Commit Graph

190 Commits

Author SHA1 Message Date
Ryan Petrello
b1f56df930 fix linting failures 2020-01-13 15:58:19 -05:00
Seth Foster
7873d08311 Update pip and setuptools in requirements txt
Versions selected to be pre-19 pip
due to unresolved issues with the build systems

Upgrade everything, party on

document new process

rotate license files

fix Swagger schema generation target

Remove --ignore-installed flag
2020-01-07 17:14:32 -06:00
Nikhil Jain
93dda04fd0 fix the saml_admin_attr not working 2019-12-13 15:11:23 +05:30
Seth Foster
7e83ddc968 Fix URLField to allow numbers in top level domain
Add a custom regex to URLField that allows numbers to be present in the
top level domain, e.g. https://towerhost.org42

Set by variable allow_numbers_in_top_level_domain in URLField __init__,
and is set to True by default. If set to False, it will use the regex
specified in the built-in django URLValidator class.

This solution was originally implemented in LDAPServerURIField, but is
now implemented in URLField to support this behavior more generally. The
changes in LDAPServerURIField are longer needed and have been removed in
this commit.

Adds unit testing to make sure URLField changes handle regex input
and settings correctly.
2019-10-28 13:47:01 -04:00
Bill Nottingham
36571a1275 Fix SAML login when only certain attributes are set.
The user may not set all of saml_{attr,admin_attr,auditor_attr},
so don't assume they all exist.
2019-09-20 15:28:38 -04:00
Seth Foster
ca5de6378a Fix LDAPServerURIField number in domain
- Bug: API error if LDAPServerURIField contains a number in the top level domain
- Add custom regex in LDAPServerURIField class that is passed to django
  URLValidator
- The custom regex allows for numbers to be present in the top level domain
- Unit tests check that valid URIs pass through URLValidator, and that
  invalid URIs raise the correct exception
- Related to issue #3646
2019-09-20 10:36:47 -04:00
Bill Nottingham
bbf28f50bd Allow mapping org auditors where we map org admins. 2019-08-13 11:32:35 -04:00
Jeff Bradberry
172864a3a1 Force the username and password to be strings under the Radius backend
The base Radius backend encodes them as utf-8 bytes, which causes the
User object that we create to get the repr of the username, including
the b prefix and single quotes, e.g. "b'foo'".
2019-07-12 15:11:22 -04:00
Jeff Bradberry
a691340986 Update authenticate method on auth backends to add required request param
This became mandatory in Django 2.1.
2019-07-12 15:11:22 -04:00
Jeff Bradberry
2d81923e22 Fix up changes in fields in the migrations
Particularly the now-required on_delete parameter for ForeignKey and
OneToOneField.
2019-07-12 15:11:22 -04:00
Jeff Bradberry
1093a662f1 Fix a problem with a change in results from User.has_usable_password 2019-07-12 15:11:22 -04:00
Jeff Bradberry
bcbb768dd3 Remove the use of the deprecated Field.rel attribute
Also, rename a number of variables named `rel` for ease of searching.
2019-07-12 15:11:21 -04:00
Jeff Bradberry
e0693d3746 is_anonymous and is_authenticated no longer support being called as methods 2019-07-12 15:11:21 -04:00
Jeff Bradberry
758ad164fe Include defined fields from all parent classes of a HybridDictField
since our settings registry adds a mixin class when doing validation on these.

related #4099
2019-07-08 16:05:03 -04:00
Ryan Petrello
0dcbafaccb fix a bug that breaks OPT_X_TLS_REQUIRE_CERT=0 for LDAP authentication 2019-07-05 10:24:18 -04:00
Ryan Petrello
11b36982cd fix a bug that causes LDAP TLS connection flags to not be set properly
co-authored-by: Jim Ladd <jladd@redhat.com>
2019-06-28 22:15:35 -04:00
Ryan Petrello
d8bd72054d work around a unit test that's periodically flaky 2019-06-14 10:05:41 -04:00
Jeff Bradberry
2a81643308 Refactor the SSO serializer fields to follow the DRF idioms more closely
and fix the tests to handle the newer nested validation checks properly.
2019-06-12 14:12:59 -04:00
Jeff Bradberry
76d4de24df Handle a change in the error message for BooleanField
related encode/django-rest-framework#5881
2019-06-12 14:12:59 -04:00
beeankha
6fb173da8a Remove redundant methods from SocialAuthMiddleware class 2019-05-15 12:54:00 -04:00
beeankha
68800d0e8e Make custom middleware use new style vs old 2019-05-14 13:37:34 -04:00
AlanCoding
8c2b3e9b84 Fix Django 2.0 deprecation warnings 2019-04-22 14:17:14 -04:00
Ryan Petrello
85898fd708 remove more unnecessary feature flagging for AUTHENTICATION_BACKENDS 2019-04-12 11:28:27 -04:00
beeankha
de34a64115 Basic License feature gating changes 2019-04-12 11:28:27 -04:00
Ryan Petrello
9bebf3217e remove usage of import * and enforce F405 in our linter
import * is a scourge upon the earth
2019-02-13 17:10:33 -05:00
Ryan Petrello
daeeaf413a clean up unnecessary usage of the six library (awx only supports py3) 2019-01-25 00:19:48 -05:00
Ryan Petrello
8cb8e63db5 fix a py3 bug that breaks the SSO complete endpoint 2019-01-21 17:04:13 -05:00
Ryan Petrello
e45e4b3cda fix a deadlock when Python garbage collects LDAPBackend objects
we shouldn't call signal.disconnect in __del__ because it can lead to
deadlocks in Django signal dispatch code

