Commit Graph

145 Commits

Author SHA1 Message Date
Ryan Petrello
c3bda8e259 properly detect settings.AUTHENTICATION_BACKEND changes for SSO logins
see: https://github.com/ansible/tower/issues/1979
2018-06-12 15:24:09 -04:00
Ryan Petrello
28a42850a2 allow AUTH_LDAP_USER_FLAGS_BY_GROUP to specify an OR'd list for a flag
see: https://github.com/ansible/tower/issues/968
2018-05-23 14:45:46 -04:00
chris meyers
04767641af isolate cache 2018-05-17 12:58:11 -04:00
adamscmRH
90308066af update radius backend for dr1.3.3 2018-04-25 15:04:46 -04:00
adamscmRH
3627c713fa fix multiple auth backends 2018-04-20 13:34:51 -04:00
AlanCoding
8ea323895a fix conditional LDAP test fail
Previously, if the main unit tests, test_common.py was
run before running this test, it would fail.
By clearing the cache at the start of the test, we
make its behavior consistent and predictable no
matter what other tests are also being ran,
and the assertion is adjusted to match.
2018-04-16 07:53:44 -04:00
chris meyers
00cd6cb384 set better defaults for ldap
* LDAP params is a new field. It contains the kwargs that will be passed
to the python class specified by group type. The default for group type
is MemberDNGroupType. The required params are now those in the defaults.
2018-04-10 15:44:08 -04:00
chris meyers
dc46a732bc fix ldap group type params label
* copy pasted ldap group type label and did no previously update. This
updates.
2018-03-28 09:12:06 -04:00
chris meyers
b9b8502738 introspect ldap group types for param validation
* Instead of keeping a hard-coded mapping of valid args for each ldap
group type; introspect the subclass to determine valid/invalid fields
2018-03-26 11:40:49 -04:00
chris meyers
1c578cdd74 validate group type params 2018-03-21 09:13:08 -04:00
chris meyers
17795f82e8 more parameters 2018-03-21 09:13:08 -04:00
chris meyers
e3c362956d add ldap group type like posixGroupType
* Adds pattern to easy add django-auth-ldap group types classes and to
pass parameters via AUTH_LDAP_GROUP_TYPE_PARAMS
* Adds new group type PosixUIDGroupType that accepts the attribute,
ldap_group_user_attr, on which to search for the user(s) in the group.
2018-03-21 09:13:08 -04:00
adamscmRH
310f37dd37 clears authtoken & add PAT 2018-02-22 15:18:12 -05:00
Aaron Tan
1c2621cd60 Implement session-based and OAuth 2 authentications
Relates #21. Please see acceptance docs for feature details.

Signed-off-by: Aaron Tan <jangsutsr@gmail.com>
2018-02-22 15:18:12 -05:00
cclauss
2e623ad80c Change unicode() --> six.text_type() for Python 3 2018-02-11 21:09:12 +01:00
cclauss
c371b869dc basestring to six.string_types for Python 3 2018-02-09 16:28:36 +01:00
Jake McDermott
3d421cc595 Merge pull request #1078 from jakemcdermott/saml-ldap-updates
update configuration views for multiple LDAP servers, SAML 2FA, and SAML attribute mapping
2018-02-02 12:15:44 -05:00
John Eismeier
026cbeb018 Propose small spelling changes 2018-02-02 10:49:55 -05:00
Ryan Petrello
81af34fce3 fix a bug which causes /api/v2/auth/ to list disabled auth backends
see: https://github.com/ansible/awx/issues/1073
2018-01-30 16:20:29 -05:00
Jake McDermott
44d223b6c9 add fields for team and organization saml attribute mappings 2018-01-30 00:27:51 -05:00
Chris Meyers
2b1d2b2976 Merge pull request #805 from chrismeyersfsu/feature-saml_import_attr
allow for saml attributes to define team and org
2018-01-15 11:57:05 -05:00
Chris Meyers
2ed97aeb0c implement multiple ldap servers 2018-01-11 09:03:14 -05:00
Chris Meyers
0a9d3d47b9 more efficiently determine saml team mapping 2018-01-09 12:16:07 -05:00
Chris Meyers
9d58b15135 allow for saml attributes to define team and org
related to https://github.com/ansible/awx/issues/217

* Adds a configure tower in tower setting for users to configure a saml
attribute that tower will use to put users into teams and orgs.
2018-01-04 15:35:11 -05:00
Matthew Jones
9dbcc5934e Merge remote-tracking branch 'tower/release_3.2.2' into devel 2017-12-13 12:25:47 -05:00
Chris Meyers
1899795d08 Merge pull request #721 from chrismeyersfsu/feature-2_factor
allow support for saml + 2-factor
2017-11-29 14:54:57 -05:00
Joachim Jablon
6609f38fa2 Fix import of social_core.exceptions in sso/pipeline.py
Signed-off-by: Joachim Jablon <ewjoachim@gmail.com>
2017-11-29 14:08:58 +01:00
Bill Nottingham
8cede51bac Remove stray quote from help string. 2017-11-28 14:32:39 -05:00
Chris Meyers
383c3cfe3e add more saml fields 2017-11-28 13:49:35 -05:00
Chris Meyers
98f2d936d9 allow support for saml + 2-factor
* python-social-auth has SOCIAL_AUTH_SAML_SECURITY_CONFIG, which is
forwarded to python-saml settings configuration. This commit exposes
SOCIAL_AUTH_SAML_SECURITY_CONFIG to configure tower in tower to allow
users to set requestedAuthnContext, which will disable the requesting of
password type auth from the idp. Thus, it's up to the idp to choose
which auth to use (i.e. 2-factor).
2017-11-17 09:25:50 -05:00
Wayne Witzel III
f118e27047 Flake8 fixes and URL updates 2017-11-10 17:04:33 -05:00
Wayne Witzel III
6d6bbbb627 Update URL strucuture, fixed string based calls 2017-11-09 17:24:04 -05:00
Chris Church
0f8e073d10 Allow non-FQDN for AUTH_LDAP_SERVER_URI. 2017-11-01 12:51:41 -04:00
Bill Nottingham
89d0f90e27 Add system auditor placeholder. 2017-11-01 10:46:39 -04:00
Wayne Witzel III
38c2ea7025 use getattr in social auth django strategy 2017-10-18 10:20:44 -04:00
Aaron Tan
9dd4c7aaa3 Add extra encoding to ldap_dn verification
Relates #391.

