From 4db010b0078dc3c9da58160e093849ffcbc25c14 Mon Sep 17 00:00:00 2001 From: Luis Date: Mon, 10 Jun 2019 13:25:21 -0400 Subject: [PATCH 01/13] [ADD] Auth SAML create users --- auth_saml_create_user/README.rst | 93 ++++ auth_saml_create_user/__init__.py | 4 + auth_saml_create_user/__manifest__.py | 27 ++ auth_saml_create_user/models/__init__.py | 5 + auth_saml_create_user/models/auth_saml.py | 12 + auth_saml_create_user/models/res_users.py | 74 +++ auth_saml_create_user/readme/CONTRIBUTORS.rst | 6 + auth_saml_create_user/readme/CREDITS.rst | 3 + auth_saml_create_user/readme/DESCRIPTION.rst | 2 + auth_saml_create_user/readme/USAGE.rst | 3 + .../security/ir.model.access.csv | 2 + .../static/description/index.html | 441 ++++++++++++++++++ auth_saml_create_user/views/auth_saml.xml | 13 + 13 files changed, 685 insertions(+) create mode 100644 auth_saml_create_user/README.rst create mode 100644 auth_saml_create_user/__init__.py create mode 100644 auth_saml_create_user/__manifest__.py create mode 100644 auth_saml_create_user/models/__init__.py create mode 100644 auth_saml_create_user/models/auth_saml.py create mode 100644 auth_saml_create_user/models/res_users.py create mode 100644 auth_saml_create_user/readme/CONTRIBUTORS.rst create mode 100644 auth_saml_create_user/readme/CREDITS.rst create mode 100644 auth_saml_create_user/readme/DESCRIPTION.rst create mode 100644 auth_saml_create_user/readme/USAGE.rst create mode 100644 auth_saml_create_user/security/ir.model.access.csv create mode 100644 auth_saml_create_user/static/description/index.html create mode 100644 auth_saml_create_user/views/auth_saml.xml diff --git a/auth_saml_create_user/README.rst b/auth_saml_create_user/README.rst new file mode 100644 index 0000000000..002f8bd6dc --- /dev/null +++ b/auth_saml_create_user/README.rst @@ -0,0 +1,93 @@ +===================== +Auth SAML Create User +===================== + +.. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + !! This file is generated by oca-gen-addon-readme !! + !! changes will be overwritten. !! + !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png + :target: https://odoo-community.org/page/development-status + :alt: Beta +.. |badge2| image:: https://img.shields.io/badge/licence-LGPL--3-blue.png + :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html + :alt: License: LGPL-3 +.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github + :target: https://github.com/OCA/server-auth/tree/11.0/auth_saml_create_user + :alt: OCA/server-auth +.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png + :target: https://translation.odoo-community.org/projects/server-auth-11-0/server-auth-11-0-auth_saml_create_user + :alt: Translate me on Weblate +.. |badge5| image:: https://img.shields.io/badge/runbot-Try%20me-875A7B.png + :target: https://runbot.odoo-community.org/runbot/251/11.0 + :alt: Try me on Runbot + +|badge1| |badge2| |badge3| |badge4| |badge5| + +This module extends the functionality of Auth SAML to support the automatic creation of +SAML users when they don't exist in odoo. + +**Table of contents** + +.. contents:: + :local: + +Usage +===== + +To use this module, you need to: + +#. Check to true the create user option in the SAML Provider configuration + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues `_. