From 0abdf2053394d30495c2d8643ee0fcfafb785b3e Mon Sep 17 00:00:00 2001
From: Benjamin Dauvergne <bdauvergne@entrouvert.com>
Date: Fri, 4 Dec 2015 17:35:47 +0100
Subject: [PATCH 1/3] add helper method to test if user attributes are IdP
 managed (#9210)

---
 wcs/admin/users.py      | 11 ++++++-----
 wcs/qommon/ident/idp.py |  3 +++
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/wcs/admin/users.py b/wcs/admin/users.py
index f45b1cc..ab54e66 100644
--- a/wcs/admin/users.py
+++ b/wcs/admin/users.py
@@ -25,6 +25,7 @@ from qommon.backoffice.listing import pagination_links
 from wcs.roles import Role
 
 import qommon.ident
+from qommon.ident.idp import is_idp_managing_user_attributes
 from qommon.form import *
 from qommon.admin.emails import EmailsDirectory
 from qommon.backoffice.menu import html_top
@@ -41,7 +42,7 @@ class UserUI(object):
         form = Form(enctype='multipart/form-data')
         # do not display user attribute fields if the site has been set to get
         # them filled by SAML requests
-        if not get_cfg('sp', {}).get('idp-manage-user-attributes', False):
+        if not is_idp_managing_user_attributes():
             formdef = get_publisher().user_class.get_formdef()
             if not formdef or not users_cfg.get('field_name'):
                 form.add(StringWidget, 'name', title = _('Name'), required = True, size=30,
@@ -79,7 +80,7 @@ class UserUI(object):
             widget = form.get_widget(f)
             if widget:
                 setattr(self.user, f, widget.parse())
-        if not get_cfg('sp', {}).get('idp-manage-user-attributes', False):
+        if not is_idp_managing_user_attributes():
             formdef = get_publisher().user_class.get_formdef()
             if formdef:
                 data = formdef.get_data(form)
@@ -213,7 +214,7 @@ class UserPage(Directory):
         r = TemplateIO(html=True)
         r += htmltext('<ul id="sidebar-actions">')
 
-        if get_cfg('sp', {}).get('idp-manage-user-attributes'):
+        if is_idp_managing_user_attributes():
             r += htmltext('<li><a href="edit">%s</a></li>') % _('Manage Roles')
         else:
             r += htmltext('<li><a href="edit">%s</a></li>') % _('Edit')
@@ -408,7 +409,7 @@ class UsersDirectory(Directory):
         # if attributes are managed by the identity provider, do not expose
         # the possibility to create users, as only the roles field would
         # be shown, and the creation would fail on missing fields.
-        if not get_cfg('sp', {}).get('idp-manage-user-attributes', False):
+        if not is_idp_managing_user_attributes():
             r += htmltext("""<ul id="sidebar-actions">
               <li><a class="new-item" href="new">%s</a></li>
             </ul>""") % _('New User')
@@ -469,7 +470,7 @@ class UsersDirectory(Directory):
         if ident_methods == ['idp'] and len(get_cfg('idp', {}).items()) == 0:
             return error_page('users',
                     _('SAML support must be setup before creating users.'))
-        if get_cfg('sp', {}).get('idp-manage-user-attributes', False):
+        if is_idp_managing_user_attributes():
             raise errors.TraversalError()
 
         # XXX: user must be logged in to get here
diff --git a/wcs/qommon/ident/idp.py b/wcs/qommon/ident/idp.py
index 1f7d578..11ba1c6 100644
--- a/wcs/qommon/ident/idp.py
+++ b/wcs/qommon/ident/idp.py
@@ -49,6 +49,9 @@ import qommon.saml2utils as saml2utils
 
 ADMIN_TITLE = N_('SAML2')
 
+def is_idp_managing_user_attributes():
+    return get_cfg('sp', {}).get('idp-manage-user-attributes', False)
+
 def get_file_content(filename):
     try:
         return open(filename,'r').read()
-- 
2.1.4