Merge 1e998b9d37 into 2aa237f096

conf/local.py.j2

@@ -2,6 +2,7 @@
 from __future__ import unicode_literals
 import os
 from .settings_base import *
+from .django_ldap_extension import *
 
 DEBUG = TEMPLATE_DEBUG = False
 
@@ -43,39 +44,41 @@ EMAIL_HOST = '{{ domain }}'
 EMAIL_HOST_USER = '{{ app }}@{{ domain }}'
 EMAIL_HOST_PASSWORD = '{{ mail_pwd }}'
 
-#    # Tous acces
+# LDAP authentication and group management
-#    # parametrer SSO en protect_uris
+import ldap
-#    # OU
+from django_auth_ldap.config import LDAPSearch, LDAPSearchUnion, MemberDNGroupType, LDAPGroupType
-#    # Pas d'acces
+AUTHENTICATION_BACKENDS = (
-#    # hook
+    'django_auth_ldap.backend.LDAPBackend',
-#    # parametrer SSO en protect_uris
+    'django.contrib.auth.backends.ModelBackend',
-#    import ldap
+)
-#    from django_auth_ldap.config import LDAPSearch, PosixGroupType
+AUTH_LDAP_SERVER_URI = "ldap://localhost:389"
-#    AUTHENTICATION_BACKENDS = (
+AUTH_LDAP_USER_SEARCH = LDAPSearch("ou=users,dc=yunohost,dc=org", ldap.SCOPE_SUBTREE, "(uid=%(user)s)")
-#        'django_auth_ldap.backend.LDAPBackend',
+AUTH_LDAP_USER_ATTR_MAP = {
-#        'django.contrib.auth.backends.ModelBackend',
+    "username": "uid",
-#    )
+    "first_name": "givenName",
-#    AUTH_LDAP_SERVER_URI = "ldap://localhost:389"
+    "last_name": "sn",
-#    AUTH_LDAP_USER_SEARCH = LDAPSearch("uid={{ admin }},ou=users,dc=yunohost,dc=org", ldap.SCOPE_SUBTREE, "(uid=%(user)s)")
+    "email": "mail",
-#    AUTH_LDAP_USER_ATTR_MAP = {
+}
-#        "username": "uid",
+AUTH_LDAP_USER_FLAGS_BY_GROUP = {
-#        "first_name": "givenName",
+    "is_active": "cn={{ app }}.main,ou=permission,dc=yunohost,dc=org",
-#        "last_name": "sn",
+    "is_staff": "cn={{ app }}.staff,ou=permission,dc=yunohost,dc=org",
-#        "email": "mail",
+    "is_superuser": "cn={{ app }}.superadmin,ou=permission,dc=yunohost,dc=org"
-#    }
+}
-#    AUTH_LDAP_USER_FLAGS_BY_GROUP = {
+AUTH_LDAP_GROUP_SEARCH = LDAPSearchUnion(
-#        "is_active": "cn=sftpusers,ou=groups,dc=yunohost,dc=org",
+    LDAPSearch("ou=permission,dc=yunohost,dc=org", ldap.SCOPE_SUBTREE, filterstr=u'(cn=coin.*)'),
-#        "is_staff": "cn=sftpusers,ou=groups,dc=yunohost,dc=org",
+    LDAPSearch("ou=groups,dc=yunohost,dc=org", ldap.SCOPE_SUBTREE)
-#        "is_superuser": "cn=sftpusers,ou=groups,dc=yunohost,dc=org"
+)
-#    }
+AUTH_LDAP_GROUP_TYPE = MemberDNGroupTypeUnion(
-#    AUTH_LDAP_GROUP_SEARCH = LDAPSearch("ou=groups,dc=yunohost,dc=org", ldap.SCOPE_SUBTREE, "(objectClass=posixGroup)")
+    MemberDNGroupType("inheritPermission"), # permissionYnh
-#    AUTH_LDAP_GROUP_TYPE = PosixGroupType()
+    MemberDNGroupType("member")) # groupOfNamesYnh
-#    AUTH_LDAP_ALWAYS_UPDATE_USER = True
+AUTH_LDAP_ALWAYS_UPDATE_USER = True
-#    AUTH_LDAP_AUTHORIZE_ALL_USERS = True
+AUTH_LDAP_AUTHORIZE_ALL_USERS = False
-#    AUTH_LDAP_FIND_GROUP_PERMS = True
+AUTH_LDAP_FIND_GROUP_PERMS = True
-#    #AUTH_LDAP_CACHE_GROUPS = True
+AUTH_LDAP_CACHE_GROUPS = True
-#    #AUTH_LDAP_GROUP_CACHE_TIMEOUT = 300
+AUTH_LDAP_GROUP_CACHE_TIMEOUT = 1000
-#    #import logging
+# Link Yunohost group with django permission group
-#    #logger = logging.getLogger('django_auth_ldap')
+AUTH_LDAP_MIRROR_GROUPS_EXCEPT = ("{{ app }}.main", "{{ app }}.staff", "{{ app }}.superadmin")
-#    #logger.addHandler(logging.StreamHandler())
+# import logging
-#    #logger.setLevel(logging.DEBUG)
+# logger = logging.getLogger('django_auth_ldap')
+# logger.addHandler(logging.StreamHandler())
+# logger.setLevel(logging.DEBUG)

manifest.toml

@@ -51,6 +51,22 @@ ram.runtime = "50M"
     type = "string"
     example = "https://www.exemple.tld"
 
