Projet

Général

Profil

0001-misc-prevent-cleaning-of-unused-LDAP-and-OIDC-accoun.patch

Benjamin Dauvergne, 06 octobre 2020 13:50

Télécharger (5,61 ko)

Voir les différences: 

Subject: [PATCH] misc: prevent cleaning of unused LDAP and OIDC accounts
 (#47387)


 .../commands/clean-unused-accounts.py         | 12 +++++-
 tests/test_commands.py                        | 40 ++++++++++++++-----
 2 files changed, 42 insertions(+), 10 deletions(-)
src/authentic2/management/commands/clean-unused-accounts.py
27 27 
from django.utils.six.moves.urllib import parse as urlparse
28 28 
from django_rbac.utils import get_ou_model
29 29 

  		




  
  30
  
    
from authentic2.backends.ldap_backend import LDAPBackend

  		




  30
  31
  
    
from authentic2.utils import send_templated_mail

  		




  31
  32
  
    

  		




  32
  33
  
    
from django.conf import settings

  		




  ......




  61
  62
  
    
            logger.propagate = False

  		




  62
  63
  
    

  		




  63
  64
  
    
        self.now = timezone.now()

  		




  
  65
  
    

  		




  
  66
  
    
        # exclude user from LDAP directories based on their source name (or realm)

  		




  
  67
  
    
        realms = [block['realm'] for block in LDAPBackend.get_config() if block.get('realm')]

  		




  
  68
  
    
        self.user_qs = (

  		




  
  69
  
    
            User.objects.all()

  		




  
  70
  
    
            .exclude(oidc_account__isnull=False)

  		




  
  71
  
    
            .exclude(userexternalid__source__in=realms)

  		




  
  72
  
    
        )

  		




  
  73
  
    

  		




  64
  74
  
    
        translation.activate(settings.LANGUAGE_CODE)

  		




  65
  75
  
    
        try:

  		




  66
  76
  
    
            self.clean_unused_accounts()

  		




  ......




  71
  81
  
    
        for ou in get_ou_model().objects.filter(clean_unused_accounts_alert__isnull=False):

  		




  72
  82
  
    
            alert_delay = timedelta(days=ou.clean_unused_accounts_alert)

  		




  73
  83
  
    
            deletion_delay = timedelta(days=ou.clean_unused_accounts_deletion)

  		




  74
  
  
    
            ou_users = User.objects.filter(ou=ou)

  		




  
  84
  
    
            ou_users = self.user_qs.filter(ou=ou)

  		




  75
  85
  
    

  		




  76
  86
  
    
            # reset last_account_deletion_alert for users which connected since last alert

  		




  77
  87
  
    
            active_users = ou_users.filter(last_login__gte=F('last_account_deletion_alert'))

  		












  

    
      tests/test_commands.py
    
  





  26
  26
  
    
import py

  		




  27
  27
  
    

  		




  28
  28
  
    
from authentic2.a2_rbac.utils import get_default_ou

  		




  29
  
  
    
from authentic2_auth_oidc.models import OIDCProvider

  		




  
  29
  
    
from authentic2.models import UserExternalId

  		




  
  30
  
    
from authentic2_auth_oidc.models import OIDCProvider, OIDCAccount

  		




  30
  31
  
    
from django_rbac.models import ADMIN_OP

  		




  31
  32
  
    
from django_rbac.models import Operation

  		




  32
  33
  
    
from django_rbac.utils import get_operation

  		




  ......




  37
  38
  
    

  		




  38
  39
  
    
from .utils import login, call_command

  		




  39
  40
  
    

  		




  
  41
  
    
User = get_user_model()

  		




  
  42
  
    

  		




  40
  43
  
    
if six.PY2:

  		




  41
  44
  
    
    FileType = file  # noqa: F821

  		




  42
  45
  
    
else:

  		




  ......




