mirror/netbox-community-netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2024-05-10 07:54:54 +00:00
Code Activity

Fixes #5442: Use LDAP groups to find permissions

Browse Source 
When AUTH_LDAP_FIND_GROUP_PERMS is set to true the filter to find the
users permissions is extended to search for all permissions assigned to
groups in which the LDAP user is.
This commit is contained in:
Tobias Genannt
2021-06-10 08:02:13 +02:00
parent ec5ed17860
commit 82300990ec
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
netbox/netbox/authentication.py
View File

@ -11,7 +11,7 @@ from users.models import ObjectPermission
from utilities.permissions import permission_is_exempt, resolve_permission, resolve_permission_ct from utilities.permissions import permission_is_exempt, resolve_permission, resolve_permission_ct
class ObjectPermissionBackend(ModelBackend): class ObjectPermissionMixin():
def get_all_permissions(self, user_obj, obj=None): def get_all_permissions(self, user_obj, obj=None):
if not user_obj.is_active or user_obj.is_anonymous: if not user_obj.is_active or user_obj.is_anonymous:
@ -20,13 +20,16 @@ class ObjectPermissionBackend(ModelBackend):
user_obj._object_perm_cache = self.get_object_permissions(user_obj) user_obj._object_perm_cache = self.get_object_permissions(user_obj)
return user_obj._object_perm_cache return user_obj._object_perm_cache
def get_permission_filter(self, user_obj):
return Q(users=user_obj) | Q(groups__user=user_obj)
def get_object_permissions(self, user_obj): def get_object_permissions(self, user_obj):
""" """
Return all permissions granted to the user by an ObjectPermission. Return all permissions granted to the user by an ObjectPermission.
""" """
# Retrieve all assigned and enabled ObjectPermissions # Retrieve all assigned and enabled ObjectPermissions
object_permissions = ObjectPermission.objects.filter( object_permissions = ObjectPermission.objects.filter(
Q(users=user_obj) | Q(groups__user=user_obj), self.get_permission_filter(user_obj),
enabled=True enabled=True
).prefetch_related('object_types') ).prefetch_related('object_types')
@ -86,6 +89,10 @@ class ObjectPermissionBackend(ModelBackend):
return model.objects.filter(constraints, pk=obj.pk).exists() return model.objects.filter(constraints, pk=obj.pk).exists()
class ObjectPermissionBackend(ObjectPermissionMixin, ModelBackend):
pass
class RemoteUserBackend(_RemoteUserBackend): class RemoteUserBackend(_RemoteUserBackend):
""" """
Custom implementation of Django's RemoteUserBackend which provides configuration hooks for basic customization. Custom implementation of Django's RemoteUserBackend which provides configuration hooks for basic customization.
@ -163,8 +170,15 @@ class LDAPBackend:
"Required parameter AUTH_LDAP_SERVER_URI is missing from ldap_config.py." "Required parameter AUTH_LDAP_SERVER_URI is missing from ldap_config.py."
) )
# Create a new instance of django-auth-ldap's LDAPBackend # Create a new instance of django-auth-ldap's LDAPBackend with our own ObjectPermissions
obj = LDAPBackend_() class NBLDAPBackend(ObjectPermissionMixin, LDAPBackend_):
def get_permission_filter(self, user_obj):
permission_filter = Q(users=user_obj) | Q(groups__user=user_obj)
if self.settings.FIND_GROUP_PERMS:
permission_filter = permission_filter | Q(groups__name__in=user_obj.ldap_user.group_names)
return permission_filter
obj = NBLDAPBackend()
# Read LDAP configuration parameters from ldap_config.py instead of settings.py # Read LDAP configuration parameters from ldap_config.py instead of settings.py
settings = LDAPSettings() settings = LDAPSettings()