leonard.montalbano/ScoDoc
1
0
Fork 0
forked from ScoDoc/ScoDoc
Code Issues Pull Requests Projects Releases Wiki Activity

CAS: options cas_force et cas_allow_scodoc_login, améliorations diverses.

Browse Source
This commit is contained in:
Emmanuel Viennet 2023-03-01 19:10:37 +01:00
parent dc13e8bba5
commit 5ca85a9da9
17 changed files with 129 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
app/auth/models.py
View File

@ -22,6 +22,7 @@ import jwt
from app import db, log, login
from app.models import Departement
from app.models import SHORT_STR_LEN
from app.models.config import ScoDocSiteConfig
from app.scodoc.sco_exceptions import ScoValueError
from app.scodoc.sco_permissions import Permission
from app.scodoc.sco_roles_default import SCO_ROLES_DEFAULTS
@ -71,9 +72,8 @@ class User(UserMixin, db.Model):
cas_allow_scodoc_login = db.Column(
db.Boolean, default=False, server_default="false", nullable=False
)
"""(not yet implemented XXX)
si CAS activé, peut-on se logguer sur ScoDoc directement ?
(le rôle ScoSuperAdmin peut toujours)
"""Si CAS forcé (cas_force), peut-on se logguer sur ScoDoc directement ?
(le rôle ScoSuperAdmin peut toujours, mettre à True pour les utilisateur API)
"""
password_hash = db.Column(db.String(128))
@ -133,28 +133,37 @@ class User(UserMixin, db.Model):
self.password_hash = None
self.passwd_temp = False
def check_password(self, password):
def check_password(self, password: str) -> bool:
"""Check given password vs current one.
Returns `True` if the password matched, `False` otherwise.
"""
if not self.active: # inactived users can't login
return False
if (not self.password_hash) and self.password_scodoc7:
# Special case: user freshly migrated from ScoDoc7
if scu.check_scodoc7_password(self.password_scodoc7, password):
current_app.logger.warning(
f"migrating legacy ScoDoc7 password for {self}"
)
self.set_password(password)
self.password_scodoc7 = None
db.session.add(self)
db.session.commit()
return True
return False
# if CAS activated and forced, allow only super-user and users with cas_allow_scodoc_login
if ScoDocSiteConfig.is_cas_enabled() and ScoDocSiteConfig.get("cas_force"):
if (not self.is_administrator()) and not self.cas_allow_scodoc_login:
return False
if not self.password_hash: # user without password can't login
if self.password_scodoc7:
# Special case: user freshly migrated from ScoDoc7
return self._migrate_scodoc7_password(password)
return False
return check_password_hash(self.password_hash, password)
def _migrate_scodoc7_password(self, password) -> bool:
"""After migration, rehash password."""
if scu.check_scodoc7_password(self.password_scodoc7, password):
current_app.logger.warning(f"migrating legacy ScoDoc7 password for {self}")
self.set_password(password)
self.password_scodoc7 = None
db.session.add(self)
db.session.commit()
return True
return False
def get_reset_password_token(self, expires_in=600):
"Un token pour réinitialiser son mot de passe"
return jwt.encode(

37
app/auth/routes.py
View File

@ -27,12 +27,8 @@ _ = lambda x: x # sans babel
_l = _
@bp.route("/login", methods=["GET", "POST"])
def login():
"ScoDoc Login form"
if current_user.is_authenticated:
return redirect(url_for("scodoc.index"))
def _login_form():
"""le formulaire de login, avec un lien CAS s'il est configuré."""
form = LoginForm()
if form.validate_on_submit():
user = User.query.filter_by(user_name=form.user_name.data).first()
@ -40,9 +36,12 @@ def login():
current_app.logger.info("login: invalid (%s)", form.user_name.data)
flash(_("Nom ou mot de passe invalide"))
return redirect(url_for("auth.login"))
login_user(user, remember=form.remember_me.data)
current_app.logger.info("login: success (%s)", form.user_name.data)
return form.redirect("scodoc.index")
message = request.args.get("message", "")
return render_template(
"auth/login.j2",
@ -53,6 +52,32 @@ def login():
)
@bp.route("/login", methods=["GET", "POST"])
def login():
"""ScoDoc Login form
Si paramètre cas_force, redirige vers le CAS.
"""
if current_user.is_authenticated:
return redirect(url_for("scodoc.index"))
if ScoDocSiteConfig.get("cas_force"):
current_app.logger.info("login: forcing CAS")
return redirect(url_for("cas.login"))
return _login_form()
@bp.route("/login_scodoc", methods=["GET", "POST"])
def login_scodoc():
"""ScoDoc Login form.
Formulaire login, sans redirection immédiate sur CAS si ce dernier est configuré.
Sans CAS, ce formulaire est identique à /login
"""
if current_user.is_authenticated:
return redirect(url_for("scodoc.index"))
return _login_form()
@bp.route("/logout")
def logout() -> flask.Response:
"Logout a scodoc user. If CAS session, logout from CAS. Redirect."