  57
  60
  
    
    assert old_pass != simple_user.password

  		




  58
  61
  
    

  		




  59
  62
  
    

  		




  60
  
  
    
def test_clean_unused_account(db, simple_user, mailoutbox, freezer):

  		




  
  63
  
    
def test_clean_unused_account(db, simple_user, mailoutbox, freezer, settings):

  		




  
  64
  
    
    settings.LDAP_AUTH_SETTINGS = [{'realm': 'ldap', 'url': 'ldap://ldap.com/', 'basedn': 'dc=ldap,dc=com'}]

  		




  
  65
  
    
    ldap_user = User.objects.create(username='ldap-user',

  		




  
  66
  
    
                                    email='ldap-user@example.com',

  		




  
  67
  
    
                                    ou=simple_user.ou)

  		




  
  68
  
    
    oidc_user = User.objects.create(username='oidc-user',

  		




  
  69
  
    
                                    email='oidc-user@example.com',

  		




  
  70
  
    
                                    ou=simple_user.ou)

  		




  
  71
  
    
    UserExternalId.objects.create(user=ldap_user, source='ldap',

  		




  
  72
  
    
                                  external_id='whatever')

  		




  
  73
  
    
    provider = OIDCProvider.objects.create(name='oidc', ou=simple_user.ou)

  		




  
  74
  
    
    OIDCAccount.objects.create(user=oidc_user, provider=provider, sub='1')

  		




  
  75
  
    

  		




  61
  76
  
    
    email = simple_user.email

  		




  62
  77
  
    
    freezer.move_to('2018-01-01')

  		




  63
  78
  
    
    simple_user.ou.clean_unused_accounts_alert = 2

  		




  64
  79
  
    
    simple_user.ou.clean_unused_accounts_deletion = 3

  		




  65
  80
  
    
    simple_user.ou.save()

  		




  66
  81
  
    

  		




  67
  
  
    
    simple_user.last_login = now() - datetime.timedelta(days=2)

  		




  68
  
  
    
    simple_user.save()

  		




  
  82
  
    
    last_login = now() - datetime.timedelta(days=2, seconds=30)

  		




  
  83
  
    
    for user in (simple_user, ldap_user, oidc_user):

  		




  
  84
  
    
        user.last_login = last_login

  		




  
  85
  
    
        user.save()

  		




  69
  86
  
    

  		




  70
  87
  
    
    call_command('clean-unused-accounts')

  		




  71
  
  
    
    simple_user.refresh_from_db()

  		




  72
  
  
    
    assert not simple_user.deleted

  		




  
  88
  
    

  		




  
  89
  
    
    for user in (simple_user, ldap_user, oidc_user):

  		




  
  90
  
    
        user.refresh_from_db()

  		




  
  91
  
    
        assert not simple_user.deleted

  		




  73
  92
  
    
    assert len(mailoutbox) == 1

  		




  74
  93
  
    

  		




  75
  94
  
    
    freezer.move_to('2018-01-01 12:00:00')

  		




  76
  95
  
    
    # no new mail, no deletion

  		




  77
  96
  
    
    call_command('clean-unused-accounts')

  		




  78
  
  
    
    simple_user.refresh_from_db()

  		




  79
  
  
    
    assert not simple_user.deleted

  		




  
  97
  
    
    for user in (simple_user, ldap_user, oidc_user):

  		




  
  98
  
    
        user.refresh_from_db()

  		




  
  99
  
    
        assert not simple_user.deleted

  		




  80
  100
  
    
    assert len(mailoutbox) == 1

  		




  81
  101
  
    

  		




  82
  102
  
    
    freezer.move_to('2018-01-02')

  		




  83
  103
  
    
    call_command('clean-unused-accounts')

  		




  
  104
  
    
    for user in (ldap_user, oidc_user):

  		




  
  105
  
    
        user.refresh_from_db()

  		




  
  106
  
    
        assert not simple_user.deleted

  		




  84
  107
  
    
    simple_user.refresh_from_db()

  		




  85
  108
  
    
    assert simple_user.deleted

  		




  86
  109
  
    
    assert len(mailoutbox) == 2

  		




  ......




  318
  341
  
    
    settings.A2_EMAIL_IS_UNIQUE = False

  		




  319
  342
  
    
    settings.A2_USERNAME_IS_UNIQUE = False

  		




  320
  343
  
    

  		




  321
  
  
    
    User = get_user_model()

  		




  322
  344
  
    
    user1 = User.objects.create(

  		




  323
  345
  
    
            username='foo', email='foo@example.net',

  		




  324
  346
  
    
            first_name='Toto', last_name='Foo')

  		




  325
  
  
    
-