mirror of
https://github.com/ansible/awx.git
synced 2026-09-05 03:18:29 -02:30
Configure Tower in Tower:
* Add separate Django app for configuration: awx.conf. * Migrate from existing main.TowerSettings model to conf.Setting. * Add settings wrapper to allow get/set/del via django.conf.settings. * Update existing references to tower_settings to use django.conf.settings. * Add a settings registry to allow for each Django app to register configurable settings. * Support setting validation and conversion using Django REST Framework fields. * Add /api/v1/settings/ to display a list of setting categories. * Add /api/v1/settings/<slug>/ to display all settings in a category as a single object. * Allow PUT/PATCH to update setting singleton, DELETE to reset to defaults. * Add "all" category to display all settings across categories. * Add "changed" category to display only settings configured in the database. * Support per-user settings via "user" category (/api/v1/settings/user/). * Support defaults for user settings via "user-defaults" category (/api/v1/settings/user-defaults/). * Update serializer metadata to support category, category_slug and placeholder on OPTIONS responses. * Update serializer metadata to handle child fields of a list/dict. * Hide raw data form in browsable API for OPTIONS and DELETE. * Combine existing licensing code into single "TaskEnhancer" class. * Move license helper functions from awx.api.license into awx.conf.license. * Update /api/v1/config/ to read/verify/update license using TaskEnhancer and settings wrapper. * Add support for caching settings accessed via settings wrapper. * Invalidate cached settings when Setting model changes or is deleted. * Preload all database settings into cache on first access via settings wrapper. * Add support for read-only settings than can update their value depending on other settings. * Use setting_changed signal whenever a setting changes. * Register configurable authentication, jobs, system and ui settings. * Register configurable LDAP, RADIUS and social auth settings. * Add custom fields and validators for URL, LDAP, RADIUS and social auth settings. * Rewrite existing validator for Credential ssh_private_key to support validating private keys, certs or combinations of both. * Get all unit/functional tests working with above changes. * Add "migrate_to_database_settings" command to determine settings to be migrated into the database and comment them out when set in Python settings files. * Add support for migrating license key from file to database. * Remove database-configuable settings from local_settings.py example files. * Update setup role to no longer install files for database-configurable settings. f 94ff6ee More settings work. f af4c4e0 Even more db settings stuff. f 96ea9c0 More settings, attempt at singleton serializer for settings. f 937c760 More work on singleton/category views in API, add code to comment out settings in Python files, work on command to migrate settings to database. f 425b0d3 Minor fixes for sprint demo. f ea402a4 Add support for read-only settings, cleanup license engine, get license support working with DB settings. f ec289e4 Rename migration, minor fixmes, update setup role. f 603640b Rewrite key/cert validator, finish adding social auth fields, hook up signals for setting_changed, use None to imply a setting is not set. f 67d1b5a Get functional/unit tests passing. f 2919b62 Flake8 fixes. f e62f421 Add redbaron to requirements, get file to database migration working (except for license). f c564508 Add support for migrating license file. f 982f767 Add support for regex in social map fields.
This commit is contained in:
Chris Church
@@ -116,6 +116,7 @@ LOG_ROOT = os.path.join(BASE_DIR)
|
||||
SCHEDULE_METADATA_LOCATION = os.path.join(BASE_DIR, '.tower_cycle')
|
||||
|
||||
# Maximum number of the same job that can be waiting to run when launching from scheduler
|
||||
# Note: This setting may be overridden by database settings.
|
||||
SCHEDULE_MAX_JOBS = 10
|
||||
|
||||
SITE_ID = 1
|
||||
@@ -132,6 +133,7 @@ ALLOWED_HOSTS = []
|
||||
# reverse proxy.
|
||||
REMOTE_HOST_HEADERS = ['REMOTE_ADDR', 'REMOTE_HOST']
|
||||
|
||||
# Note: This setting may be overridden by database settings.
|
||||
STDOUT_MAX_BYTES_DISPLAY = 1048576
|
||||
|
||||
TEMPLATE_CONTEXT_PROCESSORS = ( # NOQA
|
||||
@@ -190,6 +192,7 @@ INSTALLED_APPS = (
|
||||
'polymorphic',
|
||||
'taggit',
|
||||
'social.apps.django_app.default',
|
||||
'awx.conf',
|
||||
'awx.main',
|
||||
'awx.api',
|
||||
'awx.ui',
|
||||
@@ -242,28 +245,34 @@ AUTHENTICATION_BACKENDS = (
|
||||
)
|
||||
|
||||
# LDAP server (default to None to skip using LDAP authentication).
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AUTH_LDAP_SERVER_URI = None
|
||||
|
||||
# Disable LDAP referrals by default (to prevent certain LDAP queries from
|
||||
# hanging with AD).
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AUTH_LDAP_CONNECTION_OPTIONS = {
|
||||
ldap.OPT_REFERRALS: 0,
|
||||
}
|
||||
|
||||
# Radius server settings (default to empty string to skip using Radius auth).
|
||||
# Note: These settings may be overridden by database settings.
|
||||
RADIUS_SERVER = ''
|
||||
RADIUS_PORT = 1812
|
||||
RADIUS_SECRET = ''
|
||||
|
||||
# Seconds before auth tokens expire.
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AUTH_TOKEN_EXPIRATION = 1800
|
||||
|
||||
# Maximum number of per-user valid, concurrent tokens.
|
||||
# -1 is unlimited
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AUTH_TOKEN_PER_USER = -1
|
||||
|
||||
# Enable / Disable HTTP Basic Authentication used in the API browser
|
||||
# Note: Session limits are not enforced when using HTTP Basic Authentication.
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AUTH_BASIC_ENABLED = True
|
||||
|
||||
# If set, serve only minified JS for UI.
|
||||
@@ -407,6 +416,20 @@ SOCIAL_AUTH_PIPELINE = (
|
||||
'awx.sso.pipeline.update_user_teams',
|
||||
)
|
||||
|
||||
SOCIAL_AUTH_LOGIN_URL = '/'
|
||||
SOCIAL_AUTH_LOGIN_REDIRECT_URL = '/sso/complete/'
|
||||
SOCIAL_AUTH_LOGIN_ERROR_URL = '/sso/error/'
|
||||
SOCIAL_AUTH_INACTIVE_USER_URL = '/sso/inactive/'
|
||||
|
||||
SOCIAL_AUTH_RAISE_EXCEPTIONS = False
|
||||
SOCIAL_AUTH_USERNAME_IS_FULL_EMAIL = False
|
||||
SOCIAL_AUTH_SLUGIFY_USERNAMES = True
|
||||
SOCIAL_AUTH_CLEAN_USERNAMES = True
|
||||
|
||||
SOCIAL_AUTH_SANITIZE_REDIRECTS = True
|
||||
SOCIAL_AUTH_REDIRECT_IS_HTTPS = False
|
||||
|
||||
# Note: These settings may be overridden by database settings.
|
||||
SOCIAL_AUTH_GOOGLE_OAUTH2_KEY = ''
|
||||
SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET = ''
|
||||
SOCIAL_AUTH_GOOGLE_OAUTH2_SCOPE = ['profile']
|
||||
@@ -433,19 +456,6 @@ SOCIAL_AUTH_SAML_TECHNICAL_CONTACT = {}
|
||||
SOCIAL_AUTH_SAML_SUPPORT_CONTACT = {}
|
||||
SOCIAL_AUTH_SAML_ENABLED_IDPS = {}
|
||||
|
||||
SOCIAL_AUTH_LOGIN_URL = '/'
|
||||
SOCIAL_AUTH_LOGIN_REDIRECT_URL = '/sso/complete/'
|
||||
SOCIAL_AUTH_LOGIN_ERROR_URL = '/sso/error/'
|
||||
SOCIAL_AUTH_INACTIVE_USER_URL = '/sso/inactive/'
