0001-journal_event_types-add-ldap-user-deactivation-52671.patch

Valentin Deniaud, 20 mai 2021 15:09

Voir les différences: en ligne côte à côte

Subject: [PATCH] journal_event_types: add ldap user deactivation (#52671)

 src/authentic2/backends/ldap_backend.py       |  6 ++++
 src/authentic2/manager/journal_event_types.py | 24 ++++++++++---
 tests/test_ldap.py                            | 20 ++++++++---
 tests/test_manager_journal.py                 | 34 +++++++++++++++++++
 tests/utils.py                                |  4 ++-
 5 files changed, 79 insertions(+), 9 deletions(-)

     from authentic2.backends import is_user_authenticable
     from authentic2.compat_lasso import lasso
     from authentic2.ldap_utils import FilterFormatter
     from authentic2.manager.journal_event_types import ManagerUserDeactivation
     from authentic2.middleware import StoreRequestMiddleware
     from authentic2.models import UserExternalId
     from authentic2.user_login_failure import user_login_failure, user_login_success
-...
                 conn = cls.get_connection(block)
                 if conn is None:
                     continue
                 ldap_uri = conn.get_option(ldap.OPT_URI)
                 eids = list(
                     UserExternalId.objects.filter(user__is_active=True, source=block['realm']).values_list(
                         'external_id', flat=True
-...
                     external_id__in=eids, user__is_active=True, source=block['realm']
                 ):
                     eid.user.mark_as_inactive()
                     ManagerUserDeactivation.record(
                         target_user=eid.user, reason='ldap-not-present', origin=ldap_uri
+                    )
             # Handle users of old sources
             uei_qs = UserExternalId.objects.exclude(source__in=[block['realm'] for block in cls.get_config()])
             for user in User.objects.filter(userexternalid__in=uei_qs):
                 user.mark_as_inactive()
                 ManagerUserDeactivation.record(target_user=user, reason='ldap-old-source', origin=ldap_uri)
         @classmethod
         def ad_encoding(cls, s):

         label = _('user deactivation')
         @classmethod
         def record(cls, user, session, target_user):
             super().record(user=user, session=session, references=[target_user])
         def record(cls, target_user, user=None, session=None, origin='backoffice', reason=None):
             data = {'reason': reason, 'origin': origin}
             super().record(user=user, session=session, references=[target_user], data=data)
         @classmethod
         def get_message(cls, event, context):
             (user,) = event.get_typed_references(User)
             reason = event.get_data('reason')
             if context and context == user:
                 return _('deactivation by administrator')
                 if reason == 'ldap-not-present':
                     return _('automatic deactivation because the associated LDAP account does not exist anymore')
                 elif reason == 'ldap-old-source':
                     return _('automatic deactivation because the associated LDAP source has been deleted')
                 else:
                     return _('deactivation by administrator')
             elif user:
                 return _('deactivation of user "%s"') % user.get_full_name()
                 if reason == 'ldap-not-present':
                     return _(
                         'automatic deactivation of user "%s" because the associated LDAP account does not exist anymore'
+                    )
                 elif reason == 'ldap-old-source':
                     return _(
                         'automatic deactivation of user "%s" because the associated LDAP source has been deleted'
+                    )
                 else:
                     return _('deactivation of user "%s"') % user.get_full_name()
             return super().get_message(event, context)

         ldap_backend.LDAPBackend.deactivate_orphaned_users()
         assert (
             ldap_backend.UserExternalId.objects.filter(user__is_active=False, source=block['realm']).count() == 1
         deactivated_user = ldap_backend.UserExternalId.objects.get(user__is_active=False, source=block['realm'])
         utils.assert_event(
             'manager.user.deactivation',
             target_user=deactivated_user.user,
             reason='ldap-not-present',
             origin=slapd.ldap_url,
+        )
         # rename source realm
-...
+        ]
         ldap_backend.LDAPBackend.deactivate_orphaned_users()
         assert (
             ldap_backend.UserExternalId.objects.filter(user__is_active=False, source=block['realm']).count() == 6
         deactivated_users = ldap_backend.UserExternalId.objects.filter(
             user__is_active=False, source=block['realm']
+        )
         assert deactivated_users.count() == 6
         for ldap_user in deactivated_users.exclude(pk=deactivated_user.pk):
             utils.assert_event(
                 'manager.user.deactivation',
                 target_user=ldap_user.user,
                 reason='ldap-old-source',
                 origin=slapd.ldap_url,
+            )
     @pytest.mark.django_db

             old_email='old@example.com',
             new_email='new@example.com',
+        )
         make(
             'manager.user.deactivation',
             target_user=user,
             reason='ldap-not-present',
+        )
         make(
             'manager.user.deactivation',
             target_user=user,
             reason='ldap-old-source',
+        )
         # verify we created at least one event for each type
         assert set(Event.objects.values_list("type__name", flat=True)) == set(_registry)
-...
                 'type': 'user.email.change',
                 'user': 'Johnny doe',
             },
+            {
                 'timestamp': 'Jan. 2, 2020, 5 p.m.',
                 'type': 'manager.user.deactivation',
                 'user': '-',
                 'message': 'automatic deactivation of user "%s" because the associated LDAP account does not exist anymore',
             },
+            {
                 'timestamp': 'Jan. 2, 2020, 6 p.m.',
                 'type': 'manager.user.deactivation',
                 'user': '-',
                 'message': 'automatic deactivation of user "%s" because the associated LDAP source has been deleted',
             },
+        ]
-...
                 'type': 'user.email.change',
                 'user': 'Johnny doe',
             },
+            {
                 'timestamp': 'Jan. 2, 2020, 5 p.m.',
                 'type': 'manager.user.deactivation',
                 'user': '-',
                 'message': 'automatic deactivation because the associated LDAP account does not exist anymore',
             },
+            {
                 'timestamp': 'Jan. 2, 2020, 6 p.m.',
                 'type': 'manager.user.deactivation',
                 'user': '-',
                 'message': 'automatic deactivation because the associated LDAP source has been deleted',
             },
+        ]

         return ''.join(node.itertext()) if node is not None else ''
     def assert_event(event_type_name, user=None, session=None, service=None, **data):
     def assert_event(event_type_name, user=None, session=None, service=None, target_user=None, **data):
         qs = Event.objects.filter(type__name=event_type_name)
         if user:
             qs = qs.filter(user=user)
-...
             qs = qs.which_references(service)
         else:
             qs = qs.exclude(qs._which_references_query(models.Service))
         if target_user:
             qs = qs.which_references(target_user)
         assert qs.count() == 1
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0001-journal_event_types-add-ldap-user-deactivation-52671.patch