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us smashing it by providing a detailed and welcomed +`feedback `_. + +Do not contact contributors directly about support or help with technical issues. + +Credits +======= + +Authors +~~~~~~~ + +* Savoir-faire Linux + +Contributors +~~~~~~~~~~~~ + +* Luis Garcia(luis.garcia@savoirfairelinux.com) +* Jerome Oufella(jerome.oufella@savoirfairelinux.com) +* Rim Ben Dhaou +* Larbi Gharib +* Pierre Gault +* William Beverly + +Other credits +~~~~~~~~~~~~~ + +The development of this module has been financially supported by: + +* Savoir-faire Linux + +Maintainers +~~~~~~~~~~~ + +This module is maintained by the OCA. + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +This module is part of the `OCA/server-auth `_ project on GitHub. + +You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/auth_saml_create_user/__init__.py b/auth_saml_create_user/__init__.py new file mode 100644 index 0000000000..17bd1660bd --- /dev/null +++ b/auth_saml_create_user/__init__.py @@ -0,0 +1,4 @@ +# © 2019 Savoir-faire Linux +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). + +from . import models diff --git a/auth_saml_create_user/__manifest__.py b/auth_saml_create_user/__manifest__.py new file mode 100644 index 0000000000..c1c3082408 --- /dev/null +++ b/auth_saml_create_user/__manifest__.py @@ -0,0 +1,27 @@ +# © 2019 Savoir-faire Linux +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). + +{ + 'name': "Auth SAML Create User", + + 'summary': """ + Short (1 phrase/line) summary of the module's purpose, used as + subtitle on modules listing or apps.openerp.com""", + + 'description': """ + Long description of module's purpose + """, + 'author': 'Savoir-faire Linux', + 'maintainer': 'Savoir-faire Linux', + 'website': 'http://www.savoirfairelinux.com', + 'license': 'LGPL-3', + 'category': 'Tools', + 'version': '11.1', + 'depends': [ + 'base', + 'auth_saml' + ], + 'data': [ + 'views/auth_saml.xml', + ], +} diff --git a/auth_saml_create_user/models/__init__.py b/auth_saml_create_user/models/__init__.py new file mode 100644 index 0000000000..edb757f22a --- /dev/null +++ b/auth_saml_create_user/models/__init__.py @@ -0,0 +1,5 @@ +# © 2018 Savoir-faire Linux +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). + +from . import auth_saml +from . import res_users diff --git a/auth_saml_create_user/models/auth_saml.py b/auth_saml_create_user/models/auth_saml.py new file mode 100644 index 0000000000..3f11969599 --- /dev/null +++ b/auth_saml_create_user/models/auth_saml.py @@ -0,0 +1,12 @@ +# Copyright (C) 2010-2016 XCG Consulting +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). + +from odoo import fields, models + + +class AuthSamlProvider(models.Model): + _inherit = ['auth.saml.provider'] + + create_user = fields.Boolean( + string='Create User', + ) diff --git a/auth_saml_create_user/models/res_users.py b/auth_saml_create_user/models/res_users.py new file mode 100644 index 0000000000..8789caeec1 --- /dev/null +++ b/auth_saml_create_user/models/res_users.py @@ -0,0 +1,74 @@ +# © 2019 Savoir-faire Linux +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). + +import logging + +from odoo import api, models +from odoo.exceptions import AccessDenied + +_logger = logging.getLogger(__name__) + + +class Users(models.Model): + _inherit = "res.users" + + @api.multi + def _auth_saml_signin(self, provider, validation, saml_response): + """ retrieve and sign into openerp the user corresponding to provider + and validated access token + + :param provider: saml provider id (int) + :param validation: result of validation of access token (dict) + :param saml_response: saml parameters response from the IDP + :return: user login (str) + :raise: openerp.exceptions.AccessDenied if signin failed + + This method can be overridden to add alternative signin methods. + """ + token_osv = self.env['auth_saml.token'] + saml_uid = validation['user_id'] + + user_ids = self.search( + [('saml_uid', '=', saml_uid), ('saml_provider_id', '=', provider)]) + + if user_ids: + # TODO replace assert by proper raise... asserts do not execute in + # production code... + assert len(user_ids) == 1 + user = user_ids[0] + + # now find if a token for this user/provider already exists + token_ids = token_osv.search( + [('saml_provider_id', '=', provider), ('user_id', '=', user.id)]) + + if token_ids: + token_ids.write({'saml_access_token': saml_response}) + else: + token_osv.create({'saml_access_token': saml_response, + 'saml_provider_id': provider, + 'user_id': user.id + }) + return user.login + elif self.env['auth.saml.provider'].browse(provider).create_user: + _logger.debug("Creating new Odoo user \"%s\" from LDAP" % saml_uid) + # This following line is to create user with default template + # values = self.map_ldap_attributes(conf, saml_uid, ldap_entry) + SudoUser = self.env['res.users'].sudo() + # if conf['user']: + # values['active'] = True + # user_id = SudoUser.browse(conf['user'][0]).copy(default=values).id + new_user = SudoUser.create({ + 'name': saml_uid, + 'login': saml_uid, + 'saml_provider_id': provider, + 'company_id': self.env['res.company'].sudo().browse(1).id, + 'saml_uid': saml_uid + }) + new_user.write({'saml_uid': saml_uid}) + token_osv.create({'saml_access_token': saml_response, + 'saml_provider_id': provider, + 'user_id': new_user.id + }) + return new_user.login + else: + raise AccessDenied() diff --git a/auth_saml_create_user/readme/CONTRIBUTORS.rst b/auth_saml_create_user/readme/CONTRIBUTORS.rst new file mode 100644 index 0000000000..c9d627a072 --- /dev/null +++ b/auth_saml_create_user/readme/CONTRIBUTORS.rst @@ -0,0 +1,6 @@ +* Luis Garcia(luis.garcia@savoirfairelinux.com) +* Jerome Oufella(jerome.oufella@savoirfairelinux.com) +* Rim Ben Dhaou +* Larbi Gharib +* Pierre Gault +* William Beverly diff --git a/auth_saml_create_user/readme/CREDITS.rst b/auth_saml_create_user/readme/CREDITS.rst new file mode 100644 index 0000000000..d030eac6fc --- /dev/null +++ b/auth_saml_create_user/readme/CREDITS.rst @@ -0,0 +1,3 @@ +The development of this module has been financially supported by: + +* Savoir-faire Linux diff --git a/auth_saml_create_user/readme/DESCRIPTION.rst b/auth_saml_create_user/readme/DESCRIPTION.rst new file mode 100644 index 0000000000..564528b8df --- /dev/null +++ b/auth_saml_create_user/readme/DESCRIPTION.rst @@ -0,0 +1,2 @@ +This module extends the functionality of Auth SAML to support the automatic creation of +SAML users when they don't exist in odoo. diff --git a/auth_saml_create_user/readme/USAGE.rst b/auth_saml_create_user/readme/USAGE.rst new file mode 100644 index 0000000000..f408e63803 --- /dev/null +++ b/auth_saml_create_user/readme/USAGE.rst @@ -0,0 +1,3 @@ +To use this module, you need to: + +#. Check to true the create user option in the SAML Provider configuration diff --git a/auth_saml_create_user/security/ir.model.access.csv b/auth_saml_create_user/security/ir.model.access.csv new file mode 100644 index 0000000000..96aaf52a23 --- /dev/null +++ b/auth_saml_create_user/security/ir.model.access.csv @@ -0,0 +1,2 @@ +id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink +access_auth_saml_create_user_auth_saml_create_user,auth_saml_create_user.auth_saml_create_user,model_auth_saml_create_user_auth_saml_create_user,,1,0,0,0 \ No newline at end of file diff --git a/auth_saml_create_user/static/description/index.html b/auth_saml_create_user/static/description/index.html new file mode 100644 index 0000000000..c7d3694a37 --- /dev/null +++ b/auth_saml_create_user/static/description/index.html @@ -0,0 +1,441 @@ + + + + + + +Auth SAML Create User + + + +
+