|
||||
|
||||
SOCIAL_AUTH_RAISE_EXCEPTIONS = False
|
||||
SOCIAL_AUTH_USERNAME_IS_FULL_EMAIL = False
|
||||
SOCIAL_AUTH_SLUGIFY_USERNAMES = True
|
||||
SOCIAL_AUTH_CLEAN_USERNAMES = True
|
||||
|
||||
SOCIAL_AUTH_SANITIZE_REDIRECTS = True
|
||||
SOCIAL_AUTH_REDIRECT_IS_HTTPS = False
|
||||
|
||||
SOCIAL_AUTH_ORGANIZATION_MAP = {}
|
||||
SOCIAL_AUTH_TEAM_MAP = {}
|
||||
|
||||
@@ -480,30 +490,37 @@ JOB_EVENT_MAX_QUEUE_SIZE = 100
|
||||
CAPTURE_JOB_EVENT_HOSTS = False
|
||||
|
||||
# Enable proot support for running jobs (playbook runs only).
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AWX_PROOT_ENABLED = False
|
||||
|
||||
# Command/path to proot.
|
||||
AWX_PROOT_CMD = 'proot'
|
||||
|
||||
# Additional paths to hide from jobs using proot.
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AWX_PROOT_HIDE_PATHS = []
|
||||
|
||||
# Additional paths to show for jobs using proot.
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AWX_PROOT_SHOW_PATHS = []
|
||||
|
||||
# Number of jobs to show as part of the job template history
|
||||
AWX_JOB_TEMPLATE_HISTORY = 10
|
||||
|
||||
# The directory in which proot will create new temporary directories for its root
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AWX_PROOT_BASE_PATH = "/tmp"
|
||||
|
||||
# User definable ansible callback plugins
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AWX_ANSIBLE_CALLBACK_PLUGINS = ""
|
||||
|
||||
# Enable Pendo on the UI, possible values are 'off', 'anonymous', and 'detailed'
|
||||
# Note: This setting may be overridden by database settings.
|
||||
PENDO_TRACKING_STATE = "off"
|
||||
|
||||
# Default list of modules allowed for ad hoc commands.
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AD_HOC_COMMANDS = [
|
||||
'command',
|
||||
'shell',
|
||||
@@ -730,6 +747,7 @@ CLOUDFORMS_INSTANCE_ID_VAR = 'id'
|
||||
# -- Activity Stream --
|
||||
# ---------------------
|
||||
# Defaults for enabling/disabling activity stream.
|
||||
# Note: These settings may be overridden by database settings.
|
||||
ACTIVITY_STREAM_ENABLED = True
|
||||
ACTIVITY_STREAM_ENABLED_FOR_INVENTORY_SYNC = False
|
||||
|
||||
@@ -745,161 +763,17 @@ SOCKETIO_LISTEN_PORT = 8080
|
||||
|
||||
FACT_CACHE_PORT = 6564
|
||||
|
||||
# Note: This setting may be overridden by database settings.
|
||||
ORG_ADMINS_CAN_SEE_ALL_USERS = True
|
||||
|
||||
# Note: This setting may be overridden by database settings.
|
||||
TOWER_ADMIN_ALERTS = True
|
||||
|
||||
# Note: This setting may be overridden by database settings.
|
||||
TOWER_URL_BASE = "https://towerhost"
|
||||
|
||||
TOWER_SETTINGS_MANIFEST = {
|
||||
"SCHEDULE_MAX_JOBS": {
|
||||
"name": "Maximum Scheduled Jobs",
|
||||
"description": "Maximum number of the same job template that can be waiting to run when launching from a schedule before no more are created",
|
||||
"default": SCHEDULE_MAX_JOBS,
|
||||
"type": "int",
|
||||
"category": "jobs",
|
||||
},
|
||||
"STDOUT_MAX_BYTES_DISPLAY": {
|
||||
"name": "Standard Output Maximum Display Size",
|
||||
"description": "Maximum Size of Standard Output in bytes to display before requiring the output be downloaded",
|
||||
"default": STDOUT_MAX_BYTES_DISPLAY,
|
||||
"type": "int",
|
||||
"category": "jobs",
|
||||
},
|
||||
"AUTH_TOKEN_EXPIRATION": {
|
||||
"name": "Idle Time Force Log Out",
|
||||
"description": "Number of seconds that a user is inactive before they will need to login again",
|
||||
"type": "int",
|
||||
"default": AUTH_TOKEN_EXPIRATION,
|
||||
"category": "authentication",
|
||||
},
|
||||
"AUTH_TOKEN_PER_USER": {
|
||||
"name": "Maximum number of simultaneous logins",
|
||||
"description": "Maximum number of simultaneous logins a user may have. To disable enter -1",
|
||||
"type": "int",
|
||||
"default": AUTH_TOKEN_PER_USER,
|
||||
"category": "authentication",
|
||||
},
|
||||
# "AUTH_BASIC_ENABLED": {
|
||||
# "name": "Enable HTTP Basic Auth",
|
||||
# "description": "Enable HTTP Basic Auth for the API Browser",
|
||||
# "default": AUTH_BASIC_ENABLED,
|
||||
# "type": "bool",
|
||||
# "category": "authentication",
|
||||
# },
|
||||
# "AUTH_LDAP_SERVER_URI": {
|
||||
# "name": "LDAP Server URI",
|
||||
# "description": "URI Location of the LDAP Server",
|
||||
# "default": AUTH_LDAP_SERVER_URI,
|
||||
# "type": "string",
|
||||
# "category": "authentication",
|
||||
# },
|
||||
# "RADIUS_SERVER": {
|
||||
# "name": "Radius Server Host",
|
||||
# "description": "Host to communicate with for Radius Authentication",
|
||||
# "default": RADIUS_SERVER,
|
||||
# "type": "string",
|
||||
# "category": "authentication",
|
||||
# },
|
||||
# "RADIUS_PORT": {
|
||||
# "name": "Radius Server Port",
|
||||
# "description": "Port on the Radius host for Radius Authentication",
|
||||
# "default": RADIUS_PORT,
|
||||
# "type": "string",
|
||||
# "category": "authentication",
|
||||
# },
|
||||
# "RADIUS_SECRET": {
|
||||
# "name": "Radius Server Secret",
|
||||
# "description": "Secret used when negotiating with the Radius server",
|
||||
# "default": RADIUS_SECRET,
|
||||
# "type": "string",
|
||||
# "category": "authentication",
|
||||
# },
|
||||
"AWX_PROOT_ENABLED": {
|
||||
"name": "Enable PRoot for Job Execution",
|
||||
"description": "Isolates an Ansible job from protected parts of the Tower system to prevent exposing sensitive information",
|
||||
"default": AWX_PROOT_ENABLED,
|
||||
"type": "bool",
|
||||
"category": "jobs",
|
||||
},
|
||||
"AWX_PROOT_HIDE_PATHS": {
|
||||
"name": "Paths to hide from PRoot jobs",
|
||||
"description": "Extra paths to hide from PRoot isolated processes",
|
||||
"default": AWX_PROOT_HIDE_PATHS,
|
||||
"type": "list",
|
||||
"category": "jobs",
|
||||
},
|
||||
"AWX_PROOT_SHOW_PATHS": {
|
||||
"name": "Paths to expose to PRoot jobs",
|
||||
"description": "Explicit whitelist of paths to expose to PRoot jobs",
|
||||
"default": AWX_PROOT_SHOW_PATHS,
|
||||
"type": "list",
|
||||
"category": "jobs",
|
||||
},
|
||||
"AWX_PROOT_BASE_PATH": {
|
||||
"name": "Base PRoot execution path",
|
||||
"description": "The location that PRoot will create its temporary working directory",
|
||||
"default": AWX_PROOT_BASE_PATH,
|
||||
"type": "string",
|
||||
"category": "jobs",
|
||||
},
|
||||
"AWX_ANSIBLE_CALLBACK_PLUGINS": {
|
||||
"name": "Ansible Callback Plugins",
|
||||
"description": "Colon Seperated Paths for extra callback plugins to be used when running jobs",
|
||||
"default": AWX_ANSIBLE_CALLBACK_PLUGINS,
|
||||
"type": "string",
|
||||
"category": "jobs",
|
||||
},
|
||||
"PENDO_TRACKING_STATE": {
|
||||
"name": "Analytics Tracking State",
|
||||
"description": "Enable or Disable Analytics Tracking",
|
||||
"default": PENDO_TRACKING_STATE,
|
||||
"type": "string",
|
||||
"category": "ui",
|
||||
},
|
||||
"AD_HOC_COMMANDS": {
|
||||
"name": "Ansible Modules Allowed for Ad Hoc Jobs",
|
||||
"description": "A colon-seperated whitelist of modules allowed to be used by ad-hoc jobs",
|
||||
"default": AD_HOC_COMMANDS,
|
||||
"type": "list",
|
||||
"category": "jobs",
|
||||
},
|
||||
"ACTIVITY_STREAM_ENABLED": {
|
||||
"name": "Enable Activity Stream",
|
||||
"description": "Enable capturing activity for the Tower activity stream",
|
||||
"default": ACTIVITY_STREAM_ENABLED,
|
||||
"type": "bool",
|
||||
"category": "system",
|
||||
},
|
||||
"ORG_ADMINS_CAN_SEE_ALL_USERS": {
|
||||
"name": "All Users Visible to Organization Admins",
|
||||
"description": "Controls whether any Organization Admin can view all users, even those not associated with their Organization",
|
||||
"default": ORG_ADMINS_CAN_SEE_ALL_USERS,
|
||||
"type": "bool",
|
||||
"category": "system",
|
||||
},
|
||||
"TOWER_ADMIN_ALERTS": {
|
||||
"name": "Enable Tower Administrator Alerts",
|
||||
"description": "Allow Tower to email Admin users for system events that may require attention",
|
||||
"default": TOWER_ADMIN_ALERTS,
|
||||
"type": "bool",
|
||||
"category": "system",
|
||||
},
|
||||
"TOWER_URL_BASE": {
|
||||
"name": "Base URL of the Tower host",
|
||||
"description": "This is used by services like Notifications to render a valid url to the Tower host",