2
app/decorators.py
View File

@ -96,7 +96,7 @@ def permission_required(permission):
return decorator
def permission_required_compat_scodoc7(permission):
def permission_required_compat_scodoc7(permission): # XXX TODO A SUPPRIMER
"""Décorateur pour les fonctions utilisées comme API dans ScoDoc 7
Comme @permission_required mais autorise de passer directement
les informations d'auth en paramètres:

9
app/forms/main/config_cas.py
View File

@ -26,17 +26,20 @@
##############################################################################
"""
Formulaires configuration Exports Apogée (codes)
Formulaire configuration CAS
"""
from flask_wtf import FlaskForm
from wtforms import BooleanField, SubmitField
from wtforms.fields.simple import FileField, StringField, TextAreaField
from wtforms.fields.simple import FileField, StringField
class ConfigCASForm(FlaskForm):
"Formulaire paramétrage CAS"
cas_enable = BooleanField("activer le CAS")
cas_enable = BooleanField("Activer le CAS")
cas_force = BooleanField(
"Forcer l'utilisation de CAS (tous les utilisateurs seront redirigés vers le CAS)"
)
cas_server = StringField(
label="URL du serveur CAS",

19
app/models/config.py
View File

@ -214,20 +214,6 @@ class ScoDocSiteConfig(db.Model):
cfg = ScoDocSiteConfig.query.filter_by(name="cas_enable").first()
return cfg is not None and cfg.value
@classmethod
def cas_enable(cls, enabled=True) -> bool:
"""Active (ou déactive) le CAS. True si changement."""
if enabled != ScoDocSiteConfig.is_cas_enabled():
cfg = ScoDocSiteConfig.query.filter_by(name="cas_enable").first()
if cfg is None:
cfg = ScoDocSiteConfig(name="cas_enable", value="on" if enabled else "")
else:
cfg.value = "on" if enabled else ""
db.session.add(cfg)
db.session.commit()
return True
return False
@classmethod
def is_entreprises_enabled(cls) -> bool:
"""True si on doit activer le module entreprise"""
@ -259,10 +245,11 @@ class ScoDocSiteConfig(db.Model):
@classmethod
def set(cls, name: str, value: str) -> bool:
"Set parameter, returns True if change. Commit session."
if cls.get(name) != (value or ""):
value_str = str(value or "")
if (cls.get(name) or "") != value_str:
cfg = ScoDocSiteConfig.query.filter_by(name=name).first()
if cfg is None:
cfg = ScoDocSiteConfig(name=name, value=str(value))
cfg = ScoDocSiteConfig(name=name, value=value_str)
else:
cfg.value = str(value or "")
current_app.logger.info(

2
app/scodoc/sco_etud.py
View File

@ -226,8 +226,6 @@ _identiteEditor = ndb.EditableTable(
"nom_usuel",
"prenom",
"cas_id",
"cas_allow_login",
"cas_allow_scodoc_login",
"civilite", # 'M", "F", or "X"
"date_naissance",
"lieu_naissance",

