mirror of
https://github.com/goauthentik/authentik
synced 2026-05-15 03:16:22 +02:00
f7e23295ed
* move imports * core: add digraph group hierarchy * move to permissions from Group or User to Role * set group parents on frontend * do not serialize `GroupParentageNode` directly * core: enforce unique group name on database level Signed-off-by: Jens Langhammer <jens@goauthentik.io> * use group parents in LDAP provider * add user-role relationship control to frontend * move materialized view to be more discoverable * add guardian to mypy exceptions * make `Role` a `ManagedModel` * fixup! make `Role` a `ManagedModel` * simplify `get_objects_for_user` * fix flaky unit test * rename `django-guardian` fork to `ak-guardian` * add tests around users/groups/roles * remove unused guardian config variable * simplify guardian file structure * clean up frontend * initial docs * remove `mode` from `InitialPermissions` This is no longer needed, since users no longer directly have permissions. * fixup! Merge branch 'main' into core/add-digraph-group-hierarchy * clean up docs for managing permissions * addendums from docs review * fixup! Merge branch 'main' into core/add-digraph-group-hierarchy * tweaks * dewi and tana edits to docs * tweak * truly final tweaks, for now * relabel Role Permissions table * clarify button label * fixup! Merge branch 'main' into core/add-digraph-group-hierarchy * fixup! Merge branch 'main' into core/add-digraph-group-hierarchy * merge migrations * fixup! Merge branch 'main' into core/add-digraph-group-hierarchy --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Tana M Berry <tana@goauthentik.io>
80 lines
1.9 KiB
Go
80 lines
1.9 KiB
Go
package ldap
|
|
|
|
import (
|
|
"fmt"
|
|
"strconv"
|
|
|
|
"goauthentik.io/api/v3"
|
|
)
|
|
|
|
func (pi *ProviderInstance) GroupsForUser(user api.User) []string {
|
|
groups := make([]string, len(user.Groups))
|
|
for i, group := range user.GroupsObj {
|
|
groups[i] = pi.GetGroupDN(group.Name)
|
|
}
|
|
return groups
|
|
}
|
|
|
|
func (pi *ProviderInstance) MembersForGroup(group api.Group) []string {
|
|
users := make([]string, len(group.UsersObj))
|
|
for i, user := range group.UsersObj {
|
|
users[i] = pi.GetUserDN(user.Username)
|
|
}
|
|
children := make([]string, len(group.ChildrenObj))
|
|
for i, child := range group.ChildrenObj {
|
|
children[i] = pi.GetGroupDN(child.Name)
|
|
}
|
|
return append(users, children...)
|
|
}
|
|
|
|
func (pi *ProviderInstance) MemberOfForGroup(group api.Group) []string {
|
|
groups := make([]string, len(group.ParentsObj))
|
|
for i, group := range group.ParentsObj {
|
|
fmt.Printf("in range")
|
|
groups[i] = pi.GetGroupDN(group.Name)
|
|
}
|
|
return groups
|
|
}
|
|
|
|
func (pi *ProviderInstance) GetUserDN(user string) string {
|
|
return fmt.Sprintf("cn=%s,%s", user, pi.UserDN)
|
|
}
|
|
|
|
func (pi *ProviderInstance) GetGroupDN(group string) string {
|
|
return fmt.Sprintf("cn=%s,%s", group, pi.GroupDN)
|
|
}
|
|
|
|
func (pi *ProviderInstance) GetVirtualGroupDN(group string) string {
|
|
return fmt.Sprintf("cn=%s,%s", group, pi.VirtualGroupDN)
|
|
}
|
|
|
|
func (pi *ProviderInstance) GetUserUidNumber(user api.User) string {
|
|
uidNumber, ok := user.GetAttributes()["uidNumber"].(string)
|
|
|
|
if ok {
|
|
return uidNumber
|
|
}
|
|
|
|
return strconv.FormatInt(int64(pi.uidStartNumber+user.Pk), 10)
|
|
}
|
|
|
|
func (pi *ProviderInstance) GetUserGidNumber(user api.User) string {
|
|
gidNumber, ok := user.GetAttributes()["gidNumber"].(string)
|
|
|
|
if ok {
|
|
return gidNumber
|
|
}
|
|
|
|
return pi.GetUserUidNumber(user)
|
|
}
|
|
|
|
func (pi *ProviderInstance) GetGroupGidNumber(group api.Group) string {
|
|
gidNumber, ok := group.GetAttributes()["gidNumber"].(string)
|
|
|
|
if ok {
|
|
return gidNumber
|
|
}
|
|
|
|
return strconv.FormatInt(int64(pi.gidStartNumber+group.NumPk), 10)
|
|
}
|