|
||||
"default": TOWER_URL_BASE,
|
||||
"type": "string",
|
||||
"category": "system",
|
||||
},
|
||||
"LICENSE": {
|
||||
"name": "Tower License",
|
||||
"description": "Controls what features and functionality is enabled in Tower.",
|
||||
"default": "{}",
|
||||
"type": "string",
|
||||
"category": "system",
|
||||
},
|
||||
}
|
||||
TOWER_SETTINGS_MANIFEST = {}
|
||||
|
||||
# Logging configuration.
|
||||
LOGGING = {
|
||||
'version': 1,
|
||||
@@ -1030,6 +904,11 @@ LOGGING = {
|
||||
'handlers': ['console', 'file', 'tower_warnings'],
|
||||
'level': 'DEBUG',
|
||||
},
|
||||
'awx.conf': {
|
||||
'handlers': ['console', 'file', 'tower_warnings'],
|
||||
'level': 'WARNING',
|
||||
'propagate': False,
|
||||
},
|
||||
'awx.main.commands.run_callback_receiver': {
|
||||
'handlers': ['console', 'file', 'callback_receiver'],
|
||||
'propagate': False
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
# Development settings for AWX project.
|
||||
|
||||
# Python
|
||||
import copy
|
||||
import sys
|
||||
import traceback
|
||||
|
||||
@@ -38,9 +39,12 @@ if 'celeryd' in sys.argv:
|
||||
|
||||
CALLBACK_QUEUE = "callback_tasks"
|
||||
|
||||
# Enable PROOT for tower-qa integration tests
|
||||
# Enable PROOT for tower-qa integration tests.
|
||||
# Note: This setting may be overridden by database settings.
|
||||
AWX_PROOT_ENABLED = True
|
||||
|
||||
# Disable Pendo on the UI for development/test.
|
||||
# Note: This setting may be overridden by database settings.
|
||||
PENDO_TRACKING_STATE = "off"
|
||||
|
||||
# Use Django-Jenkins if installed. Only run tests for awx.main app.
|
||||
@@ -75,6 +79,15 @@ PASSWORD_HASHERS = (
|
||||
# Configure a default UUID for development only.
|
||||
SYSTEM_UUID = '00000000-0000-0000-0000-000000000000'
|
||||
|
||||
# Store a snapshot of default settings at this point (only for migrating from
|
||||
# file to database settings).
|
||||
if 'migrate_to_database_settings' in sys.argv:
|
||||
DEFAULTS_SNAPSHOT = {}
|
||||
this_module = sys.modules[__name__]
|
||||
for setting in dir(this_module):
|
||||
if setting == setting.upper():
|
||||
DEFAULTS_SNAPSHOT[setting] = copy.deepcopy(getattr(this_module, setting))
|
||||
|
||||
# If there is an `/etc/tower/settings.py`, include it.
|
||||
# If there is a `/etc/tower/conf.d/*.py`, include them.
|
||||
include(optional('/etc/tower/settings.py'), scope=locals())
|
||||
@@ -90,8 +103,6 @@ TOWER_VENV_PATH = "/venv/tower"
|
||||
# only the defaults.
|
||||
try:
|
||||
include(optional('local_*.py'), scope=locals())
|
||||
if not is_testing(sys.argv):
|
||||
include('postprocess.py', scope=locals())
|
||||
except ImportError:
|
||||
traceback.print_exc()
|
||||
sys.exit(1)
|
||||
|
||||
@@ -192,141 +192,13 @@ LOGGING['handlers']['syslog'] = {
|
||||
#LOGGING['loggers']['awx.main.signals']['propagate'] = True
|
||||
#LOGGING['loggers']['awx.main.permissions']['propagate'] = True
|
||||
|
||||
# Enable the following line to turn on database settings logging.
|
||||
#LOGGING['loggers']['awx.conf']['level'] = 'DEBUG'
|
||||
|
||||
# Enable the following lines to turn on LDAP auth logging.
|
||||
#LOGGING['loggers']['django_auth_ldap']['handlers'] = ['console']
|
||||
#LOGGING['loggers']['django_auth_ldap']['level'] = 'DEBUG'
|
||||
|
||||
###############################################################################
|
||||
# LDAP AUTHENTICATION SETTINGS
|
||||
###############################################################################
|
||||
|
||||
# Refer to django-auth-ldap docs for more details:
|
||||
# http://pythonhosted.org/django-auth-ldap/authentication.html
|
||||
|
||||
# Imports needed for LDAP configuration.
|
||||
import ldap
|
||||
from django_auth_ldap.config import LDAPSearch, LDAPSearchUnion
|
||||
from django_auth_ldap.config import ActiveDirectoryGroupType
|
||||
|
||||
# LDAP server URI, such as "ldap://ldap.example.com:389" (non-SSL) or
|
||||
# "ldaps://ldap.example.com:636" (SSL). LDAP authentication is disable if this
|
||||
# parameter is empty.
|
||||
AUTH_LDAP_SERVER_URI = ''
|
||||
|
||||
# DN of user to bind for all search queries. Normally in the format
|
||||
# "CN=Some User,OU=Users,DC=example,DC=com" but may also be specified as
|
||||
# "DOMAIN\username" for Active Directory.
|
||||
AUTH_LDAP_BIND_DN = ''
|
||||
|
||||
# Password using to bind above user account.
|
||||
AUTH_LDAP_BIND_PASSWORD = ''
|
||||
|
||||
# Enable TLS when the connection is not using SSL.
|
||||
AUTH_LDAP_START_TLS = False
|
||||
|
||||
# Additional options to set for the LDAP connection. LDAP referrals are
|
||||
# disabled by default (to prevent certain LDAP queries from hanging with AD).
|
||||
AUTH_LDAP_CONNECTION_OPTIONS = {
|
||||
ldap.OPT_REFERRALS: 0,
|
||||
}
|
||||
|
||||
# LDAP search query to find users.
|
||||
AUTH_LDAP_USER_SEARCH = LDAPSearch(
|
||||
'OU=Users,DC=example,DC=com', # Base DN
|
||||
ldap.SCOPE_SUBTREE, # SCOPE_BASE, SCOPE_ONELEVEL, SCOPE_SUBTREE
|
||||
'(sAMAccountName=%(user)s)', # Query
|
||||
)
|
||||
|
||||
# Alternative to user search, if user DNs are all of the same format.
|
||||
#AUTH_LDAP_USER_DN_TEMPLATE = 'uid=%(user)s,OU=Users,DC=example,DC=com'
|
||||
|
||||
# Mapping of LDAP to user atrributes (key is user attribute name, value is LDAP
|
||||
# attribute name).
|
||||
AUTH_LDAP_USER_ATTR_MAP = {
|
||||
'first_name': 'givenName',
|
||||
'last_name': 'sn',
|
||||
'email': 'mail',
|
||||
}
|
||||
|
||||
# LDAP search query to find groups. Does not support LDAPSearchUnion.
|
||||
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
|
||||
'DC=example,DC=com', # Base DN
|
||||
ldap.SCOPE_SUBTREE, # SCOPE_BASE, SCOPE_ONELEVEL, SCOPE_SUBTREE
|
||||
'(objectClass=group)', # Query
|
||||
)
|
||||
# Type of group returned by the search above. Should be one of the types
|
||||
# listed at: http://pythonhosted.org/django-auth-ldap/groups.html#types-of-groups
|
||||
AUTH_LDAP_GROUP_TYPE = ActiveDirectoryGroupType()
