From 368f615d717c70f3c2f348bcc635c1a7b4c1dbbd Mon Sep 17 00:00:00 2001 From: Oliver Date: Mon, 15 May 2023 15:09:14 +1000 Subject: [PATCH] Bug fix for improperly configured SSO provider (#4822) * Add sso template tags * Check if SSO provider is valid on login page * Add warning if SSO method is not correctly configured * Template tweaks --- InvenTree/part/templatetags/sso.py | 48 +++++++++++++ .../templates/InvenTree/settings/user.html | 58 +-------------- .../InvenTree/settings/user_sso.html | 71 +++++++++++++++++++ InvenTree/templates/socialaccount/login.html | 18 ++++- .../socialaccount/snippets/provider_list.html | 31 +++++--- 5 files changed, 160 insertions(+), 66 deletions(-) create mode 100644 InvenTree/part/templatetags/sso.py create mode 100644 InvenTree/templates/InvenTree/settings/user_sso.html diff --git a/InvenTree/part/templatetags/sso.py b/InvenTree/part/templatetags/sso.py new file mode 100644 index 0000000000..2bcbf5f606 --- /dev/null +++ b/InvenTree/part/templatetags/sso.py @@ -0,0 +1,48 @@ +"""This module provides template tags pertaining to SSO functionality""" + + +from django import template + +from common.models import InvenTreeSetting +from InvenTree.helpers import str2bool + +register = template.Library() + + +@register.simple_tag() +def sso_login_enabled(): + """Return True if single-sign-on is enabled""" + + val = InvenTreeSetting.get_setting('LOGIN_ENABLE_SSO') + + print("SSO Enabled:", val) + + return str2bool(InvenTreeSetting.get_setting('LOGIN_ENABLE_SSO')) + + +@register.simple_tag() +def sso_reg_enabled(): + """Return True if single-sign-on is enabled for self-registration""" + return str2bool(InvenTreeSetting.get_setting('LOGIN_ENABLE_SSO_REG')) + + +@register.simple_tag() +def sso_auto_enabled(): + """Return True if single-sign-on is enabled for auto-registration""" + return str2bool(InvenTreeSetting.get_setting('LOGIN_SIGNUP_SSO_AUTO')) + + +@register.simple_tag() +def sso_check_provider(provider): + """Return True if the given provider is correctly configured""" + + from allauth.socialaccount.models import SocialApp + + # First, check that the provider is enabled + if not SocialApp.objects.filter(provider__iexact=provider.name).exists(): + return False + + # Next, check that the provider is correctly configured + + # At this point, we assume that the provider is correctly configured + return True diff --git a/InvenTree/templates/InvenTree/settings/user.html b/InvenTree/templates/InvenTree/settings/user.html index ca1c1fdc18..9a1fbcd135 100644 --- a/InvenTree/templates/InvenTree/settings/user.html +++ b/InvenTree/templates/InvenTree/settings/user.html @@ -1,6 +1,7 @@ {% extends "panel.html" %} {% load i18n %} +{% load sso %} {% load inventree_extras %} {% load socialaccount %} {% load crispy_forms_tags %} @@ -112,62 +113,7 @@ {% endif %} -
-
-

{% trans "Social Accounts" %}

-
- -
- {% if social_form.accounts %} -

{% blocktrans %}You can sign in to your account using any of the following third party accounts:{% endblocktrans %}

- - -
- {% csrf_token %} - -
- {% if social_form.non_field_errors %} -
{{ social_form.non_field_errors }}
- {% endif %} - - {% for base_account in social_form.accounts %} - {% with base_account.get_provider_account as account %} -
- -
- {% endwith %} - {% endfor %} - -
- -
- -
- -
- - {% else %} -
- {% trans 'There are no social network accounts connected to this account.' %} -
- {% endif %} -
- -
-
{% trans 'Add a 3rd Party Account' %}
-
- {% include "socialaccount/snippets/provider_list.html" with process="connect" %} -
- {% include "socialaccount/snippets/login_extra.html" %} -
-
+{% include "InvenTree/settings/user_sso.html" %}
diff --git a/InvenTree/templates/InvenTree/settings/user_sso.html b/InvenTree/templates/InvenTree/settings/user_sso.html new file mode 100644 index 0000000000..dc635224dd --- /dev/null +++ b/InvenTree/templates/InvenTree/settings/user_sso.html @@ -0,0 +1,71 @@ +{% load i18n %} +{% load inventree_extras %} +{% load sso %} + +{% sso_login_enabled as sso %} + +
+
+

