now store user groups in session, for display

1 files changed, 46 insertions, 18 deletions

diff --git a/session_app.py.publish b/session_app.py.publish
index ac37e17..18bf5f1 100755
--- a/session_app.py.publish
+++ b/session_app.py.publish
@@ -97,16 +97,34 @@ def requires_authn_kerberos(function):
             # if ldap config options are set, then do kerberos -> short username resolution
             user = ctx.kerberos_user
             if 'LDAP_USER_KERBEROS_PRINCIPAL_ATTRIB' in app.config:
-               user = session_ldap.get_ldap_attrib_from_krbPrincipalName(
+               conn = session_ldap.get_ldap_connection(
                   server_uri=get_next_ldap_server(app),
                   bind_dn=app.config['LDAP_BIND_DN'],
                   bind_pw=app.config['LDAP_BIND_PASSWORD'],
+               )
+               this_user = session_ldap.get_ldap_attrib_from_krbPrincipalName(
+                  connection = conn,
                   search_base=app.config['LDAP_USER_BASE'],
-                  user_attrib=app.config['LDAP_USER_DISPLAY_ATTRIB'],
+                  user_attrib="dn",
                   user_krbPrincipalName=user,
                   krbPrincipalName_attrib=app.config['LDAP_USER_KERBEROS_PRINCIPAL_ATTRIB']
                )
-            response = function(user, *args, **kwargs)
+               #print(f"DEBUG: krb user {user} is ldap dn {this_user}")
+               shortuser = session_ldap.get_ldap_username_attrib_from_dn(
+                  authenticated_user=conn,
+                  user_dn=this_user,
+                  user_match_attrib=app.config['LDAP_USER_DISPLAY_ATTRIB']
+               )
+               #print(f"DEBUG: shortuser {shortuser}")
+               groups = session_ldap.get_ldap_user_groups(
+                  connection=conn,
+                  user_dn=this_user,
+                  user_attrib_memberof=app.config['LDAP_USER_ATTRIB_MEMBEROF'],
+                  group_name_attrib=app.config['LDAP_GROUP_NAME_ATTRIB'],
+                  group_base=app.config['LDAP_GROUP_BASE']
+               )
+               #print(f"DEBUG: groups {groups}")
+            response = function(shortuser, groups, *args, **kwargs)
             response = make_response(response)
             if ctx.kerberos_token is not None:
                response.headers['WWW-Authenticate'] = ' '.join(['negotiate', ctx.kerberos_token])
@@ -131,7 +149,7 @@ def requires_authn_ldap(function):
       # formdata is in session if we are coming from login_basic()
       form = session.get('formdata', None)
       if form:
-         print(f"DEBUG: requires_authn_ldap form={form}")
+         #print(f"DEBUG: requires_authn_ldap form={form}")
          session.pop('formdata')
          if 'username' in form:
             username = form['username']
@@ -156,7 +174,7 @@ def requires_authn_ldap(function):
       )
       # list_matching_users always returns list, so if it contains <> 1 we are in trouble
       if len(this_user) != 1:
-         print(f"WARNING: cannot determine unique user for {app.config['LDAP_USER_MATCH_ATTRIB']}={username} which returned {tihs_user}")
+         print(f"WARNING: cannot determine unique user for {app.config['LDAP_USER_MATCH_ATTRIB']}={username} which returned {this_user}")
          return _unauthorized_ldap()
       this_user = this_user[0]
       print(f"DEBUG: requires_authn_ldap: found in ldap the username {this_user}")
@@ -166,7 +184,15 @@ def requires_authn_ldap(function):
             authenticated_user=ll,
             user_match_attrib=app.config['LDAP_USER_DISPLAY_ATTRIB']
          )
-         return function(shortuser,*args, **kwargs)
+         groups = session_ldap.get_ldap_user_groups(
+            connection=ll,
+            user_dn=this_user,
+            user_attrib_memberof=app.config['LDAP_USER_ATTRIB_MEMBEROF'],
+            group_name_attrib=app.config['LDAP_GROUP_NAME_ATTRIB'],
+            group_base=app.config['LDAP_GROUP_BASE']
+         )
+         print(f"DEBUG: user {shortuser} has groups {groups}")
+         return function(shortuser, groups ,*args, **kwargs)
       else:
          return _unauthorized_ldap()
    return decorated
@@ -193,9 +219,10 @@ def protected_page():
 def protected_page_real():
    s_user = session['user']
    c_user = request.cookies.get('user')
+   groups = session['groups']
    cookie=request.cookies
    print(cookie)
-   return render_template('view.html', c_user = c_user, s_user=s_user, cookie=cookie)
+   return render_template('view.html', c_user = c_user, s_user=s_user, cookie=cookie, groups=groups)
 
 @app.route("/login/new")
 @app.route("/login/new/")
@@ -257,11 +284,20 @@ def ldap_login(username,password):
 @app.route("/login/kerberos")
 @app.route("/login/kerberos/")
 @requires_authn_kerberos
-def login_kerberos(user):
+def login_kerberos(user,groups=[]):
    resp = Response(f'<meta http-equiv="Refresh" content="1; url={url_for("protected_page")}">success with kerberos')
    #resp.headers['login'] = "from-kerberos"
    resp.set_cookie('type',"kerberos")
-   resp = login_generic(session,resp,user,None)
+   resp = login_generic(session,resp,user,groups)
+   return resp
+
+@app.route("/login/ldap", methods=['POST','GET'])
+@app.route("/login/ldap/", methods=['POST','GET'])
+@requires_authn_ldap
+def login_ldap(user,groups=[]):
+   resp = Response(f'<meta http-equiv="Refresh" content="1; url={url_for("protected_page")}">success with ldap')
+   resp.set_cookie('type',"ldap")
+   resp = login_generic(session,resp,user,groups)
    return resp
 
 def login_generic(session,resp,user,groups=[]):
@@ -272,15 +308,7 @@ def login_generic(session,resp,user,groups=[]):
    session.permanent = True
    session['user']=user
    session['end_time'] = end_time_str
-   return resp
-
-@app.route("/login/ldap", methods=['POST','GET'])
-@app.route("/login/ldap/", methods=['POST','GET'])
-@requires_authn_ldap
-def login_ldap(user,groups=[]):
-   resp = Response(f'<meta http-equiv="Refresh" content="1; url={url_for("protected_page")}">success with ldap')
-   resp.set_cookie('type',"ldap")
-   resp = login_generic(session,resp,user,groups)
+   session['groups'] = groups
    return resp
 
 @app.route("/login/form", methods=['POST','GET'])