|
||||
|
||||
# Group DN required to login. If specified, user must be a member of this
|
||||
# group to login via LDAP.
|
||||
#AUTH_LDAP_REQUIRE_GROUP = ''
|
||||
|
||||
# Group DN denied from login. If specified, user will not be allowed to login
|
||||
# if a member of this group.
|
||||
#AUTH_LDAP_DENY_GROUP = ''
|
||||
|
||||
# User profile flags updated from group membership (key is user attribute name,
|
||||
# value is group DN).
|
||||
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
|
||||
#'is_superuser': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
}
|
||||
|
||||
# Mapping between organization admins/users and LDAP groups. Keys are
|
||||
# organization names (will be created if not present). Values are dictionaries
|
||||
# of options for each organization's membership, where each can contain the
|
||||
# following parameters:
|
||||
# - remove: True/False. Defaults to False. Specifies the default for
|
||||
# remove_admins or remove_users if those parameters aren't explicitly set.
|
||||
# - admins: None, True/False, string or list/tuple of strings.
|
||||
# If None, organization admins will not be updated.
|
||||
# If True/False, all LDAP users will be added/removed as admins.
|
||||
# If a string or list of strings, specifies the group DN(s). User will be
|
||||
# added as an org admin if the user is a member of ANY of these groups.
|
||||
# - remove_admins: True/False. Defaults to False. If True, a user who is not a
|
||||
# member of the given groups will be removed from the organization's admins.
|
||||
# - users: None, True/False, string or list/tuple of strings. Same rules apply
|
||||
# as for admins.
|
||||
# - remove_users: True/False. Defaults to False. If True, a user who is not a
|
||||
# member of the given groups will be removed from the organization's users.
|
||||
AUTH_LDAP_ORGANIZATION_MAP = {
|
||||
#'Test Org': {
|
||||
# 'admins': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
# 'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
#},
|
||||
#'Test Org 2': {
|
||||
# 'admins': ['CN=Administrators,CN=Builtin,DC=example,DC=com'],
|
||||
# 'users': True,
|
||||
#},
|
||||
}
|
||||
|
||||
# Mapping between team members (users) and LDAP groups. Keys are team names
|
||||
# (will be created if not present). Values are dictionaries of options for
|
||||
# each team's membership, where each can contain the following parameters:
|
||||
# - organization: string. The name of the organization to which the team
|
||||
# belongs. The team will be created if the combination of organization and
|
||||
# team name does not exist. The organization will first be created if it
|
||||
# does not exist.
|
||||
# - users: None, True/False, string or list/tuple of strings.
|
||||
# If None, team members will not be updated.
|
||||
# If True/False, all LDAP users will be added/removed as team members.
|
||||
# If a string or list of strings, specifies the group DN(s). User will be
|
||||
# added as a team member if the user is a member of ANY of these groups.
|
||||
# - remove: True/False. Defaults to False. If True, a user who is not a member
|
||||
# of the given groups will be removed from the team.
|
||||
AUTH_LDAP_TEAM_MAP = {
|
||||
'My Team': {
|
||||
'organization': 'Test Org',
|
||||
'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
'remove': True,
|
||||
},
|
||||
'Other Team': {
|
||||
'organization': 'Test Org 2',
|
||||
'users': 'CN=Other Users,CN=Users,DC=example,DC=com',
|
||||
'remove': False,
|
||||
},
|
||||
}
|
||||
|
||||
###############################################################################
|
||||
# SCM TEST SETTINGS
|
||||
###############################################################################
|
||||
@@ -365,280 +237,6 @@ import getpass
|
||||
TEST_SSH_LOOPBACK_USERNAME = getpass.getuser()
|
||||
TEST_SSH_LOOPBACK_PASSWORD = ''
|
||||
|
||||
###############################################################################
|
||||
# LDAP TEST SETTINGS
|
||||
###############################################################################
|
||||
|
||||
# LDAP connection and authentication settings for unit tests only. LDAP tests
|
||||
# will be skipped if TEST_AUTH_LDAP_SERVER_URI is not configured.
|
||||
|
||||
TEST_AUTH_LDAP_SERVER_URI = ''
|
||||
TEST_AUTH_LDAP_BIND_DN = ''
|
||||
TEST_AUTH_LDAP_BIND_PASSWORD = ''
|
||||
TEST_AUTH_LDAP_START_TLS = False
|
||||
TEST_AUTH_LDAP_CONNECTION_OPTIONS = {
|
||||
ldap.OPT_REFERRALS: 0,
|
||||
}
|
||||
|
||||
# LDAP username/password for testing authentication.
|
||||
TEST_AUTH_LDAP_USERNAME = ''
|
||||
TEST_AUTH_LDAP_PASSWORD = ''
|
||||
|
||||
# LDAP search query to find users.
|
||||
TEST_AUTH_LDAP_USER_SEARCH = LDAPSearch(
|
||||
'CN=Users,DC=example,DC=com',
|
||||
ldap.SCOPE_SUBTREE,
|
||||
'(sAMAccountName=%(user)s)',
|
||||
)
|
||||
|
||||
# Alternative to user search.
|
||||
#TEST_AUTH_LDAP_USER_DN_TEMPLATE = 'sAMAccountName=%(user)s,OU=Users,DC=example,DC=com'
|
||||
|
||||
# Mapping of LDAP attributes to user attributes.
|
||||
TEST_AUTH_LDAP_USER_ATTR_MAP = {
|
||||
'first_name': 'givenName',
|
||||
'last_name': 'sn',
|
||||
'email': 'mail',
|
||||
}
|
||||
|
||||
# LDAP search query for finding groups.
|
||||
TEST_AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
|
||||
'DC=example,DC=com',
|
||||
ldap.SCOPE_SUBTREE,
|
||||
'(objectClass=group)',
|
||||
)
|
||||
# Type of group returned by the search above.
|
||||
TEST_AUTH_LDAP_GROUP_TYPE = ActiveDirectoryGroupType()
|
||||
|
||||
# Test DNs for a group required to login. User should be a member of the first
|
||||
# group, but not a member of the second.
|
||||
TEST_AUTH_LDAP_REQUIRE_GROUP = 'CN=Domain Admins,CN=Users,DC=example,DC=com'
|
||||
TEST_AUTH_LDAP_REQUIRE_GROUP_FAIL = 'CN=Guest,CN=Users,DC=example,DC=com'
|
||||
|
||||
# Test DNs for a group denied from login. User should not be a member of the
|
||||
# first group, but should be a member of the second.
|
||||
TEST_AUTH_LDAP_DENY_GROUP = 'CN=Guest,CN=Users,DC=example,DC=com'
|
||||
TEST_AUTH_LDAP_DENY_GROUP_FAIL = 'CN=Domain Admins,CN=Users,DC=example,DC=com'
