From 76f74f479ba74e86075aef2eda34dfa7d5f58dd0 Mon Sep 17 00:00:00 2001 From: Jeremy Stretch Date: Mon, 1 Jun 2020 16:23:45 -0400 Subject: [PATCH] Support permission attribute assignment via REMOTE_AUTH_DEFAULT_PERMISSIONS --- docs/configuration/optional-settings.md | 4 ++-- netbox/netbox/authentication.py | 6 +++--- netbox/netbox/configuration.example.py | 2 +- netbox/netbox/settings.py | 13 ++++++++++++- 4 files changed, 18 insertions(+), 7 deletions(-) diff --git a/docs/configuration/optional-settings.md b/docs/configuration/optional-settings.md index 7c4a7c9c2..31ee39a5f 100644 --- a/docs/configuration/optional-settings.md +++ b/docs/configuration/optional-settings.md @@ -416,9 +416,9 @@ The list of groups to assign a new user account when created using remote authen ## REMOTE_AUTH_DEFAULT_PERMISSIONS -Default: `[]` (Empty list) +Default: `{}` (Empty dictionary) -The list of permissions to assign a new user account when created using remote authentication. (Requires `REMOTE_AUTH_ENABLED`.) +A mapping of permissions to assign a new user account when created using remote authentication. Each key in the dictionary should be set to a dictionary of the attributes to be applied to the permission, or `None` to allow all objects. (Requires `REMOTE_AUTH_ENABLED`.) --- diff --git a/netbox/netbox/authentication.py b/netbox/netbox/authentication.py index 1522e6268..4e9078a9a 100644 --- a/netbox/netbox/authentication.py +++ b/netbox/netbox/authentication.py @@ -112,18 +112,18 @@ class RemoteUserBackend(_RemoteUserBackend): # Assign default object permissions to the user permissions_list = [] - for permission_name in settings.REMOTE_AUTH_DEFAULT_PERMISSIONS: + for permission_name, attrs in settings.REMOTE_AUTH_DEFAULT_PERMISSIONS.items(): try: content_type, action = resolve_permission(permission_name) # TODO: Merge multiple actions into a single ObjectPermission per content type - obj_perm = ObjectPermission(actions=[action]) + obj_perm = ObjectPermission(actions=[action], attrs=attrs) obj_perm.save() obj_perm.users.add(user) obj_perm.content_types.add(content_type) permissions_list.append(permission_name) except ValueError: logging.error( - "Invalid permission name: '{permission_name}'. Permissions must be in the form " + f"Invalid permission name: '{permission_name}'. Permissions must be in the form " "._. (Example: dcim.add_site)" ) if permissions_list: diff --git a/netbox/netbox/configuration.example.py b/netbox/netbox/configuration.example.py index 0803efb2a..7b39fb19e 100644 --- a/netbox/netbox/configuration.example.py +++ b/netbox/netbox/configuration.example.py @@ -209,7 +209,7 @@ REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend' REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER' REMOTE_AUTH_AUTO_CREATE_USER = True REMOTE_AUTH_DEFAULT_GROUPS = [] -REMOTE_AUTH_DEFAULT_PERMISSIONS = [] +REMOTE_AUTH_DEFAULT_PERMISSIONS = {} # This determines how often the GitHub API is called to check the latest release of NetBox. Must be at least 1 hour. RELEASE_CHECK_TIMEOUT = 24 * 3600 diff --git a/netbox/netbox/settings.py b/netbox/netbox/settings.py index 6199ede27..692382262 100644 --- a/netbox/netbox/settings.py +++ b/netbox/netbox/settings.py @@ -99,7 +99,7 @@ PREFER_IPV4 = getattr(configuration, 'PREFER_IPV4', False) REMOTE_AUTH_AUTO_CREATE_USER = getattr(configuration, 'REMOTE_AUTH_AUTO_CREATE_USER', False) REMOTE_AUTH_BACKEND = getattr(configuration, 'REMOTE_AUTH_BACKEND', 'netbox.authentication.RemoteUserBackend') REMOTE_AUTH_DEFAULT_GROUPS = getattr(configuration, 'REMOTE_AUTH_DEFAULT_GROUPS', []) -REMOTE_AUTH_DEFAULT_PERMISSIONS = getattr(configuration, 'REMOTE_AUTH_DEFAULT_PERMISSIONS', []) +REMOTE_AUTH_DEFAULT_PERMISSIONS = getattr(configuration, 'REMOTE_AUTH_DEFAULT_PERMISSIONS', {}) REMOTE_AUTH_ENABLED = getattr(configuration, 'REMOTE_AUTH_ENABLED', False) REMOTE_AUTH_HEADER = getattr(configuration, 'REMOTE_AUTH_HEADER', 'HTTP_REMOTE_USER') RELEASE_CHECK_URL = getattr(configuration, 'RELEASE_CHECK_URL', None) @@ -127,6 +127,17 @@ if RELEASE_CHECK_URL: if RELEASE_CHECK_TIMEOUT < 3600: raise ImproperlyConfigured("RELEASE_CHECK_TIMEOUT has to be at least 3600 seconds (1 hour)") +# TODO: Remove in v2.10 +# Backward compatibility for REMOTE_AUTH_DEFAULT_PERMISSIONS +if type(REMOTE_AUTH_DEFAULT_PERMISSIONS) is not dict: + try: + REMOTE_AUTH_DEFAULT_PERMISSIONS = {perm: None for perm in REMOTE_AUTH_DEFAULT_PERMISSIONS} + warnings.warn( + "REMOTE_AUTH_DEFAULT_PERMISSIONS should be a dictionary. Backward compatibility will be removed in v2.10." + ) + except TypeError: + raise ImproperlyConfigured("REMOTE_AUTH_DEFAULT_PERMISSIONS must be a dictionary.") + # # Database