Upstream `python-ldap` (surprisingly) does not support utf-8 DN. So
explicit encoding is needed.

Signed-off-by: Aaron Tan <jangsutsr@gmail.com>
2017-10-11 12:28:26 -04:00
Matthew Jones
6fa283fc98 Merge branch 'release_3.2.0' into devel
* release_3.2.0: (66 commits)
  fix workflow maker lookup issues
  adding extra logic check for ansible_facts in smart search
  adding "admin_role" as a default query param for insights cred lookup
  changing insights cred lookup to not use hard coded cred type
  fix rounding of capacity percentage
  Catch potential unicode errors when looking up addrinfo
  fixing typo with adding query params for instance groups modal
  move percentage capacitty to variable
  Add unit test for inventory_sources_already_updated
  Check for inventory sources already updated from start args
  Fixed inventory completed jobs pagination bug by setting default page size
  Remove the logic blocking dependent inventory updates on callbacks
  fix instance group percentage
  Remove host-filter-modal import
  Fix partial hover highlight of host filter modal row
  Removed leading slash on basePath
  Fixed host nested groups pagination
  Added trailing slash to basePath
  Fixed nested groups pagination
  Fixed host_filter searching related fields
  ...
2017-10-10 16:09:43 -04:00
Chris Church
c067788428 Support dash in LDAP attribute names in filters. 2017-10-10 14:38:49 -04:00
Aaron Tan
cc8b115c6a Fix SAML auth behind load balancer issue.
Relates to #7586 of ansible-tower as a follow-up of fix #420 of tower.

The original fix works for Django version 1.9 and above, this PR
expanded the solution to Django verison 1.8 and below.

Signed-off-by: Aaron Tan <jangsutsr@gmail.com>
2017-10-10 14:38:47 -04:00
Ryan Petrello
b372cebf8d fix a bug when Tower is integrated with ipsilon SAML server
https://github.com/ansible/ansible-tower/issues/6683
2017-10-10 14:38:46 -04:00
Ryan Petrello
7a21a45781 properly encode LDAP DN values on validation
see: https://github.com/ansible/ansible-tower/issues/7554
2017-10-10 14:38:43 -04:00
Ryan Petrello
f2f42c2c8a don't append to the activity stream on LDAP group disassociate
for organizations w/ a large number of ldap orgs/teams, this results in
a _huge_ number of extraneous activity stream entries

see: https://github.com/ansible/ansible-tower/issues/7655
2017-10-10 14:38:18 -04:00
Aaron Tan
9bae656676 Restore SAML enterprise user auth logic
Connect #7666 of ansible-tower and follow up original fix tower #455.
The original fix solves the problem of duplicated db keys, but breaks a
rule of enterprise users that 'Enterprise users cannot be
created/authenticated if non-enterprise users with the same name has
already been created in Tower.'. This fix resumes that rule.

Signed-off-by: Aaron Tan <jangsutsr@gmail.com>
2017-09-26 09:51:42 -04:00
Julen Landa Alustiza
50b4002280 Fix broken link on LDAP group type help text
Signed-off-by: Julen Landa Alustiza <julen@zokormazo.info>
2017-09-25 23:43:41 +02:00
Wayne Witzel III
39cc427668 get_or_create already saves, no need to call again 2017-09-22 16:25:55 -04:00
Wayne Witzel III
e9e027ecd7 Fix issue when the enterprise_auth has already been created 2017-09-22 15:58:39 -04:00
Aaron Tan
93341d6108 Revert "Add Tower Configuration setting AUTH_LDAP_GROUP_TYPE_MEMBER_ATTR" 2017-09-22 09:48:32 -04:00
Wayne Witzel III
bab4cbbcf7 just fall through to the DjangoStrategy constructor 2017-09-20 08:50:39 -04:00
Matvey Kruglov
4c7c1aa8b3 Fix typo in AWXDjangoStrategy constructor
Signed-off-by: Matvey Kruglov <kubuzzzz@gmail.com>
2017-09-20 11:47:18 +03:00
Aaron Tan
d271757eba Fix issue #114
Add Tower Configuration setting AUTH_LDAP_GROUP_TYPE_MEMBER_ATTR.

Signed-off-by: Aaron Tan <jangsutsr@gmail.com>
2017-09-19 11:15:45 -04:00