Commit Graph

92 Commits

Author SHA1 Message Date
Matthew Jones
b39db745d4 Integrate a migration-detector middleware
This attempts to detect if there are migrations in-progress and will
force display an interstitial page in the process that attempts to
load the index page every 10s until it succeeds.

This is only attached in production settings so the development
environment can proceed even if the migrations haven't been applied yet
2017-09-11 11:09:45 -04:00
Patrick Uiterwijk
830012e2f4 Fix using SAML NameID
Without this patch, SAML backend will only use the first letter of the NameID as attribute value.

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
2017-09-07 20:54:27 +00:00
Chris Meyers
022de2aa3e Merge pull request #314 from chrismeyersfsu/fix-session_deletion
do not re-create django session on every request
2017-08-22 09:38:37 -04:00
Chris Meyers
45813bea16 do not re-create django session on every request
* The django middleware call stack behavior is changed by DRF. As a
result, during the process_request in sso/middlware.py request.user
is not set as you would expect it to be set from the middleware
django.contrib.auth.middleware.AuthenticationMiddleware
2017-08-21 11:19:52 -04:00
Aaron Tan
0121e5c22b Update API help text for Tower configuration. 2017-08-18 15:02:12 -04:00
Aaron Tan
1e77f909a5 Force providing TACACSPLUS_SECRET when TACACSPLUS_HOST is set 2017-08-07 12:12:05 -04:00
Aaron Tan
c1e16c2f46 Merge pull request #73 from jangsutsr/6986_make_up_default_values_for_tower_config
Make up default values for tower configurations
2017-08-01 20:33:41 -04:00
Ryan Petrello
147d795fa0 force python-ldap to create a new SSL context for OPT_X_TLS_REQUIRE_CERT
according to the internet, this is a thing that is necessary for
python-ldap:

71024518db (diff-1a5a32c6cc1ae9767cb2008703e4534fR41)
https://stackoverflow.com/a/29722445
https://stackoverflow.com/a/38136255

see: https://github.com/ansible/ansible-tower/issues/7335
2017-07-31 13:59:36 -04:00
Chris Meyers
ed8db2419e make specific saml fields required 2017-07-31 09:28:52 -04:00
Aaron Tan
e8bd477f1e Make up default values for tower configurations 2017-07-27 15:02:25 -04:00
Wayne Witzel III
5d167cafa2 Revert "Merge pull request #39 from wwitzel3/issue-7260"
This reverts commit 6cd0592781, reversing
changes made to 943a40eb40.
2017-07-27 11:32:09 -04:00
Matthew Jones
2b1bcc23be Merge branch 'purge_ansible_name' into release_3.2.0
* purge_ansible_name:
  Remove ansible reference from dev PKG-INFO
  Add back in PRIVILEGE_ESCALATION_METHODS inadvertantly removed
  Add awx_ and AWX_ environment vars and extra_vars alongside Tower
  Refactor some tower periodic tasks to label as awx
  Refactor Notification backend for tower -> awx
  Refactor fact cache plugin from tower -> awx
  Rename tower display plugins to awx display
  Mass rename from ansible_(awx|tower) -> (awx|tower)
2017-07-26 23:06:55 -04:00
Matthew Jones
c7a85d9738 Mass rename from ansible_(awx|tower) -> (awx|tower) 2017-07-26 13:33:26 -04:00
Wayne Witzel III
f6d59409de Fixing cookie settings for CSRF and auth token 2017-07-25 10:11:52 -04:00
Bill Nottingham
8482ed0432 Merge pull request #6818 from wenottingham/i-have-no-idea-what-im-doing
SAML configuration changes based on feedback from field.
2017-07-14 17:05:50 -04:00
Aaron Tan
c6ed70dd9d Merge pull request #6928 from jangsutsr/6904_strengthen_attribute_check_for_tower_conf_validators
Strengthen attribute check for Tower configuration validations
2017-07-12 13:30:44 -04:00
Aaron Tan
3fe12e77b7 Merge pull request #6837 from jangsutsr/6107_ldap_setting_field_validator_updates
LDAP setting fields validation updates.
2017-07-12 12:09:48 -04:00
Aaron Tan
0138510936 Strengthen attribute check for Tower configuration validations 2017-07-07 11:44:56 -04:00
Bill Nottingham
f8515857b2 Remove assorted references to Tower.
Reword and remove references to Tower so they don't need parameterized.
2017-07-05 16:42:47 -04:00
Aaron Tan
2c69d433e9 LDAP setting fields validation updates. 2017-06-30 15:30:59 -04:00
Bill Nottingham
d0a19d4f21 Fix flake8 2017-06-29 18:04:38 -04:00
Bill Nottingham
b1e6264ac0 SAML configuration changes based on feedback from field.
1. Default SOCIAL_AUTH_SAML_SP_ENTITY_ID to the Tower hostname/base URL.
2. Refer to the callback URL as the Assertion Consumer Service, per common SAML notation.
2017-06-29 16:33:34 -04:00
Aaron Tan
a184058aa2 Merge pull request #6642 from jangsutsr/6593_enforce_mutual_exclusiveness_of_tower_user_origins
Expand scope of enterprise user types
2017-06-29 12:15:07 -04:00
Aaron Tan
5e398e4a25 Add Tower configuration category validation for TACACS+ 2017-06-26 10:58:05 -04:00
Aaron Tan
70cccb0e57 Expand scope of enterprise user types. 2017-06-20 12:17:13 -04:00
Aaron Tan
3094527759 Fix usage of tacacs API 2017-05-31 11:49:03 -04:00
Aaron Tan
1eca41ce92 Merge pull request #6332 from jangsutsr/5943_simplify_tower_config_help_texts
Simplify Tower configuration help texts
2017-05-29 10:16:38 -04:00
Aaron Tan
2476c42b1e Simplify Tower configuration help texts. 2017-05-24 09:51:54 -04:00
Aaron Tan
a15bc6d0f7 Merge pull request #6295 from jangsutsr/6243_update_user_profile_to_record_source_backend
Introduce sso UserEnterpriseAuth model
2017-05-24 09:42:41 -04:00
Aaron Tan
d314f83416 Introduce sso UserEnterpriseAuth model. 2017-05-22 13:30:00 -04:00
Aaron Tan
4f9875f895 Prevent LDAP user from imposing existing Tower user. 2017-05-18 16:39:58 -04:00
Aaron Tan
f5e58922ab Create tacacs and radius users with password disabled. 2017-05-09 16:36:50 -04:00
Aaron Tan
7a6364c642 Prevent third-party-based user from imposing tower user. 2017-05-04 17:31:57 -04:00
Matthew Jones
e1e83598e9 Merge branch 'release_3.1.3' into devel
* release_3.1.3: (52 commits)
  ack fact scan messages
  making ldap user/group search fields into codemirror instances
  removing UI parsing for LDAP User and Group Search fields
  Allow exception view to accept all valid HTTP methods.
  Restore ability of parsing extra_vars string for provisioning callback.
  Fix up backup/restore role broken in f7a8e45809758322d9ee41c5305850dd70ed5faf
  Stop / start ansible-tower-service during restores
  value_to_python should encode lookup fields as ascii
  fix brace interpolation on standard out pane
  Adjust some hardcoded usages of 'awx' to use 'aw_user' and 'aw_group'.
  Pull Spanish updates from Zanata
  Temporarily grant awx user createdb role
  Stop giving ownership of backups to postgres
  don't display chunked lines'
  Add dropdown li truncation with ellipsis
  CTiT -> adhoc modules should allow the user to add new modules
  Remove task that was replacing the supervisor systemd tmp file
  Fix failing supervisorctl commands on RH-based distros
  Give ownership of the supervisor socket to awx
  Setting for external log emissions cert verification
  ...
2017-04-28 13:57:04 -04:00
Aaron Tan
07198a5ba6 Acceptance Docs. 2017-04-12 16:19:42 -04:00
Aaron Tan
fd4aaa6ca9 Implement tacacs+ auth backend. 2017-04-12 16:19:42 -04:00
Aaron Tan
f2c99eeaf5 Basic tacacs+ CTiT. 2017-04-12 16:19:42 -04:00
Ryan Petrello
d1eb33bca0 Be more restrictive in catching LDAP exceptions.
django-auth-ldap can throw exceptions, like TypeError if it's
misconfigured.  If we encounter an exception attempting to log into an
LDAP server, log it and move on (otherwise, an uncaught exception will
cause local login to fail, too).