Auth SAML Create User

+ + +

Beta License: LGPL-3 OCA/server-auth Translate me on Weblate Try me on Runbot

+

This module extends the functionality of Auth SAML to support the automatic creation of +SAML users when they don’t exist in odoo.

+

Table of contents

+ +
+

Usage

+

To use this module, you need to:

+
    +
  1. Check to true the create user option in the SAML Provider configuration
    2. +
+
+
+

Bug Tracker

+

Bugs are tracked on GitHub Issues. +In case of trouble, please check there if your issue has already been reported. +If you spotted it first, help us smashing it by providing a detailed and welcomed +feedback.

+

Do not contact contributors directly about support or help with technical issues.

+
+
+

Credits

+
+

Authors

+
    +
  • Savoir-faire Linux
    • +
+
+ +
+

Other credits

+

The development of this module has been financially supported by:

+
    +
  • Savoir-faire Linux
    • +
+
+
+

Maintainers

+

This module is maintained by the OCA.

+Odoo Community Association +

OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use.

+

This module is part of the OCA/server-auth project on GitHub.

+

You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.

+
+
+
+ + diff --git a/auth_saml_create_user/views/auth_saml.xml b/auth_saml_create_user/views/auth_saml.xml new file mode 100644 index 0000000000..86670f3fc7 --- /dev/null +++ b/auth_saml_create_user/views/auth_saml.xml @@ -0,0 +1,13 @@ + + + + auth.saml.provider.form.inherit + auth.saml.provider + + + + + + + + From 63b47d5187902254431aded5c6891975d6cd875d Mon Sep 17 00:00:00 2001 From: Luis Date: Mon, 10 Jun 2019 13:57:25 -0400 Subject: [PATCH 02/13] [FIX] Create user only when it doesn't exist [FIX] Flake8 & pylint [FIX] manifest [FIX] manifest [UPD] auth_saml_create_user/models/auth_saml.py Co-Authored-By: Rim BEN DHAOU Apply suggestions from code review [ADD] Tests [ADD] Tests [ADD] Starting random password [FIX Imports and pep8] [UPD] Tests [FIX] empty password [FIX] exception not needed [FIX] password not needed in write [UPD] Create saml pass string [ADD] test secret problem [FIX] secret null [ADD]tests: teradown method [FIX] not need teardown [FIX] manifest [FIX] License [FIX] Maintainers and development_status Update __manifest__.py --- auth_saml_create_user/README.rst | 27 ++-- auth_saml_create_user/__init__.py | 2 +- auth_saml_create_user/__manifest__.py | 24 ++- .../data/auth_saml_create_user.xml | 84 +++++++++++ auth_saml_create_user/models/__init__.py | 2 +- auth_saml_create_user/models/auth_saml.py | 2 +- auth_saml_create_user/models/res_users.py | 82 +++-------- auth_saml_create_user/readme/CREDITS.rst | 2 + .../security/ir.model.access.csv | 3 +- .../static/description/index.html | 7 +- auth_saml_create_user/tests/__init__.py | 5 + auth_saml_create_user/tests/arguments.py | 138 ++++++++++++++++++ auth_saml_create_user/tests/common.py | 20 +++ .../tests/test_auth_saml_create_users.py | 30 ++++ 14 files changed, 340 insertions(+), 88 deletions(-) create mode 100644 auth_saml_create_user/data/auth_saml_create_user.xml create mode 100644 auth_saml_create_user/tests/__init__.py create mode 100644 auth_saml_create_user/tests/arguments.py create mode 100644 auth_saml_create_user/tests/common.py create mode 100644 auth_saml_create_user/tests/test_auth_saml_create_users.py diff --git a/auth_saml_create_user/README.rst b/auth_saml_create_user/README.rst index 002f8bd6dc..a8752d1a89 100644 --- a/auth_saml_create_user/README.rst +++ b/auth_saml_create_user/README.rst @@ -7,23 +7,20 @@ Auth SAML Create User !! changes will be overwritten. !