The Signal.connect, Signal.disconnect, and Signal._live_receivers
methods all share a threading.Lock():

22a60f8d0b/django/dispatch/dispatcher.py (L49)

It's possible for this to lead to a deadlock:

1.  Have code that calls Signal._live_receivers and enter the critical
    path inside the shared threading.Lock()
2.  Python garbage collection occurs and finds one or more LDAPBackend
    objects with no more references
3.  This __del__ is called, which calls Signal.disconnect
4.  Code in Signal._disconnect attempts to obtain the (already held)
    threading.Lock
5.  Python hangs forever while attempting to garbage collect
2019-01-18 11:27:50 -05:00
Ryan Petrello
af4234556e remove dm.xmlsec.binding
python-saml uses dm.xmlsec.binding only supports python2
by moving to py3, we now use python3-saml (which uses python-xmlsec
instead)

see: https://github.com/onelogin/python-saml/issues/145#issuecomment-222021691
2019-01-15 14:09:05 -05:00
Ryan Petrello
f223df303f convert py2 -> py3 2019-01-15 14:09:01 -05:00
adamscmRH
05d988349c make current_user ck secure and httponly 2018-11-21 10:36:35 -05:00
Ryan Petrello
d3dc126d45 truncate user first/last name if it exceeds 30 chars on LDAP auth 2018-11-14 15:51:43 -05:00
chris meyers
2e98446394 fix issue with ldap queries containing unicode 2018-10-12 10:33:01 -04:00
Ryan Petrello
27f4e487ec simpilfy LDAP GROUP_SEARCH misconfiguration failure handling 2018-08-02 10:11:18 -04:00
Ryan Petrello
2102c1ef0a fix a bug in multi-LDAP authentication
see: https://github.com/ansible/tower/issues/2738
2018-08-01 17:55:13 -04:00
Bill Nottingham
80abe4b937 Merge pull request #2387 from wenottingham/certificates-for-everyone
Require certpair for SAML.
2018-07-30 22:32:05 -04:00
Ryan Petrello
78eb0444ae fix a bug that causes orphaned auth_user rows when LDAP is misconfigured
see: https://github.com/ansible/tower/issues/2465
2018-07-30 09:59:20 -04:00
chris meyers
3fcd1575c1 fix saml_admin_attr 2018-07-23 10:08:18 -04:00
Jijo Varghese
e1dde21ec3 ldap attributes filter in user_groups()
ldap search currently fetches ALL attributes which is a waste of bandwidth resources and
woefully slow on large ldap groups when it only needs to parse the name_attr

Signed-off-by: Jijo Varghese <jijojv@gmail.com>
2018-07-18 16:51:21 -04:00
Antony PERIGAULT
53b5291a56 Fix functional tests 2018-07-16 17:03:00 -04:00
Antony PERIGAULT
3b6ab6217b New feature: Add SAML users as organization admins 2018-07-16 17:02:53 -04:00
Antony PERIGAULT
6ec2228885 Revert "Map users in organizations based on saml groups"
This reverts commit b4e0ff650165e6b0ab08d9a78be85f2f46182b94.
2018-07-16 17:02:46 -04:00
Antony PERIGAULT
062c18efa0 Map users in organizations based on saml groups 2018-07-16 17:02:38 -04:00
Bill Nottingham
fa5132991f Require certpair for SAML. 2018-07-05 11:12:00 -04:00
adamscmRH
8cc77234fc revert django-radius from 1.3.3 to 1.1.0 2018-06-22 15:01:11 -04:00
Ryan Petrello
c3bda8e259 properly detect settings.AUTHENTICATION_BACKEND changes for SSO logins
see: https://github.com/ansible/tower/issues/1979
2018-06-12 15:24:09 -04:00
Ryan Petrello
28a42850a2 allow AUTH_LDAP_USER_FLAGS_BY_GROUP to specify an OR'd list for a flag
see: https://github.com/ansible/tower/issues/968
2018-05-23 14:45:46 -04:00
chris meyers
04767641af isolate cache 2018-05-17 12:58:11 -04:00
adamscmRH
90308066af update radius backend for dr1.3.3 2018-04-25 15:04:46 -04:00
adamscmRH
3627c713fa fix multiple auth backends 2018-04-20 13:34:51 -04:00