Projet

Général

Profil

0001-idp-oidc-set-user-identifier-as-preferred-username-c.patch

Josué Kouka, 10 août 2018 17:20

Télécharger (8,46 ko)

Voir les différences: 

Subject: [PATCH] idp oidc: set user identifier as preferred username claim
 (#23900)


 .../attributes_ng/sources/django_user.py      |  2 +-
 src/authentic2_idp_oidc/admin.py              |  2 +-
 .../migrations/0011_auto_20180808_1546.py     | 39 ++++++++++++++
 tests/test_idp_oidc.py                        | 54 +++++++++++++++++--
 4 files changed, 92 insertions(+), 5 deletions(-)
 create mode 100644 src/authentic2_idp_oidc/migrations/0011_auto_20180808_1546.py
src/authentic2/attributes_ng/sources/django_user.py
76 76 
    if user.username:
77 77 
        splitted = user.username.rsplit('@', 1)
78 78 
        ctx['django_user_domain'] = splitted[1] if '@' in user.username else ''
79 
        ctx['django_user_identifier'] = splitted[0] if '@' in user.username else ''
79 
        ctx['django_user_identifier'] = splitted[0]
80 80 
    ctx['django_user_full_name'] = user.get_full_name()
81 81 
    Role = get_role_model()
82 82 
    roles = Role.objects.for_user(user)
src/authentic2_idp_oidc/admin.py
32 32 
        # values on the GET (display of the creation form)
33 33 
        if request.method == 'GET' and not obj:
34 34 
            initial.extend([
35 
                {'name': 'preferred_username', 'value': 'django_user_username', 'scopes': 'profile'},
35 
                {'name': 'preferred_username', 'value': 'django_user_identifier', 'scopes': 'profile'},
36 36 
                {'name': 'given_name', 'value': 'django_user_first_name', 'scopes': 'profile'},
37 37 
                {'name': 'family_name', 'value': 'django_user_last_name', 'scopes': 'profile'},
38 38 
                {'name': 'email', 'value': 'django_user_email', 'scopes': 'email'},
src/authentic2_idp_oidc/migrations/0011_auto_20180808_1546.py
1 
# -*- coding: utf-8 -*-
2 
from __future__ import unicode_literals
3 

  		




  
  4
  
    
from django.db import migrations

  		




  
  5
  
    

  		




  
  6
  
    

  		




  
  7
  
    
OLD_DEFAULT_CLAIMS_MAPPING = {

  		




  
  8
  
    
    'email': 'django_user_email', 'email_verified': 'django_user_email_verified',

  		




  
  9
  
    
    'family_name': 'django_user_last_name', 'given_name': 'django_user_first_name',

  		




  
  10
  
    
    'preferred_username': 'django_user_username'}

  		




  
  11
  
    

  		




  
  12
  
    

  		




  
  13
  
    
def set_oidcclient_default_preferred_username_as_identifier(apps, schema_editor):

  		




  
  14
  
    
    OIDCClient = apps.get_model('authentic2_idp_oidc', 'OIDCClient')

  		




  
  15
  
    
    OIDCClaim = apps.get_model('authentic2_idp_oidc', 'OIDCClaim')

  		




  
  16
  
    
    for oidcclient in OIDCClient.objects.all():

  		




  
  17
  
    
        claims = oidcclient.oidcclaim_set.values_list('name', 'value')

  		




  
  18
  
    
        # check if default config

  		




  
  19
  
    
        if set(OLD_DEFAULT_CLAIMS_MAPPING.items()).symmetric_difference(claims):

  		




  
  20
  
    
            continue

  		




  
  21
  
    
        pref_username_claim = OIDCClaim.objects.get(name='preferred_username', client=oidcclient)

  		




  
  22
  
    
        if pref_username_claim.value != 'django_user_identifier':

  		




  
  23
  
    
            pref_username_claim.value = 'django_user_identifier'

  		




  
  24
  
    
            pref_username_claim.save()

  		




  
  25
  
    

  		




  
  26
  
    

  		




  
  27
  
    
def unset_oidcclient_default_preferred_username_as_identifier(apps, schema_editor):

  		




  
  28
  
    
    pass

  		




  
  29
  
    

  		




  
  30
  
    

  		




  
  31
  
    
class Migration(migrations.Migration):

  		




  
  32
  
    

  		




  
  33
  
    
    dependencies = [

  		




  
  34
  
    
        ('authentic2_idp_oidc', '0010_oidcclaim'),

  		




  
  35
  
    
    ]

  		




  
  36
  
    

  		




  
  37
  
    
    operations = [

  		




  
  38
  
    
        migrations.RunPython(set_oidcclient_default_preferred_username_as_identifier, unset_oidcclient_default_preferred_username_as_identifier)

  		




  
  39
  
    
    ]

  		












  

    
      tests/test_idp_oidc.py
    
  





  11
  11
  
    
import utils

  		




  12
  12
  
    

  		




  13
  13
  
    
from django.core.urlresolvers import reverse

  		




  
  14
  
    
from django.db import connection

  		




  
  15
  
    
from django.db.migrations.executor import MigrationExecutor

  		




  14
  16
  
    
from django.utils.timezone import now

  		




  15
  17
  
    
from django.contrib.auth import get_user_model

  		




  16
  18
  
    

  		




  
  19
  
    

  		




  17
  20
  
    
User = get_user_model()

  		




  18
  21
  
    

  		




  19
  22
  
    
from authentic2_idp_oidc.models import OIDCClient, OIDCAuthorization, OIDCCode, OIDCAccessToken, OIDCClaim

  		




  ......




