External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-11 18:09:57 -03:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5499 from ryanpetrello/more-oauth-tinkering

Browse Source 
only restrict OAuth2 tokens for external accounts *at creation time*

Reviewed-by: https://github.com/apps/softwarefactory-project-zuul
This commit is contained in:
softwarefactory-project-zuul[bot] 2020-01-02 14:09:30 +00:00 committed by GitHub
commit da440469cf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
awx/main/models/oauth.py
View File

@ -124,11 +124,6 @@ class OAuth2AccessToken(AbstractAccessToken):
def is_valid(self, scopes=None):
valid = super(OAuth2AccessToken, self).is_valid(scopes)
if valid:
try:
self.validate_external_users()
except oauth2.AccessDeniedError:
logger.exception(f'Failed to authenticate {self.user.username}')
return False
self.last_used = now()
def _update_last_used():
@ -146,5 +141,6 @@ class OAuth2AccessToken(AbstractAccessToken):
).format(external_account))
def save(self, *args, **kwargs):
self.validate_external_users()
if not self.pk:
self.validate_external_users()
super(OAuth2AccessToken, self).save(*args, **kwargs)

6
awx/main/tests/functional/api/test_oauth.py
View File

@ -69,7 +69,7 @@ def test_token_creation_disabled_for_external_accounts(oauth_application, post,
@pytest.mark.django_db
def test_existing_token_disabled_for_external_accounts(oauth_application, get, post, admin):
def test_existing_token_enabled_for_external_accounts(oauth_application, get, post, admin):
UserEnterpriseAuth(user=admin, provider='radius').save()
url = drf_reverse('api:oauth_authorization_root_view') + 'token/'
with override_settings(RADIUS_SERVER='example.org', ALLOW_OAUTH2_FOR_EXTERNAL_USERS=True):
@ -98,9 +98,9 @@ def test_existing_token_disabled_for_external_accounts(oauth_application, get, p
resp = get(
drf_reverse('api:user_me_list', kwargs={'version': 'v2'}),
HTTP_AUTHORIZATION='Bearer ' + token,
status=401
status=200
)
assert b'To establish a login session' in resp.content
assert json.loads(resp.content)['results'][0]['username'] == 'admin'
@pytest.mark.django_db