+    [install.init_staff_permission]
+    ask.en = "Which group will have the staff access"
+    ask.fr = "Quel groupe aura accès l'accès en tant que staff"
+    help.en = "Users of this group should have access to the Coin admin page"
+    help.fr = "Les utilisateurs de ce groupe devrait avoir accès à la page d'administration de Coin"
+    type = "group"
+    default = "admins"
+
+    [install.init_superadmin_permission]
+    ask.en = "Which group will have the superadmin access"
+    ask.fr = "Quel groupe aura accès l'accès en tant que super admin"
+    help.en = "Users of this group should have all access on the Coin admin page"
+    help.fr = "Les utilisateurs de ce groupe devrait avoir tout les accès sur la page d'administration de Coin"
+    type = "group"
+    default = "admins"
+
 [resources]
     [resources.sources.main]
     url = "https://code.ffdn.org/ffdn/coin/-/archive/bcaad5f.tar.gz"
@@ -64,10 +80,20 @@ ram.runtime = "50M"
 
     [resources.permissions]
     main.url = "/"
-    main.allowed = "visitors"
+    main.allowed = ["visitors", "all_users"]
+
+    staff.show_tile = false
+    staff.label = "Staff"
+
+    superadmin.show_tile = false
+    superadmin.label = "Super admin"
 
     [resources.apt]
-    packages = "gunicorn, python3, python3-venv, libpq-dev, libsasl2-dev, libjpeg-dev, libxml2-dev, libxslt1-dev, libpango1.0-0, postgresql, postgresql-contrib, postgresql-server-dev-13"
+    packages = ["gunicorn",
+        "python3", "python3-venv", "python3-dev",
+        "libpq-dev", "libsasl2-dev", "libjpeg-dev", "libxml2-dev", "libxslt1-dev", "libpango1.0-0",
+        "postgresql", "postgresql-contrib", "postgresql-server-dev-13",
+        "libldap2-dev"]
 
     [resources.database]
     type = "postgresql"

scripts/install

@@ -12,6 +12,7 @@ ynh_app_setting_set --app=$app --key=secret --value=$secret
 ynh_script_progression --message="Setting up source files..."
 
 ynh_setup_source --dest_dir="$install_dir"
+cp ../sources/django_ldap_extension.py "$install_dir"/coin/
 
 chmod 750 "$install_dir"
 chmod -R o-rwx "$install_dir"
@@ -28,7 +29,7 @@ pushd "$install_dir"
     python3 -m venv venv
     venv/bin/pip install --upgrade pip
     venv/bin/pip install gunicorn
-	#echo "django-auth-ldap<1.4" >> $install_dir/requirements.txt
+    echo "django-auth-ldap<1.4" >> $install_dir/requirements.txt
     venv/bin/pip install -r requirements.txt
 popd
 

scripts/upgrade

@@ -24,6 +24,7 @@ then
 
 	# Download, check integrity, uncompress and patch the source from app.src
 	ynh_setup_source --dest_dir="$install_dir" --full_replace=1 --keep=coin/settings_local.py
+	cp ../sources/django_ldap_extension.py "$install_dir"/coin/
 fi
 
 
@@ -32,7 +33,7 @@ pushd "$install_dir"
     python3 -m venv venv
     venv/bin/pip install --upgrade pip
     venv/bin/pip install gunicorn
-	#echo "django-auth-ldap<1.4" >> $install_dir/requirements.txt
+    echo "django-auth-ldap<1.4" >> $install_dir/requirements.txt
     venv/bin/pip install -r requirements.txt
 popd
 

sources/django_ldap_extension.py

@@ -0,0 +1,19 @@
+from django_auth_ldap.config import LDAPGroupType
+
+class MemberDNGroupTypeUnion(LDAPGroupType):
+
+    def __init__(self, *types, name_attr='cn'):
+        self.types = types
+        super(MemberDNGroupTypeUnion, self).__init__(name_attr)
+
+    def user_groups(self, ldap_user, group_search):
+        res = dict()
+        for t in self.types:
+            res.update(t.user_groups(ldap_user, group_search))
+        return res.items()
+
+    def is_member(self, ldap_user, group_dn):
+        for t in self.types:
+            if t.is_member(ldap_user, group_dn):
+                return True
+        return False