  856
  859
  
    

  		




  857
  860
  
    

  		




  858
  861
  
    
def test_oidclient_claims_data_migration():

  		




  859
  
  
    
    from django.db import connection

  		




  860
  
  
    
    from django.db.migrations.executor import MigrationExecutor

  		




  861
  
  
    

  		




  862
  862
  
    
    executor = MigrationExecutor(connection)

  		




  863
  863
  
    
    app = 'authentic2_idp_oidc'

  		




  864
  864
  
    
    migrate_from = [(app, '0009_auto_20180313_1156')]

  		




  ......




  877
  877
  
    
    assert OIDCClaim.objects.filter(client=client.id).count() == 5

  		




  878
  878
  
    

  		




  879
  879
  
    

  		




  
  880
  
    
def test_oidclient_preferred_username_as_identifier_data_migration():

  		




  
  881
  
    
    executor = MigrationExecutor(connection)

  		




  
  882
  
    
    app = 'authentic2_idp_oidc'

  		




  
  883
  
    
    migrate_from = [(app, '0010_oidcclaim')]

  		




  
  884
  
    
    migrate_to = [(app, '0011_auto_20180808_1546')]

  		




  
  885
  
    
    executor.migrate(migrate_from)

  		




  
  886
  
    
    executor.loader.build_graph()

  		




  
  887
  
    
    old_apps = executor.loader.project_state(migrate_from).apps

  		




  
  888
  
    
    OIDCClient = old_apps.get_model('authentic2_idp_oidc', 'OIDCClient')

  		




  
  889
  
    
    OIDCClaim = old_apps.get_model('authentic2_idp_oidc', 'OIDCClaim')

  		




  
  890
  
    
    client1 = OIDCClient.objects.create(name='test', slug='test', redirect_uris='https://example.net/')

  		




  
  891
  
    
    client2 = OIDCClient.objects.create(name='test1', slug='test1', redirect_uris='https://example.net/')

  		




  
  892
  
    
    client3 = OIDCClient.objects.create(name='test2', slug='test2', redirect_uris='https://example.net/')

  		




  
  893
  
    
    client4 = OIDCClient.objects.create(name='test3', slug='test3', redirect_uris='https://example.net/')

  		




  
  894
  
    
    for client in (client1, client2, client3, client4):

  		




  
  895
  
    
        if client.name == 'test1':

  		




  
  896
  
    
            continue

  		




  
  897
  
    
        if client.name == 'test3':

  		




  
  898
  
    
            OIDCClaim.objects.create(client=client, name='preferred_username', value='django_user_full_name', scopes='profile')

  		




  
  899
  
    
        else:

  		




  
  900
  
    
            OIDCClaim.objects.create(client=client, name='preferred_username', value='django_user_username', scopes='profile')

  		




  
  901
  
    
        OIDCClaim.objects.create(client=client, name='given_name', value='django_user_first_name', scopes='profile')

  		




  
  902
  
    
        OIDCClaim.objects.create(client=client, name='family_name', value='django_user_last_name', scopes='profile')

  		




  
  903
  
    
        if client.name == 'test2':

  		




  
  904
  
    
            continue

  		




  
  905
  
    
        OIDCClaim.objects.create(client=client, name='email', value='django_user_email', scopes='email')

  		




  
  906
  
    
        OIDCClaim.objects.create(client=client, name='email_verified', value='django_user_email_verified', scopes='email')

  		




  
  907
  
    
    executor.migrate(migrate_to)

  		




  
  908
  
    
    executor.loader.build_graph()

  		




  
  909
  
    
    client = OIDCClient.objects.first()

  		




  
  910
  
    
    for client in OIDCClient.objects.all():

  		




  
  911
  
    
        claims = client.oidcclaim_set.all()

  		




  
  912
  
    
        if client.name == 'test':

  		




  
  913
  
    
            assert claims.count() == 5

  		




  
  914
  
    
            assert sorted(claims.values_list('name', flat=True)) == [u'email', u'email_verified', u'family_name', u'given_name', u'preferred_username']

  		




  
  915
  
    
            assert sorted(claims.values_list('value', flat=True)) == [u'django_user_email', u'django_user_email_verified', u'django_user_first_name', u'django_user_identifier', u'django_user_last_name']

  		




  
  916
  
    
        elif client.name == 'test2':

  		




  
  917
  
    
            assert claims.count() == 3

  		




  
  918
  
    
            assert sorted(claims.values_list('name', flat=True)) == [u'family_name', u'given_name', u'preferred_username']

  		




  
  919
  
    
            assert sorted(claims.values_list('value', flat=True)) == [u'django_user_first_name', u'django_user_last_name', u'django_user_username']

  		




  
  920
  
    
        elif client.name == 'test3':

  		




  
  921
  
    
            assert claims.count() == 5

  		




  
  922
  
    
            assert sorted(claims.values_list('name', flat=True)) == [u'email', u'email_verified', u'family_name', u'given_name', u'preferred_username']

  		




  
  923
  
    
            assert sorted(claims.values_list('value', flat=True)) == [u'django_user_email', u'django_user_email_verified', u'django_user_first_name', u'django_user_full_name', u'django_user_last_name']

  		




  
  924
  
    
        else:

  		




  
  925
  
    
            assert claims.count() == 0

  		




  
  926
  
    

  		




  
  927
  
    

  		




  880
  928
  
    
def test_api_synchronization(app, oidc_client):

  		




  881
  929
  
    
    oidc_client.has_api_access = True

  		




  882
  930
  
    
    oidc_client.save()

  		




  883
  
  
    
-