|
||||
|
||||
# User profile flags updated from group membership. Test user should be a
|
||||
# member of the group.
|
||||
TEST_AUTH_LDAP_USER_FLAGS_BY_GROUP = {
|
||||
'is_superuser': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
}
|
||||
|
||||
# Test mapping between organization admins/users and LDAP groups.
|
||||
TEST_AUTH_LDAP_ORGANIZATION_MAP = {
|
||||
'Test Org': {
|
||||
'admins': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
},
|
||||
'Test Org 2': {
|
||||
'admins': ['CN=Administrators,CN=Builtin,DC=example,DC=com'],
|
||||
'users': True,
|
||||
},
|
||||
}
|
||||
# Expected results from organization mapping. After login, should user be an
|
||||
# admin/user in the given organization?
|
||||
TEST_AUTH_LDAP_ORGANIZATION_MAP_RESULT = {
|
||||
'Test Org': {'admins': True, 'users': False},
|
||||
'Test Org 2': {'admins': False, 'users': True},
|
||||
}
|
||||
|
||||
# Second test mapping to test remove parameters.
|
||||
TEST_AUTH_LDAP_ORGANIZATION_MAP_2 = {
|
||||
'Test Org': {
|
||||
'admins': 'CN=Domain Users,CN=Users,DC=example,DC=com',
|
||||
'users': True,
|
||||
'remove_admins': True,
|
||||
'remove_users': False,
|
||||
},
|
||||
'Test Org 2': {
|
||||
'admins': ['CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
'CN=Administrators,CN=Builtin,DC=example,DC=com'],
|
||||
'users': False,
|
||||
'remove': True,
|
||||
},
|
||||
}
|
||||
|
||||
# Expected results from second organization mapping.
|
||||
TEST_AUTH_LDAP_ORGANIZATION_MAP_2_RESULT = {
|
||||
'Test Org': {'admins': False, 'users': True},
|
||||
'Test Org 2': {'admins': True, 'users': False},
|
||||
}
|
||||
|
||||
# Test mapping between team users and LDAP groups.
|
||||
TEST_AUTH_LDAP_TEAM_MAP = {
|
||||
'Domain Users Team': {
|
||||
'organization': 'Test Org',
|
||||
'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
'remove': False,
|
||||
},
|
||||
'Admins Team': {
|
||||
'organization': 'Admins Org',
|
||||
'users': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
'remove': True,
|
||||
},
|
||||
'Everyone Team': {
|
||||
'organization': 'Test Org 2',
|
||||
'users': True,
|
||||
},
|
||||
}
|
||||
# Expected results from team mapping. After login, should user be a member of
|
||||
# the given team?
|
||||
TEST_AUTH_LDAP_TEAM_MAP_RESULT = {
|
||||
'Domain Users Team': {'users': False},
|
||||
'Admins Team': {'users': True},
|
||||
'Everyone Team': {'users': True},
|
||||
}
|
||||
|
||||
# Second test mapping for teams to remove user.
|
||||
TEST_AUTH_LDAP_TEAM_MAP_2 = {
|
||||
'Domain Users Team': {
|
||||
'organization': 'Test Org',
|
||||
'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
'remove': False,
|
||||
},
|
||||
'Admins Team': {
|
||||
'organization': 'Admins Org',
|
||||
'users': 'CN=Administrators,CN=Builtin,DC=example,DC=com',
|
||||
'remove': True,
|
||||
},
|
||||
'Everyone Team': {
|
||||
'organization': 'Test Org 2',
|
||||
'users': False,
|
||||
'remove': False,
|
||||
},
|
||||
}
|
||||
# Expected results from second team mapping. After login, should user be a
|
||||
# member of the given team?
|
||||
TEST_AUTH_LDAP_TEAM_MAP_2_RESULT = {
|
||||
'Domain Users Team': {'users': False},
|
||||
'Admins Team': {'users': False},
|
||||
'Everyone Team': {'users': True},
|
||||
}
|
||||
|
||||
###############################################################################
|
||||
# RADIUS AUTH SETTINGS
|
||||
###############################################################################
|
||||
|
||||
RADIUS_SERVER = ''
|
||||
RADIUS_PORT = 1812
|
||||
RADIUS_SECRET = ''
|
||||
|
||||
###############################################################################
|
||||
# SOCIAL AUTH SETTINGS
|
||||
###############################################################################
|
||||
|
||||
SOCIAL_AUTH_GOOGLE_OAUTH2_KEY = ''
|
||||
SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET = ''
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_SCOPE = ['profile']
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_WHITELISTED_DOMAINS = ['example.com']
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_AUTH_EXTRA_ARGUMENTS = {'hd': 'example.com'}
|
||||
|
||||
SOCIAL_AUTH_GITHUB_KEY = ''
|
||||
SOCIAL_AUTH_GITHUB_SECRET = ''
|
||||
|
||||
SOCIAL_AUTH_GITHUB_ORG_KEY = ''
|
||||
SOCIAL_AUTH_GITHUB_ORG_SECRET = ''
|
||||
SOCIAL_AUTH_GITHUB_ORG_NAME = ''
|
||||
|
||||
SOCIAL_AUTH_GITHUB_TEAM_KEY = ''
|
||||
SOCIAL_AUTH_GITHUB_TEAM_SECRET = ''
|
||||
SOCIAL_AUTH_GITHUB_TEAM_ID = ''
|
||||
|
||||
SOCIAL_AUTH_SAML_SP_ENTITY_ID = ''
|
||||
SOCIAL_AUTH_SAML_SP_PUBLIC_CERT = ''
|
||||
SOCIAL_AUTH_SAML_SP_PRIVATE_KEY = ''
|
||||
SOCIAL_AUTH_SAML_ORG_INFO = {
|
||||
'en-US': {
|
||||
'name': 'example',
|
||||
'displayname': 'Example',
|
||||
'url': 'http://www.example.com',
|
||||
},
|
||||
}
|
||||
SOCIAL_AUTH_SAML_TECHNICAL_CONTACT = {
|
||||
'givenName': 'Some User',
|
||||
'emailAddress': 'suser@example.com',
|
||||
}
|
||||
SOCIAL_AUTH_SAML_SUPPORT_CONTACT = {
|
||||
'givenName': 'Some User',
|
||||
'emailAddress': 'suser@example.com',
|
||||
}
|
||||
SOCIAL_AUTH_SAML_ENABLED_IDPS = {
|
||||
#'myidp': {
|
||||
# 'entity_id': 'https://idp.example.com',
|
||||
# 'url': 'https://myidp.example.com/sso',
|
||||
# 'x509cert': '',
|
||||
#},
|
||||
#'onelogin': {
|
||||
# 'entity_id': 'https://app.onelogin.com/saml/metadata/123456',
|
||||
# 'url': 'https://example.onelogin.com/trust/saml2/http-post/sso/123456',
|
||||
# 'x509cert': '',
|
||||
# 'attr_user_permanent_id': 'name_id',
|
||||
# 'attr_first_name': 'User.FirstName',
|
||||
# 'attr_last_name': 'User.LastName',
|
||||
# 'attr_username': 'User.email',
|
||||
# 'attr_email': 'User.email',
|
||||
#},
|
||||
}
|
||||
|
||||
SOCIAL_AUTH_ORGANIZATION_MAP = {
|
||||
# Add all users to the default organization.
|
||||
'Default': {
|
||||
'users': True,
|
||||
},
|
||||
#'Test Org': {
|
||||
# 'admins': ['admin@example.com'],
|
||||
# 'users': True,
|
||||
#},
|
||||
#'Test Org 2': {
|
||||
# 'admins': ['admin@example.com', re.compile(r'^tower-[^@]+*?@.*$],
|
||||
# 'users': re.compile(r'^[^@].*?@example\.com$'),
|
||||
#},
|
||||
}
|
||||
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_ORGANIZATION_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_ORGANIZATION_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_ORG_ORGANIZATION_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_TEAM_ORGANIZATION_MAP = {}
|
||||
#SOCIAL_AUTH_SAML_ORGANIZATION_MAP = {}
|
||||
|
||||
SOCIAL_AUTH_TEAM_MAP = {
|
||||
#'My Team': {
|
||||
# 'organization': 'Test Org',
|
||||
# 'users': ['re.compile(r'^[^@]+?@test\.example\.com$')'],
|
||||
# 'remove': True,
|
||||
#},
|
||||
#'Other Team': {
|
||||
# 'organization': 'Test Org 2',
|
||||
# 'users': re.compile(r'^[^@]+?@test2\.example\.com$'),
|
||||
# 'remove': False,
|
||||
#},
|
||||
}
|
||||
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_TEAM_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_TEAM_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_ORG_TEAM_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_TEAM_TEAM_MAP = {}
|
||||
#SOCIAL_AUTH_SAML_TEAM_MAP = {}
|
||||
|
||||
# Uncomment the line below (i.e. set SOCIAL_AUTH_USER_FIELDS to an empty list)
|
||||
# to prevent new user accounts from being created. Only users who have
|
||||
# previously logged in using social auth or have a user account with a matching
|
||||
# email address will be able to login.
|
||||
|
||||
#SOCIAL_AUTH_USER_FIELDS = []
|
||||
|
||||
# It is also possible to add custom functions to the social auth pipeline for
|
||||
# more advanced organization and team mapping. Use at your own risk.
|
||||
|
||||
#def custom_social_auth_pipeline_function(backend, details, user=None, *args, **kwargs):
|
||||
# print 'custom:', backend, details, user, args, kwargs
|
||||
|
||||
#SOCIAL_AUTH_PIPELINE += (
|
||||
# 'awx.settings.development.custom_social_auth_pipeline_function',
|
||||
#)
|
||||
|
||||
###############################################################################
|
||||
# INVENTORY IMPORT TEST SETTINGS
|
||||
###############################################################################
|
||||
|
||||
@@ -156,141 +156,13 @@ LOGGING['handlers']['syslog'] = {
|
||||
#LOGGING['loggers']['awx.main.signals']['propagate'] = True
|
||||
#LOGGING['loggers']['awx.main.permissions']['propagate'] = True
|
||||
|
||||
# Enable the following line to turn on database settings logging.
|
||||
#LOGGING['loggers']['awx.conf']['level'] = 'DEBUG'