24
app/scodoc/sco_import_users.py
View File

@ -31,7 +31,7 @@ import random
import time
from email.mime.multipart import MIMEMultipart
from flask import g, url_for
from flask import url_for
from flask_login import current_user
from app import db
@ -41,30 +41,34 @@ import app.scodoc.sco_utils as scu
from app import log
from app.scodoc.sco_exceptions import AccessDenied, ScoValueError
from app.scodoc import sco_excel
from app.scodoc import sco_preferences
from app.scodoc import sco_users
TITLES = ("user_name", "nom", "prenom", "email", "roles", "dept")
TITLES = ("user_name", "nom", "prenom", "email", "roles", "dept", "cas_id")
COMMENTS = (
"""user_name:
L'identifiant (login).
Composé de lettres (minuscules ou majuscules), de chiffres ou du caractère _
""",
"""nom:
Maximum 64 caractères""",
Maximum 64 caractères.""",
"""prenom:
Maximum 64 caractères""",
Maximum 64 caractères.""",
"""email:
Maximum 120 caractères""",
Maximum 120 caractères.""",
"""roles:
un plusieurs rôles séparés par ','
chaque role est fait de 2 composantes séparées par _:
1. Le role (Ens, Secr ou Admin)
chaque rôle est fait de 2 composantes séparées par _:
1. Le rôle (Ens, Secr ou Admin)
2. Le département (en majuscule)
Exemple: "Ens_RT,Admin_INFO"
Exemple: "Ens_RT,Admin_INFO".
""",
"""dept:
Le département d'appartenance du l'utillsateur. Laisser vide si l'utilisateur intervient dans plusieurs dépatements
Le département d'appartenance de l'utilisateur. Laisser vide si l'utilisateur intervient dans plusieurs départements.
""",
"""cas_id:
Identifiant de l'utilisateur sur CAS (optionnel).
""",
)

4
app/scodoc/sco_preferences.py
View File

@ -423,9 +423,9 @@ class BasePreferences(object):
"email_chefdpt",
{
"initvalue": "",
"title": "e-mail chef du département",
"title": "e-mail du chef du département",
"size": 40,
"explanation": "utilisé pour envoi mail notification absences",
"explanation": "pour lui envoyer des notifications sur les absences",
"category": "abs",
"only_global": True,
},

2
app/scodoc/sco_users.py
View File

@ -63,7 +63,7 @@ def index_html(all_depts=False, with_inactives=False, format="html"):
)
if current_user.is_administrator():
H.append(
"""&nbsp;&nbsp; <a href="{url_for("users.import_users_form",
f"""&nbsp;&nbsp; <a href="{url_for("users.import_users_form",
scodoc_dept=g.scodoc_dept)
}" class="stdlink">Importer des utilisateurs</a></p>"""
)

5
app/static/css/scodoc.css
View File

@ -4545,6 +4545,11 @@ table.formation_table_recap td.heures_tp {
text-align: right;
}
div.cas_link {
margin-bottom: 8px;
margin-top: 16px;
}
div.cas_etat_certif_ssl {
margin-top: 12px;
font-style: italic;

14
app/templates/auth/login.j2
View File

@ -10,18 +10,20 @@
<h1>Connexion</h1>
{% if is_cas_enabled %}
<div class"cas_link">
<a href="{{ url_for('cas.login') }}" class="stdlink">Se connecter avec CAS</a>
</div>
{% endif %}
<div class="row">
<div class="col-md-4">
{{ wtf.quick_form(form) }}
</div>
</div>
{% if is_cas_enabled %}
<div class="cas_link">
ou bien <a href="{{ url_for('cas.login') }}" class="stdlink">se connecter avec CAS</a>
</div>
{% endif %}
<br>
En cas d'oubli de votre mot de passe
En cas d'oubli de votre mot de passe ScoDoc
<a href="{{ url_for('auth.reset_password_request') }}">cliquez ici pour le réinitialiser</a>.
</p>

3
app/templates/auth/user_info_page.j2
View File

@ -9,6 +9,9 @@
<b>Login :</b> {{user.user_name}}<br>
<b>CAS id:</b> {{user.cas_id or "(aucun)"}}
(CAS {{'autorisé' if user.cas_allow_login else 'interdit'}} pour cet utilisateur)
{% if user.cas_allow_scodoc_login %}
(connexion sans CAS autorisée)
{% endif %}
<br>
<b>Nom :</b> {{user.nom or ""}}<br>
<b>Prénom :</b> {{user.prenom or ""}}<br>

8
app/templates/config_cas.j2
View File

@ -18,8 +18,16 @@
non chargé.
{% endif %}
</div>
<div style="margin-top:16px;">
ℹ️ <em>Note: si le CAS est forcé, le super-admin et les utilisateurs autorisés
à "se connecter via ScoDoc" pourront toujours se
connecter via l'adresse spéciale</em>
<tt style="color: blue;">{{url_for("auth.login_scodoc", _external=True)}}</tt>
</div>
</div>
</div>
{% endblock %}