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png - :target: https://odoo-community.org/page/development-status - :alt: Beta -.. |badge2| image:: https://img.shields.io/badge/licence-LGPL--3-blue.png - :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html - :alt: License: LGPL-3 -.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github +.. |badge1| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png + :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html + :alt: License: AGPL-3 +.. |badge2| image:: https://img.shields.io/badge/github-OCA%2Fserver--auth-lightgray.png?logo=github :target: https://github.com/OCA/server-auth/tree/11.0/auth_saml_create_user :alt: OCA/server-auth -.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png +.. |badge3| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png :target: https://translation.odoo-community.org/projects/server-auth-11-0/server-auth-11-0-auth_saml_create_user :alt: Translate me on Weblate -.. |badge5| image:: https://img.shields.io/badge/runbot-Try%20me-875A7B.png +.. |badge4| image:: https://img.shields.io/badge/runbot-Try%20me-875A7B.png :target: https://runbot.odoo-community.org/runbot/251/11.0 :alt: Try me on Runbot -|badge1| |badge2| |badge3| |badge4| |badge5| +|badge1| |badge2| |badge3| |badge4| This module extends the functionality of Auth SAML to support the automatic creation of SAML users when they don't exist in odoo. @@ -74,6 +71,8 @@ Other credits The development of this module has been financially supported by: * Savoir-faire Linux +* Odoo Community Association (OCA) + Maintainers ~~~~~~~~~~~ @@ -88,6 +87,14 @@ OCA, or the Odoo Community Association, is a nonprofit organization whose mission is to support the collaborative development of Odoo features and promote its widespread use. +.. |maintainer-eilst| image:: https://github.com/eilst.png?size=40px + :target: https://github.com/eilst + :alt: eilst + +Current `maintainer `__: + +|maintainer-eilst| + This module is part of the `OCA/server-auth `_ project on GitHub. You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute. diff --git a/auth_saml_create_user/__init__.py b/auth_saml_create_user/__init__.py index 17bd1660bd..2041038ef5 100644 --- a/auth_saml_create_user/__init__.py +++ b/auth_saml_create_user/__init__.py @@ -1,4 +1,4 @@ # © 2019 Savoir-faire Linux -# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). from . import models diff --git a/auth_saml_create_user/__manifest__.py b/auth_saml_create_user/__manifest__.py index c1c3082408..5174ebb148 100644 --- a/auth_saml_create_user/__manifest__.py +++ b/auth_saml_create_user/__manifest__.py @@ -1,27 +1,23 @@ # © 2019 Savoir-faire Linux -# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). { 'name': "Auth SAML Create User", - 'summary': """ - Short (1 phrase/line) summary of the module's purpose, used as - subtitle on modules listing or apps.openerp.com""", - - 'description': """ - Long description of module's purpose - """, - 'author': 'Savoir-faire Linux', - 'maintainer': 'Savoir-faire Linux', - 'website': 'http://www.savoirfairelinux.com', - 'license': 'LGPL-3', + This module extends