|
||||
|
||||
# Enable the following lines to turn on LDAP auth logging.
|
||||
#LOGGING['loggers']['django_auth_ldap']['handlers'] = ['console']
|
||||
#LOGGING['loggers']['django_auth_ldap']['level'] = 'DEBUG'
|
||||
|
||||
###############################################################################
|
||||
# LDAP AUTHENTICATION SETTINGS
|
||||
###############################################################################
|
||||
|
||||
# Refer to django-auth-ldap docs for more details:
|
||||
# http://pythonhosted.org/django-auth-ldap/authentication.html
|
||||
|
||||
# Imports needed for LDAP configuration.
|
||||
import ldap
|
||||
from django_auth_ldap.config import LDAPSearch, LDAPSearchUnion
|
||||
from django_auth_ldap.config import ActiveDirectoryGroupType
|
||||
|
||||
# LDAP server URI, such as "ldap://ldap.example.com:389" (non-SSL) or
|
||||
# "ldaps://ldap.example.com:636" (SSL). LDAP authentication is disable if this
|
||||
# parameter is empty.
|
||||
AUTH_LDAP_SERVER_URI = ''
|
||||
|
||||
# DN of user to bind for all search queries. Normally in the format
|
||||
# "CN=Some User,OU=Users,DC=example,DC=com" but may also be specified as
|
||||
# "DOMAIN\username" for Active Directory.
|
||||
AUTH_LDAP_BIND_DN = ''
|
||||
|
||||
# Password using to bind above user account.
|
||||
AUTH_LDAP_BIND_PASSWORD = ''
|
||||
|
||||
# Enable TLS when the connection is not using SSL.
|
||||
AUTH_LDAP_START_TLS = False
|
||||
|
||||
# Additional options to set for the LDAP connection. LDAP referrals are
|
||||
# disabled by default (to prevent certain LDAP queries from hanging with AD).
|
||||
AUTH_LDAP_CONNECTION_OPTIONS = {
|
||||
ldap.OPT_REFERRALS: 0,
|
||||
}
|
||||
|
||||
# LDAP search query to find users.
|
||||
AUTH_LDAP_USER_SEARCH = LDAPSearch(
|
||||
'OU=Users,DC=example,DC=com', # Base DN
|
||||
ldap.SCOPE_SUBTREE, # SCOPE_BASE, SCOPE_ONELEVEL, SCOPE_SUBTREE
|
||||
'(sAMAccountName=%(user)s)', # Query
|
||||
)
|
||||
|
||||
# Alternative to user search, if user DNs are all of the same format.
|
||||
#AUTH_LDAP_USER_DN_TEMPLATE = 'uid=%(user)s,OU=Users,DC=example,DC=com'
|
||||
|
||||
# Mapping of LDAP to user atrributes (key is user attribute name, value is LDAP
|
||||
# attribute name).
|
||||
AUTH_LDAP_USER_ATTR_MAP = {
|
||||
'first_name': 'givenName',
|
||||
'last_name': 'sn',
|
||||
'email': 'mail',
|
||||
}
|
||||
|
||||
# LDAP search query to find groups. Does not support LDAPSearchUnion.
|
||||
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
|
||||
'DC=example,DC=com', # Base DN
|
||||
ldap.SCOPE_SUBTREE, # SCOPE_BASE, SCOPE_ONELEVEL, SCOPE_SUBTREE
|
||||
'(objectClass=group)', # Query
|
||||
)
|
||||
# Type of group returned by the search above. Should be one of the types
|
||||
# listed at: http://pythonhosted.org/django-auth-ldap/groups.html#types-of-groups
|
||||
AUTH_LDAP_GROUP_TYPE = ActiveDirectoryGroupType()
|
||||
|
||||
# Group DN required to login. If specified, user must be a member of this
|
||||
# group to login via LDAP.
|
||||
#AUTH_LDAP_REQUIRE_GROUP = ''
|
||||
|
||||
# Group DN denied from login. If specified, user will not be allowed to login
|
||||
# if a member of this group.
|
||||
#AUTH_LDAP_DENY_GROUP = ''
|
||||
|
||||
# User profile flags updated from group membership (key is user attribute name,
|
||||
# value is group DN).
|
||||
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
|
||||
#'is_superuser': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
}
|
||||
|
||||
# Mapping between organization admins/users and LDAP groups. Keys are
|
||||
# organization names (will be created if not present). Values are dictionaries
|
||||
# of options for each organization's membership, where each can contain the
|
||||
# following parameters:
|
||||
# - remove: True/False. Defaults to False. Specifies the default for
|
||||
# remove_admins or remove_users if those parameters aren't explicitly set.
|
||||
# - admins: None, True/False, string or list/tuple of strings.
|
||||
# If None, organization admins will not be updated.
|
||||
# If True/False, all LDAP users will be added/removed as admins.
|
||||
# If a string or list of strings, specifies the group DN(s). User will be
|
||||
# added as an org admin if the user is a member of ANY of these groups.
|
||||
# - remove_admins: True/False. Defaults to False. If True, a user who is not a
|
||||
# member of the given groups will be removed from the organization's admins.
|
||||
# - users: None, True/False, string or list/tuple of strings. Same rules apply
|
||||
# as for admins.
|
||||
# - remove_users: True/False. Defaults to False. If True, a user who is not a
|
||||
# member of the given groups will be removed from the organization's users.
|
||||
AUTH_LDAP_ORGANIZATION_MAP = {
|
||||
#'Test Org': {
|
||||
# 'admins': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
# 'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
#},
|
||||
#'Test Org 2': {
|
||||
# 'admins': ['CN=Administrators,CN=Builtin,DC=example,DC=com'],
|
||||
# 'users': True,
|
||||
#},
|
||||
}
|
||||
|
||||
# Mapping between team members (users) and LDAP groups. Keys are team names
|
||||
# (will be created if not present). Values are dictionaries of options for
|
||||
# each team's membership, where each can contain the following parameters:
|
||||
# - organization: string. The name of the organization to which the team
|
||||
# belongs. The team will be created if the combination of organization and
|
||||
# team name does not exist. The organization will first be created if it
|
||||
# does not exist.
|
||||
# - users: None, True/False, string or list/tuple of strings.
|
||||
# If None, team members will not be updated.
|
||||
# If True/False, all LDAP users will be added/removed as team members.
|
||||
# If a string or list of strings, specifies the group DN(s). User will be
|
||||
# added as a team member if the user is a member of ANY of these groups.
|
||||
# - remove: True/False. Defaults to False. If True, a user who is not a member
|
||||
# of the given groups will be removed from the team.
|
||||
AUTH_LDAP_TEAM_MAP = {
|
||||
'My Team': {
|
||||
'organization': 'Test Org',
|
||||
'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
'remove': True,
|
||||
},
|
||||
'Other Team': {
|
||||
'organization': 'Test Org 2',
|
||||
'users': 'CN=Other Users,CN=Users,DC=example,DC=com',
|
||||
'remove': False,
|
||||
},
|
||||
}
|
||||
|
||||
###############################################################################
|
||||
# SCM TEST SETTINGS
|
||||
###############################################################################
|
||||
@@ -329,280 +201,6 @@ import getpass
|
||||
TEST_SSH_LOOPBACK_USERNAME = getpass.getuser()
|
||||
TEST_SSH_LOOPBACK_PASSWORD = ''
|
||||
|
||||
###############################################################################
|
||||
# LDAP TEST SETTINGS
|
||||
###############################################################################
|
||||
|
||||
# LDAP connection and authentication settings for unit tests only. LDAP tests
|
||||
# will be skipped if TEST_AUTH_LDAP_SERVER_URI is not configured.
|
||||
|
||||
TEST_AUTH_LDAP_SERVER_URI = ''
|
||||
TEST_AUTH_LDAP_BIND_DN = ''
|
||||
TEST_AUTH_LDAP_BIND_PASSWORD = ''
|
||||
TEST_AUTH_LDAP_START_TLS = False
|
||||
TEST_AUTH_LDAP_CONNECTION_OPTIONS = {
|
||||
ldap.OPT_REFERRALS: 0,
|
||||
}
|
||||
|
||||
# LDAP username/password for testing authentication.
|
||||
TEST_AUTH_LDAP_USERNAME = ''
|
||||
TEST_AUTH_LDAP_PASSWORD = ''
|
||||
|
||||
# LDAP search query to find users.
|
||||
TEST_AUTH_LDAP_USER_SEARCH = LDAPSearch(
|
||||
'CN=Users,DC=example,DC=com',
|
||||
ldap.SCOPE_SUBTREE,
|
||||
'(sAMAccountName=%(user)s)',
|
||||
)
