From 8c4204b8421763371c253a82707d60c65e860264 Mon Sep 17 00:00:00 2001 From: Benjamin Dauvergne Date: Tue, 19 May 2015 15:30:54 +0200 Subject: [PATCH] saml2: set user roles from the SAML attribute "role-slug" (#7281) --- wcs/qommon/saml2.py | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/wcs/qommon/saml2.py b/wcs/qommon/saml2.py index 35534dc..012d65a 100644 --- a/wcs/qommon/saml2.py +++ b/wcs/qommon/saml2.py @@ -35,6 +35,7 @@ import misc from publisher import get_cfg, get_logger from qommon import template from template import error_page +from wcs.roles import Role import errors @@ -462,6 +463,25 @@ class Saml2Directory(Directory): user.form_data[field_id] = d[key] logger.info('setting field %s of user %s to value %r', field_id, user.id, d[key]) save = True + + # update user roles from role-slug or wipe them if + # idp-manage-user-attributes is True + if 'role-slug' in m: + role_ids = [] + for slug in m['role-slug']: + role = Role.get_on_index(slug, 'slug', ignore_errors=True) + if not role: + continue + role_ids.append(role.id) + if set(user.roles) != set(role_ids): + user.roles = role_ids + save = True + else: + sp_cfg = get_cfg('sp', {}) + if sp_cfg.get('idp-manage-user-attributes') and user.roles: + user.roles = [] + save = True + if save: user.store() -- 2.1.4