{% trans "Single Sign On Accounts" %}

+ {% include "spacer.html" %} +
+ + {% if sso %} +
+ {% if social_form.accounts %} +

{% blocktrans %}You can sign in to your account using any of the following third party accounts:{% endblocktrans %}

+ + +
+ {% csrf_token %} + +
+ {% if social_form.non_field_errors %} +
{{ social_form.non_field_errors }}
+ {% endif %} + + {% for base_account in social_form.accounts %} + {% with base_account.get_provider_account as account %} +
+ +
+ {% endwith %} + {% endfor %} + +
+ +
+ +
+ +
+ + {% else %} +
+ {% trans 'There are no social network accounts connected to this account.' %} +
+ {% endif %} +
+ +
+
{% trans 'Add SSO Account' %}
+
+ {% include "socialaccount/snippets/provider_list.html" with process="connect" %} +
+ {% include "socialaccount/snippets/login_extra.html" %} +
+ + {% else %} +
+ {% trans "Single Sign On is not enabled for this server" %} +
+ {% endif %} + +
diff --git a/InvenTree/templates/socialaccount/login.html b/InvenTree/templates/socialaccount/login.html index 0cd0360ad0..cffccca193 100644 --- a/InvenTree/templates/socialaccount/login.html +++ b/InvenTree/templates/socialaccount/login.html @@ -1,15 +1,20 @@ {% extends "socialaccount/base.html" %} {% load i18n %} +{% load sso %} {% block head_title %}{% trans "Sign In" %}{% endblock head_title %} {% block content %} + +{% sso_check_provider provider as provider_valid %} + +{% if provider_valid %} {% if process == "connect" %} -

{% blocktrans with provider.name as provider %}Connect {{ provider }}{% endblocktrans %}

+

{% blocktrans with provider.name as provider %}Connect {{ provider }}{% endblocktrans %}

{% blocktrans with provider.name as provider %}You are about to connect a new third party account from {{ provider }}.{% endblocktrans %}

{% else %} -

{% blocktrans with provider.name as provider %}Sign In Via {{ provider }}{% endblocktrans %}

+

{% blocktrans with provider.name as provider %}Sign In Via {{ provider }}{% endblocktrans %}

{% blocktrans with provider.name as provider %}You are about to sign in using a third party account from {{ provider }}.{% endblocktrans %}

{% endif %} @@ -19,10 +24,19 @@ +{% else %} +
+

{% trans "Invalid SSO Provider" %}

+

+ {% trans "The selected SSO provider is invalid, or has not been correctly configured" %} +

+
+{% endif %}
{% trans "Return to login page" %}
+ {% endblock content %} diff --git a/InvenTree/templates/socialaccount/snippets/provider_list.html b/InvenTree/templates/socialaccount/snippets/provider_list.html index ae7b728c77..42d29974ce 100644 --- a/InvenTree/templates/socialaccount/snippets/provider_list.html +++ b/InvenTree/templates/socialaccount/snippets/provider_list.html @@ -1,22 +1,37 @@ {% load socialaccount %} +{% load i18n %} +{% load sso %} {% get_providers as socialaccount_providers %} +{% if socialaccount_providers|length > 0 %}
    {% for provider in socialaccount_providers %} +{% sso_check_provider provider as provider_valid %}
  • -{% if provider.id == "openid" %} -{% for brand in provider.get_brands %} + {% if provider.id == "openid" %} + {% for brand in provider.get_brands %} - {{ brand.name }} -{% endfor %} -{% endif %} + {{ brand.name }} + + {% endfor %} + {% endif %} {{ provider.name }} + class="btn btn-light socialaccount_provider {{ provider.id }}" + href="{% provider_login_url provider.id process=process scope=scope auth_params=auth_params %}"> + {{ provider.name }} + {% if not provider_valid %} + + {% endif %} +
    • {% endfor %}
+ +{% else %} +
+ {% trans "No SSO providers have been configured" %} +
+{% endif %}