|
||||
|
||||
# Alternative to user search.
|
||||
#TEST_AUTH_LDAP_USER_DN_TEMPLATE = 'sAMAccountName=%(user)s,OU=Users,DC=example,DC=com'
|
||||
|
||||
# Mapping of LDAP attributes to user attributes.
|
||||
TEST_AUTH_LDAP_USER_ATTR_MAP = {
|
||||
'first_name': 'givenName',
|
||||
'last_name': 'sn',
|
||||
'email': 'mail',
|
||||
}
|
||||
|
||||
# LDAP search query for finding groups.
|
||||
TEST_AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
|
||||
'DC=example,DC=com',
|
||||
ldap.SCOPE_SUBTREE,
|
||||
'(objectClass=group)',
|
||||
)
|
||||
# Type of group returned by the search above.
|
||||
TEST_AUTH_LDAP_GROUP_TYPE = ActiveDirectoryGroupType()
|
||||
|
||||
# Test DNs for a group required to login. User should be a member of the first
|
||||
# group, but not a member of the second.
|
||||
TEST_AUTH_LDAP_REQUIRE_GROUP = 'CN=Domain Admins,CN=Users,DC=example,DC=com'
|
||||
TEST_AUTH_LDAP_REQUIRE_GROUP_FAIL = 'CN=Guest,CN=Users,DC=example,DC=com'
|
||||
|
||||
# Test DNs for a group denied from login. User should not be a member of the
|
||||
# first group, but should be a member of the second.
|
||||
TEST_AUTH_LDAP_DENY_GROUP = 'CN=Guest,CN=Users,DC=example,DC=com'
|
||||
TEST_AUTH_LDAP_DENY_GROUP_FAIL = 'CN=Domain Admins,CN=Users,DC=example,DC=com'
|
||||
|
||||
# User profile flags updated from group membership. Test user should be a
|
||||
# member of the group.
|
||||
TEST_AUTH_LDAP_USER_FLAGS_BY_GROUP = {
|
||||
'is_superuser': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
}
|
||||
|
||||
# Test mapping between organization admins/users and LDAP groups.
|
||||
TEST_AUTH_LDAP_ORGANIZATION_MAP = {
|
||||
'Test Org': {
|
||||
'admins': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
},
|
||||
'Test Org 2': {
|
||||
'admins': ['CN=Administrators,CN=Builtin,DC=example,DC=com'],
|
||||
'users': True,
|
||||
},
|
||||
}
|
||||
# Expected results from organization mapping. After login, should user be an
|
||||
# admin/user in the given organization?
|
||||
TEST_AUTH_LDAP_ORGANIZATION_MAP_RESULT = {
|
||||
'Test Org': {'admins': True, 'users': False},
|
||||
'Test Org 2': {'admins': False, 'users': True},
|
||||
}
|
||||
|
||||
# Second test mapping to test remove parameters.
|
||||
TEST_AUTH_LDAP_ORGANIZATION_MAP_2 = {
|
||||
'Test Org': {
|
||||
'admins': 'CN=Domain Users,CN=Users,DC=example,DC=com',
|
||||
'users': True,
|
||||
'remove_admins': True,
|
||||
'remove_users': False,
|
||||
},
|
||||
'Test Org 2': {
|
||||
'admins': ['CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
'CN=Administrators,CN=Builtin,DC=example,DC=com'],
|
||||
'users': False,
|
||||
'remove': True,
|
||||
},
|
||||
}
|
||||
|
||||
# Expected results from second organization mapping.
|
||||
TEST_AUTH_LDAP_ORGANIZATION_MAP_2_RESULT = {
|
||||
'Test Org': {'admins': False, 'users': True},
|
||||
'Test Org 2': {'admins': True, 'users': False},
|
||||
}
|
||||
|
||||
# Test mapping between team users and LDAP groups.
|
||||
TEST_AUTH_LDAP_TEAM_MAP = {
|
||||
'Domain Users Team': {
|
||||
'organization': 'Test Org',
|
||||
'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
'remove': False,
|
||||
},
|
||||
'Admins Team': {
|
||||
'organization': 'Admins Org',
|
||||
'users': 'CN=Domain Admins,CN=Users,DC=example,DC=com',
|
||||
'remove': True,
|
||||
},
|
||||
'Everyone Team': {
|
||||
'organization': 'Test Org 2',
|
||||
'users': True,
|
||||
},
|
||||
}
|
||||
# Expected results from team mapping. After login, should user be a member of
|
||||
# the given team?
|
||||
TEST_AUTH_LDAP_TEAM_MAP_RESULT = {
|
||||
'Domain Users Team': {'users': False},
|
||||
'Admins Team': {'users': True},
|
||||
'Everyone Team': {'users': True},
|
||||
}
|
||||
|
||||
# Second test mapping for teams to remove user.
|
||||
TEST_AUTH_LDAP_TEAM_MAP_2 = {
|
||||
'Domain Users Team': {
|
||||
'organization': 'Test Org',
|
||||
'users': ['CN=Domain Users,CN=Users,DC=example,DC=com'],
|
||||
'remove': False,
|
||||
},
|
||||
'Admins Team': {
|
||||
'organization': 'Admins Org',
|
||||
'users': 'CN=Administrators,CN=Builtin,DC=example,DC=com',
|
||||
'remove': True,
|
||||
},
|
||||
'Everyone Team': {
|
||||
'organization': 'Test Org 2',
|
||||
'users': False,
|
||||
'remove': False,
|
||||
},
|
||||
}
|
||||
# Expected results from second team mapping. After login, should user be a
|
||||
# member of the given team?
|
||||
TEST_AUTH_LDAP_TEAM_MAP_2_RESULT = {
|
||||
'Domain Users Team': {'users': False},
|
||||
'Admins Team': {'users': False},
|
||||
'Everyone Team': {'users': True},
|
||||
}
|
||||
|
||||
###############################################################################
|
||||
# RADIUS AUTH SETTINGS
|
||||
###############################################################################
|
||||
|
||||
RADIUS_SERVER = ''
|
||||
RADIUS_PORT = 1812
|
||||
RADIUS_SECRET = ''
|
||||
|
||||
###############################################################################
|
||||
# SOCIAL AUTH SETTINGS
|
||||
###############################################################################
|
||||
|
||||
SOCIAL_AUTH_GOOGLE_OAUTH2_KEY = ''
|
||||
SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET = ''
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_SCOPE = ['profile']
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_WHITELISTED_DOMAINS = ['example.com']
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_AUTH_EXTRA_ARGUMENTS = {'hd': 'example.com'}
|
||||
|
||||
SOCIAL_AUTH_GITHUB_KEY = ''
|
||||
SOCIAL_AUTH_GITHUB_SECRET = ''
|
||||
|
||||
SOCIAL_AUTH_GITHUB_ORG_KEY = ''
|
||||
SOCIAL_AUTH_GITHUB_ORG_SECRET = ''
|
||||
SOCIAL_AUTH_GITHUB_ORG_NAME = ''
|
||||
|
||||
SOCIAL_AUTH_GITHUB_TEAM_KEY = ''
|
||||
SOCIAL_AUTH_GITHUB_TEAM_SECRET = ''
|
||||
SOCIAL_AUTH_GITHUB_TEAM_ID = ''
|
||||
|
||||
SOCIAL_AUTH_SAML_SP_ENTITY_ID = ''
|
||||
SOCIAL_AUTH_SAML_SP_PUBLIC_CERT = ''
|
||||
SOCIAL_AUTH_SAML_SP_PRIVATE_KEY = ''
