({cls.attribute_table.get(key, key)}={value})" f"({cls.attribute_table.get(key, key)}={value})"
for key, value in filter_.items() for key, value in filter_.items()

6
demo/conf-docker/canaille.toml
View file

@ -105,8 +105,8 @@ GROUP_BASE = "ou=groups,dc=mydomain,dc=tld"
# Here are some examples # Here are some examples
# FILTER = {user_name = 'admin'} # FILTER = {user_name = 'admin'}
# FILTER = # FILTER =
# - {groups = 'cn=admins,ou=groups,dc=mydomain,dc=tld'} # - {groups = 'admins'}
# - {groups = 'cn=moderators,ou=groups,dc=mydomain,dc=tld'} # - {groups = 'moderators'}
# #
# The 'PERMISSIONS' parameter that is an list of items the users in the access # The 'PERMISSIONS' parameter that is an list of items the users in the access
# control will be able to manage. 'PERMISSIONS' is optionnal. Values can be: # control will be able to manage. 'PERMISSIONS' is optionnal. Values can be:
@ -146,7 +146,7 @@ WRITE = [
] ]
[ACL.ADMIN] [ACL.ADMIN]
FILTER = {groups = "cn=admins,ou=groups,dc=mydomain,dc=tld"} FILTER = {groups = "admins"}
PERMISSIONS = [ PERMISSIONS = [
"manage_users", "manage_users",
"manage_groups", "manage_groups",

6
demo/conf/canaille.toml
View file

@ -105,8 +105,8 @@ GROUP_BASE = "ou=groups,dc=mydomain,dc=tld"
# Here are some examples # Here are some examples
# FILTER = {user_name = 'admin'} # FILTER = {user_name = 'admin'}
# FILTER = # FILTER =
# - {groups = 'cn=admins,ou=groups,dc=mydomain,dc=tld'} # - {groups = 'admins'}
# - {groups = 'cn=moderators,ou=groups,dc=mydomain,dc=tld'} # - {groups = 'moderators'}
# #
# The 'PERMISSIONS' parameter that is an list of items the users in the access # The 'PERMISSIONS' parameter that is an list of items the users in the access
# control will be able to manage. 'PERMISSIONS' is optionnal. Values can be: # control will be able to manage. 'PERMISSIONS' is optionnal. Values can be:
@ -146,7 +146,7 @@ WRITE = [
] ]
[ACL.ADMIN] [ACL.ADMIN]
FILTER = {groups = "cn=admins,ou=groups,dc=mydomain,dc=tld"} FILTER = {groups = "admins"}
PERMISSIONS = [ PERMISSIONS = [
"manage_users", "manage_users",
"manage_groups", "manage_groups",

11
tests/core/test_permissions.py
View file

@ -1,7 +1,16 @@
def test_group_permissions(testclient, user, foo_group): def test_group_permissions_by_id(testclient, user, foo_group):
assert not user.can_manage_users assert not user.can_manage_users
testclient.app.config["ACL"]["ADMIN"]["FILTER"] = {"groups": foo_group.id} testclient.app.config["ACL"]["ADMIN"]["FILTER"] = {"groups": foo_group.id}
user.reload() user.reload()
assert user.can_manage_users assert user.can_manage_users
def test_group_permissions_by_display_name(testclient, user, foo_group):
assert not user.can_manage_users
testclient.app.config["ACL"]["ADMIN"]["FILTER"] = {"groups": foo_group.display_name}
user.reload()
assert user.can_manage_users