see: #5933
2017-04-11 16:43:26 -04:00
Ryan Petrello
ec52e18be8 allow is_system_auditor with AUTH_LDAP_USER_FLAGS_BY_GROUP
see: #4959
2017-03-07 16:48:51 -05:00
Matthew Jones
2c7dd8497b Filter on reason also when logging in via sso and picking authtoken 2017-03-07 13:54:52 -05:00
Ryan Petrello
045994a472 properly detect the backend name in failed social_auth callbacks
don't assume that the callback URL contains the correct social_auth
backend name; instead, store it temporarily in the session at
`/login/sso/`

see: #5324
2017-02-14 16:19:39 -05:00
Ryan Petrello
f4d55659f0 enforce a sane default OPT_NETWORK_TIMEOUT for LDAP connections
see: #5208
2017-02-07 12:37:05 -05:00
Ryan Petrello
ea4682e782 catch and log LDAP auth plugin misconfigurations
see: #5204
2017-02-06 16:27:22 -05:00
Ryan Petrello
5bd670291b default certain LDAP settings to None instead of an empty string
Related: #5148 #4678
2017-02-02 13:06:59 -05:00
Ryan Petrello
f347bc5ae4 fix a typo that results in a NameError
Resolves #4861
2017-01-25 14:08:49 -05:00
Ryan Petrello
0bcbaa5c86 allow certain LDAP settings fields to be nullable
necessary to completely resolve #4678
2017-01-24 09:31:44 -05:00
Ryan Petrello
40a5c6cc0b fix an LDAP settings bug which can cause LDAP auth to fail
django-ldap-auth expects the "unset/empty" state of certain LDAP DN
settings (such as AUTH_LDAP_REQUIRE_GROUP and
AUTH_LDAP_USER_DN_TEMPLATE) to be NULL/None (not an empty string).

Resolves #4678
2017-01-23 15:35:23 -05:00
Alan Rominger
c39c62973b Merge pull request #4574 from AlanCoding/4519
Provide __init__ arg for LDAP group type
2017-01-06 13:28:14 -05:00
AlanCoding
983bee115c provide default for permanent attribute in redirect view before Django 1.9 hits 2017-01-04 15:06:10 -05:00
AlanCoding
2e220beda4 provide __init__ arg for LDAP group type 2017-01-04 10:51:20 -05:00