|
||||
SOCIAL_AUTH_SAML_ORG_INFO = {
|
||||
'en-US': {
|
||||
'name': 'example',
|
||||
'displayname': 'Example',
|
||||
'url': 'http://www.example.com',
|
||||
},
|
||||
}
|
||||
SOCIAL_AUTH_SAML_TECHNICAL_CONTACT = {
|
||||
'givenName': 'Some User',
|
||||
'emailAddress': 'suser@example.com',
|
||||
}
|
||||
SOCIAL_AUTH_SAML_SUPPORT_CONTACT = {
|
||||
'givenName': 'Some User',
|
||||
'emailAddress': 'suser@example.com',
|
||||
}
|
||||
SOCIAL_AUTH_SAML_ENABLED_IDPS = {
|
||||
#'myidp': {
|
||||
# 'entity_id': 'https://idp.example.com',
|
||||
# 'url': 'https://myidp.example.com/sso',
|
||||
# 'x509cert': '',
|
||||
#},
|
||||
#'onelogin': {
|
||||
# 'entity_id': 'https://app.onelogin.com/saml/metadata/123456',
|
||||
# 'url': 'https://example.onelogin.com/trust/saml2/http-post/sso/123456',
|
||||
# 'x509cert': '',
|
||||
# 'attr_user_permanent_id': 'name_id',
|
||||
# 'attr_first_name': 'User.FirstName',
|
||||
# 'attr_last_name': 'User.LastName',
|
||||
# 'attr_username': 'User.email',
|
||||
# 'attr_email': 'User.email',
|
||||
#},
|
||||
}
|
||||
|
||||
SOCIAL_AUTH_ORGANIZATION_MAP = {
|
||||
# Add all users to the default organization.
|
||||
'Default': {
|
||||
'users': True,
|
||||
},
|
||||
#'Test Org': {
|
||||
# 'admins': ['admin@example.com'],
|
||||
# 'users': True,
|
||||
#},
|
||||
#'Test Org 2': {
|
||||
# 'admins': ['admin@example.com', re.compile(r'^tower-[^@]+*?@.*$],
|
||||
# 'users': re.compile(r'^[^@].*?@example\.com$'),
|
||||
#},
|
||||
}
|
||||
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_ORGANIZATION_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_ORGANIZATION_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_ORG_ORGANIZATION_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_TEAM_ORGANIZATION_MAP = {}
|
||||
#SOCIAL_AUTH_SAML_ORGANIZATION_MAP = {}
|
||||
|
||||
SOCIAL_AUTH_TEAM_MAP = {
|
||||
#'My Team': {
|
||||
# 'organization': 'Test Org',
|
||||
# 'users': ['re.compile(r'^[^@]+?@test\.example\.com$')'],
|
||||
# 'remove': True,
|
||||
#},
|
||||
#'Other Team': {
|
||||
# 'organization': 'Test Org 2',
|
||||
# 'users': re.compile(r'^[^@]+?@test2\.example\.com$'),
|
||||
# 'remove': False,
|
||||
#},
|
||||
}
|
||||
|
||||
#SOCIAL_AUTH_GOOGLE_OAUTH2_TEAM_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_TEAM_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_ORG_TEAM_MAP = {}
|
||||
#SOCIAL_AUTH_GITHUB_TEAM_TEAM_MAP = {}
|
||||
#SOCIAL_AUTH_SAML_TEAM_MAP = {}
|
||||
|
||||
# Uncomment the line below (i.e. set SOCIAL_AUTH_USER_FIELDS to an empty list)
|
||||
# to prevent new user accounts from being created. Only users who have
|
||||
# previously logged in using social auth or have a user account with a matching
|
||||
# email address will be able to login.
|
||||
|
||||
#SOCIAL_AUTH_USER_FIELDS = []
|
||||
|
||||
# It is also possible to add custom functions to the social auth pipeline for
|
||||
# more advanced organization and team mapping. Use at your own risk.
|
||||
|
||||
#def custom_social_auth_pipeline_function(backend, details, user=None, *args, **kwargs):
|
||||
# print 'custom:', backend, details, user, args, kwargs
|
||||
|
||||
#SOCIAL_AUTH_PIPELINE += (
|
||||
# 'awx.settings.development.custom_social_auth_pipeline_function',
|
||||
#)
|
||||
|
||||
###############################################################################
|
||||
# INVENTORY IMPORT TEST SETTINGS
|
||||
###############################################################################
|
||||
|
||||
@@ -1,38 +0,0 @@
|
||||
# Copyright (c) 2015 Ansible, Inc.
|
||||
# All Rights Reserved.
|
||||
|
||||
# flake8: noqa
|
||||
|
||||
# Runs after all configuration files have been loaded to fix/check/update
|
||||
# settings as needed.
|
||||
|
||||
if not AUTH_LDAP_SERVER_URI:
|
||||
AUTHENTICATION_BACKENDS = [x for x in AUTHENTICATION_BACKENDS if x != 'awx.sso.backends.LDAPBackend']
|
||||
|
||||
if not RADIUS_SERVER:
|
||||
AUTHENTICATION_BACKENDS = [x for x in AUTHENTICATION_BACKENDS if x != 'awx.sso.backends.RADIUSBackend']
|
||||
|
||||
if not all([SOCIAL_AUTH_GOOGLE_OAUTH2_KEY, SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET]):
|
||||
AUTHENTICATION_BACKENDS = [x for x in AUTHENTICATION_BACKENDS if x != 'social.backends.google.GoogleOAuth2']
|
||||
|
||||
if not all([SOCIAL_AUTH_GITHUB_KEY, SOCIAL_AUTH_GITHUB_SECRET]):
|
||||
AUTHENTICATION_BACKENDS = [x for x in AUTHENTICATION_BACKENDS if x != 'social.backends.github.GithubOAuth2']
|
||||
|
||||
if not all([SOCIAL_AUTH_GITHUB_ORG_KEY, SOCIAL_AUTH_GITHUB_ORG_SECRET, SOCIAL_AUTH_GITHUB_ORG_NAME]):
|
||||
AUTHENTICATION_BACKENDS = [x for x in AUTHENTICATION_BACKENDS if x != 'social.backends.github.GithubOrganizationOAuth2']
|
||||
|
||||
if not all([SOCIAL_AUTH_GITHUB_TEAM_KEY, SOCIAL_AUTH_GITHUB_TEAM_SECRET, SOCIAL_AUTH_GITHUB_TEAM_ID]):
|
||||
AUTHENTICATION_BACKENDS = [x for x in AUTHENTICATION_BACKENDS if x != 'social.backends.github.GithubTeamOAuth2']
|
||||
|
||||
if not all([SOCIAL_AUTH_SAML_SP_ENTITY_ID, SOCIAL_AUTH_SAML_SP_PUBLIC_CERT,
|
||||
SOCIAL_AUTH_SAML_SP_PRIVATE_KEY, SOCIAL_AUTH_SAML_ORG_INFO,
|
||||
SOCIAL_AUTH_SAML_TECHNICAL_CONTACT, SOCIAL_AUTH_SAML_SUPPORT_CONTACT,
|
||||
SOCIAL_AUTH_SAML_ENABLED_IDPS]):
|
||||
AUTHENTICATION_BACKENDS = [x for x in AUTHENTICATION_BACKENDS if x != 'awx.sso.backends.SAMLAuth']
|
||||
|
||||
if not AUTH_BASIC_ENABLED:
|
||||
REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES'] = [x for x in REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES'] if x != 'rest_framework.authentication.BasicAuthentication']
|
||||
|
||||
# Update cache to use celery broker URL defined in configuration files.
|
||||
if CACHES['default']['BACKEND'] == 'redis_cache.RedisCache':
|
||||
CACHES['default']['LOCATION'] = BROKER_URL
|
||||
@@ -4,6 +4,7 @@
|
||||
# Production settings for AWX project.
|
||||
|
||||
# Python
|
||||
import copy
|
||||
import errno
|
||||
import sys
|
||||
import traceback
|
||||
@@ -57,6 +58,15 @@ LOGGING['handlers']['fact_receiver']['filename'] = '/var/log/tower/fact_receiver
|
||||
LOGGING['handlers']['system_tracking_migrations']['filename'] = '/var/log/tower/tower_system_tracking_migrations.log'
|
||||
LOGGING['handlers']['rbac_migrations']['filename'] = '/var/log/tower/tower_rbac_migrations.log'
|
||||
|
||||
# Store a snapshot of default settings at this point (only for migrating from
|
||||
# file to database settings).
|
||||
if 'migrate_to_database_settings' in sys.argv:
|
||||
DEFAULTS_SNAPSHOT = {}
|
||||
this_module = sys.modules[__name__]
|
||||
for setting in dir(this_module):
|
||||
if setting == setting.upper():
|
||||
DEFAULTS_SNAPSHOT[setting] = copy.deepcopy(getattr(this_module, setting))
|
||||
|
||||
# Load settings from any .py files in the global conf.d directory specified in
|
||||
# the environment, defaulting to /etc/tower/conf.d/.
|
||||
settings_dir = os.environ.get('AWX_SETTINGS_DIR', '/etc/tower/conf.d/')
|
||||
@@ -71,7 +81,6 @@ settings_file = os.environ.get('AWX_SETTINGS_FILE',
|
||||
# /etc/tower/conf.d/*.py.
|
||||
try:
|
||||
include(settings_file, optional(settings_files), scope=locals())
|
||||
include('postprocess.py', scope=locals())
|
||||
except ImportError:
|
||||
traceback.print_exc()
|
||||
sys.exit(1)
|
||||
|
||||
Reference in New Issue
Block a user