the functionality of Auth SAML to support + the automatic creation of SAML users when they don't exist in odoo.""", + 'author': 'Savoir-faire Linux, Odoo Community Association (OCA)', + 'maintainers': ['eilst'], + 'website': 'https://github.com/OCA/server-auth', + 'license': 'AGPL-3', 'category': 'Tools', - 'version': '11.1', + 'version': '11.0.1.0.0', 'depends': [ - 'base', 'auth_saml' ], 'data': [ + 'data/auth_saml_create_user.xml', 'views/auth_saml.xml', ], + 'development_status': 'Stable', } diff --git a/auth_saml_create_user/data/auth_saml_create_user.xml b/auth_saml_create_user/data/auth_saml_create_user.xml new file mode 100644 index 0000000000..2975073b61 --- /dev/null +++ b/auth_saml_create_user/data/auth_saml_create_user.xml @@ -0,0 +1,84 @@ + + + + Local Authentic server + True + + + + + + + MIIDXTCCAkWgAwIBAgIJALmVVuDWu4NYMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTYxMjMxMTQzNDQ3WhcNNDgwNjI1MTQzNDQ3WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzUCFozgNb1h1M0jzNRSCjhOBnR+uVbVpaWfXYIR+AhWDdEe5ryY+CgavOg8bfLybyzFdehlYdDRgkedEB/GjG8aJw06l0qF4jDOAw0kEygWCu2mcH7XOxRt+YAH3TVHa/Hu1W3WjzkobqqqLQ8gkKWWM27fOgAZ6GieaJBN6VBSMMcPey3HWLBmc+TYJmv1dbaO2jHhKh8pfKw0W12VM8P1PIO8gv4Phu/uuJYieBWKixBEyy0lHjyixYFCR12xdh4CA47q958ZRGnnDUGFVE1QhgRacJCOZ9bd5t9mr8KLaVBYTCJo5ERE8jymab5dPqe5qKfJsCZiqWglbjUo9twIDAQABo1AwTjAdBgNVHQ4EFgQUxpuwcs/CYQOyui+r1G+3KxBNhxkwHwYDVR0jBBgwFoAUxpuwcs/CYQOyui+r1G+3KxBNhxkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAAiWUKs/2x/viNCKi3Y6blEuCtAGhzOOZ9EjrvJ8+COH3Rag3tVBWrcBZ3/uhhPq5gy9lqw4OkvEws99/5jFsX1FJ6MKBgqfuy7yh5s1YfM0ANHYczMmYpZeAcQf2CGAaVfwTTfSlzNLsF2lW/ly7yapFzlYSJLGoVE+OHEu8g5SlNACUEfkXw+5Eghh+KzlIN7R6Q7r2ixWNFBC/jWf7NKUfJyX8qIG5md1YUeT6GBW9Bm2/1/RiO24JTaYlfLdKK9TYb8sG5B+OLab2DImG99CJ25RkAcSobWNF5zD0O6lgOo3cEdB/ksCq3hmtlC/DlLZ/D8CJ+7VuZnS1rR2naQ== + + + + + + + MIIDXTCCAkWgAwIBAgIJALmVVuDWu4NYMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTYxMjMxMTQzNDQ3WhcNNDgwNjI1MTQzNDQ3WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzUCFozgNb1h1M0jzNRSCjhOBnR+uVbVpaWfXYIR+AhWDdEe5ryY+CgavOg8bfLybyzFdehlYdDRgkedEB/GjG8aJw06l0qF4jDOAw0kEygWCu2mcH7XOxRt+YAH3TVHa/Hu1W3WjzkobqqqLQ8gkKWWM27fOgAZ6GieaJBN6VBSMMcPey3HWLBmc+TYJmv1dbaO2jHhKh8pfKw0W12VM8P1PIO8gv4Phu/uuJYieBWKixBEyy0lHjyixYFCR12xdh4CA47q958ZRGnnDUGFVE1QhgRacJCOZ9bd5t9mr8KLaVBYTCJo5ERE8jymab5dPqe5qKfJsCZiqWglbjUo9twIDAQABo1AwTjAdBgNVHQ4EFgQUxpuwcs/CYQOyui+r1G+3KxBNhxkwHwYDVR0jBBgwFoAUxpuwcs/CYQOyui+r1G+3KxBNhxkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAAiWUKs/2x/viNCKi3Y6blEuCtAGhzOOZ9EjrvJ8+COH3Rag3tVBWrcBZ3/uhhPq5gy9lqw4OkvEws99/5jFsX1FJ6MKBgqfuy7yh5s1YfM0ANHYczMmYpZeAcQf2CGAaVfwTTfSlzNLsF2lW/ly7yapFzlYSJLGoVE+OHEu8g5SlNACUEfkXw+5Eghh+KzlIN7R6Q7r2ixWNFBC/jWf7NKUfJyX8qIG5md1YUeT6GBW9Bm2/1/RiO24JTaYlfLdKK9TYb8sG5B+OLab2DImG99CJ25RkAcSobWNF5zD0O6lgOo3cEdB/ksCq3hmtlC/DlLZ/D8CJ+7VuZnS1rR2naQ== + + + + + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + +]]> + + + + + MIIENzCCAx+gAwIBAgIJAPd0Z/WpwfcjMA0GCSqGSIb3DQEBCwUAMIGxMQswCQYDVQQGEwJDQTEPMA0GA1UECAwGUXVlYmVjMREwDwYDVQQHDAhNb250cmVhbDEbMBkGA1UECgwSU2F2b2lyLWZhaXJlIExpbnV4MQ0wCwYDVQQLDARPZG9vMSUwIwYDVQQDDBxzdGFnaW5nLWdlc3RldmUudW1vbnRyZWFsLmNhMSswKQYJKoZIhvcNAQkBFhxzdXBwb3J0QHNhdm9pcmZhaXJlbGludXguY29tMB4XDTE4MDgzMDE3MjkxNloXDTI4MDgyNzE3MjkxNlowgbExCzAJBgNVBAYTAkNBMQ8wDQYDVQQIDAZRdWViZWMxETAPBgNVBAcMCE1vbnRyZWFsMRswGQYDVQQKDBJTYXZvaXItZmFpcmUgTGludXgxDTALBgNVBAsMBE9kb28xJTAjBgNVBAMMHHN0YWdpbmctZ2VzdGV2ZS51bW9udHJlYWwuY2ExKzApBgkqhkiG9w0BCQEWHHN1cHBvcnRAc2F2b2lyZmFpcmVsaW51eC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFENv1etOugsnjB/Sn1paHfuhfhz38rs8MBOpAwoqiD74gnCskIWVV5J4D7QRx+v2HHGPZxJhHIKxHVXRJyKZALcaSQnSoPIHmFhs/A+aYb6xjPLgVo+6boZL2KRQ5gWoSKiP24ae//pyTOJnkFBDJw1l8CLsS4vAS2jyuDVBgu1neHPn3xFlmuynbz/fv0SDuQ0LogmLbP5xBOQVJu199e11mGyjZVCeVv149wjjwif+voVGZR5m0A3Hk3KErLpZmG4hY2jlAOKuHE6AOM+EN8qH0m98mPWFPPSe+TEbqQzMp4djP0XGtmBFJjfjvUrXrWBBs/BNFDIoF116f/IbJAgMBAAGjUDBOMB0GA1UdDgQWBBTuOJKRdor1RFsCfgUmV2JLMDtW/TAfBgNVHSMEGDAWgBTuOJKRdor1RFsCfgUmV2JLMDtW/TAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB3wAK+7pznrib0RQg92pf/48mxaxn7kiKhEm06r2Ja5RmfZsEnSh0ZslU7yL84SbA9lSC9eAWf4EKdll4v8c4SkLH/Xe+UDW58xiGAzGZtcKtBpuKfE3SVRTA8gAHB4hZu6WaZ6uUvmLaj+fzd6eY9a7avDDzflbRRikevRVD7GXB6R+7zCF3xDfWTks90JtwjDkJvfvCI5AnvGmbe/CBNdf21QX9qjEdDN9CElsQNFdTagAONxsDYDbftZ8BhoL9hjmprURrCYpB+iuMXLOnKzlnWakF6Nn7qL5/i655PpzwV724RIzD6OFS7SOKy3d9umiKistWI+SIltUD4IvIM + + urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress + + + Savoir-faire Linux + + ]]> + + + + zocial saml + Log in with Authentic + + email + + diff --git a/auth_saml_create_user/models/__init__.py b/auth_saml_create_user/models/__init__.py index edb757f22a..51103236b6 100644 --- a/auth_saml_create_user/models/__init__.py +++ b/auth_saml_create_user/models/__init__.py @@ -1,5 +1,5 @@ # © 2018 Savoir-faire Linux -# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). from . import auth_saml from . import res_users diff --git a/auth_saml_create_user/models/auth_saml.py b/auth_saml_create_user/models/auth_saml.py index 3f11969599..faf92b9a98 100644 --- a/auth_saml_create_user/models/auth_saml.py +++ b/auth_saml_create_user/models/auth_saml.py @@ -5,7 +5,7 @@ class AuthSamlProvider(models.Model): - _inherit = ['auth.saml.provider'] + _inherit = 'auth.saml.provider' create_user = fields.Boolean( string='Create User', diff --git a/auth_saml_create_user/models/res_users.py b/auth_saml_create_user/models/res_users.py index 8789caeec1..84d7895b91 100644 --- a/auth_saml_create_user/models/res_users.py +++ b/auth_saml_create_user/models/res_users.py @@ -1,74 +1,40 @@ # © 2019 Savoir-faire Linux -# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). import logging from odoo import api, models -from odoo.exceptions import AccessDenied +import random _logger = logging.getLogger(__name__) +s = "abcdefghijklmnopqrstuvwxyz034567890ABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()?" +passlen = 16 -class Users(models.Model): +class ResUsers(models.Model): _inherit = "res.users" @api.multi def _auth_saml_signin(self, provider, validation, saml_response): - """ retrieve and sign into openerp the user corresponding to provider - and validated access token - - :param provider: saml provider id (int) - :param validation: result of validation of access token (dict) - :param saml_response: saml parameters response from the IDP - :return: user login (str) - :raise: openerp.exceptions.AccessDenied if signin failed - - This method can be overridden to add alternative signin methods. - """ - token_osv = self.env['auth_saml.token'] saml_uid = validation['user_id'] - user_ids = self.search( [('saml_uid', '=', saml_uid), ('saml_provider_id', '=', provider)]) - - if user_ids: - # TODO replace assert by proper raise... asserts