5
app/views/scodoc.py
View File

@ -144,8 +144,10 @@ def config_cas():
if request.method == "POST" and form.cancel.data: # cancel button
return redirect(url_for("scodoc.index"))
if form.validate_on_submit():
if ScoDocSiteConfig.cas_enable(enabled=form.data["cas_enable"]):
if ScoDocSiteConfig.set("cas_enable", form.data["cas_enable"]):
flash("CAS " + ("activé" if form.data["cas_enable"] else "désactivé"))
if ScoDocSiteConfig.set("cas_force", form.data["cas_force"]):
flash("CAS " + ("forcé" if form.data["cas_force"] else "non forcé"))
if ScoDocSiteConfig.set("cas_server", form.data["cas_server"]):
flash("Serveur CAS enregistré")
if ScoDocSiteConfig.set("cas_attribute_id", form.data["cas_attribute_id"]):
@ -165,6 +167,7 @@ def config_cas():
elif request.method == "GET":
form.cas_enable.data = ScoDocSiteConfig.get("cas_enable")
form.cas_force.data = ScoDocSiteConfig.get("cas_force")
form.cas_server.data = ScoDocSiteConfig.get("cas_server")
form.cas_attribute_id.data = ScoDocSiteConfig.get("cas_attribute_id")
form.cas_ssl_verify.data = ScoDocSiteConfig.get("cas_ssl_verify")

16
app/views/users.py
View File

@ -403,7 +403,16 @@ def create_user_form(user_name=None, edit=0, all_roles=True):
{
"title": "Autorise connexion via CAS",
"input_type": "boolcheckbox",
"explanation": "en test: seul le super-administrateur peut changer ce réglage",
"explanation": " seul le super-administrateur peut changer ce réglage",
"readonly": not current_user.is_administrator(),
},
),
(
"cas_allow_scodoc_login",
{
"title": "Autorise connexion via ScoDoc",
"input_type": "boolcheckbox",
"explanation": " seul le super-administrateur peut changer ce réglage",
"readonly": not current_user.is_administrator(),
},
),
@ -764,8 +773,9 @@ def import_users_form():
<li>envoi à chaque utilisateur de son <b>mot de passe initial par mail</b>.</li>
</ol>"""
H.append(
"""<ol><li><a class="stdlink" href="import_users_generate_excel_sample">
Obtenir la feuille excel à remplir</a></li><li>"""
f"""<ol><li><a class="stdlink" href="{
url_for("users.import_users_generate_excel_sample", scodoc_dept=g.scodoc_dept)
}">Obtenir la feuille excel à remplir</a></li><li>"""
)
F = html_sco_header.sco_footer()
tf = TrivialFormulator(

1
scodoc.py
View File

@ -516,7 +516,6 @@ def photos_import_files(formsemestre_id: int, xlsfile: str, zipfile: str):
"""Import des photos d'étudiants à partir d'une liste excel et d'un zip avec les images."""
import app as mapp
from app.scodoc import sco_trombino, sco_photos
from flask_login import login_user
from app.auth.models import get_super_admin
sem = mapp.models.formsemestre.FormSemestre.query.get(formsemestre_id)

10
tests/unit/test_users.py
View File

@ -4,7 +4,7 @@
Ré-écriture de test_users avec pytest.
Usage: pytest tests/unit/test_users.py
Usage: pytest tests/unit/test_users.py
"""
import pytest
@ -24,7 +24,7 @@ def test_password_hashing(test_client):
db.session.add(u)
db.session.commit()
# nota: default attributes values, like active,
# are not set before the first commit() (?)
# are not set before the first commit()
assert u.active
u.set_password("cat")
assert not u.check_password("dog")
@ -62,7 +62,7 @@ def test_roles_permissions(test_client):
def test_users_roles(test_client):
dept = "XX"
dept = DEPT
perm = Permission.ScoAbsChange
perm2 = Permission.ScoView
u = User(user_name="un_enseignant")
@ -97,14 +97,14 @@ def test_users_roles(test_client):
def test_user_admin(test_client):
dept = "XX"
dept = DEPT
perm = 0x1234 # a random perm
u = User(user_name="un_admin", email=current_app.config["SCODOC_ADMIN_MAIL"])
db.session.add(u)
assert len(u.roles) == 1
assert u.has_permission(perm, dept)
# Le grand admin a accès à tous les départements:
assert u.has_permission(perm, dept + "XX")
assert u.has_permission(perm, dept + DEPT)
assert u.roles[0].name == "SuperAdmin"