do not execute in - # production code... - assert len(user_ids) == 1 - user = user_ids[0] - - # now find if a token for this user/provider already exists - token_ids = token_osv.search( - [('saml_provider_id', '=', provider), ('user_id', '=', user.id)]) - - if token_ids: - token_ids.write({'saml_access_token': saml_response}) - else: - token_osv.create({'saml_access_token': saml_response, - 'saml_provider_id': provider, - 'user_id': user.id - }) - return user.login - elif self.env['auth.saml.provider'].browse(provider).create_user: - _logger.debug("Creating new Odoo user \"%s\" from LDAP" % saml_uid) - # This following line is to create user with default template - # values = self.map_ldap_attributes(conf, saml_uid, ldap_entry) - SudoUser = self.env['res.users'].sudo() - # if conf['user']: - # values['active'] = True - # user_id = SudoUser.browse(conf['user'][0]).copy(default=values).id - new_user = SudoUser.create({ - 'name': saml_uid, - 'login': saml_uid, - 'saml_provider_id': provider, - 'company_id': self.env['res.company'].sudo().browse(1).id, - 'saml_uid': saml_uid - }) - new_user.write({'saml_uid': saml_uid}) - token_osv.create({'saml_access_token': saml_response, - 'saml_provider_id': provider, - 'user_id': new_user.id - }) - return new_user.login - else: - raise AccessDenied() + if self.check_if_create_user(provider) and not user_ids: + self.create_user(saml_uid, provider) + return super()._auth_saml_signin(provider, validation, saml_response) + + def check_if_create_user(self, provider): + return self.env['auth.saml.provider'].browse(provider).create_user + + def create_user(self, saml_uid, provider): + _logger.debug("Creating new Odoo user \"%s\" from SAML" % saml_uid) + SudoUser = self.env['res.users'].sudo() + new_user = SudoUser.create({ + 'name': saml_uid, + 'login': saml_uid, + 'saml_provider_id': provider, + 'password': "".join(random.sample(s, passlen)), + 'company_id': self.env['res.company'].sudo().browse(1).id, + }) + new_user.write( + {'saml_uid': saml_uid}) diff --git a/auth_saml_create_user/readme/CREDITS.rst b/auth_saml_create_user/readme/CREDITS.rst index d030eac6fc..a5b5a0b1ca 100644 --- a/auth_saml_create_user/readme/CREDITS.rst +++ b/auth_saml_create_user/readme/CREDITS.rst @@ -1,3 +1,5 @@ The development of this module has been financially supported by: * Savoir-faire Linux +* Odoo Community Association (OCA) + diff --git a/auth_saml_create_user/security/ir.model.access.csv b/auth_saml_create_user/security/ir.model.access.csv index 96aaf52a23..b9f4a2c96a 100644 --- a/auth_saml_create_user/security/ir.model.access.csv +++ b/auth_saml_create_user/security/ir.model.access.csv @@ -1,2 +1,3 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink -access_auth_saml_create_user_auth_saml_create_user,auth_saml_create_user.auth_saml_create_user,model_auth_saml_create_user_auth_saml_create_user,,1,0,0,0 \ No newline at end of file +access_auth_saml_create_user_auth_saml_create_user,auth_saml_create_user.auth_saml_create_user,model_auth_saml_create_user_auth_saml_create_user,,1,0,0,0 + diff --git a/auth_saml_create_user/static/description/index.html b/auth_saml_create_user/static/description/index.html index c7d3694a37..4eeaaf76a3 100644 --- a/auth_saml_create_user/static/description/index.html +++ b/auth_saml_create_user/static/description/index.html @@ -3,7 +3,7 @@ - + Auth SAML Create User