You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

98 lines
4.2 KiB

  1. # -*- coding: utf-8 -*-
  2. ##############################################################################
  3. #
  4. # OpenERP, Open Source Management Solution
  5. # This module copyright (C) 2012 Therp BV (<http://therp.nl>).
  6. #
  7. # This program is free software: you can redistribute it and/or modify
  8. # it under the terms of the GNU Affero General Public License as
  9. # published by the Free Software Foundation, either version 3 of the
  10. # License, or (at your option) any later version.
  11. #
  12. # This program is distributed in the hope that it will be useful,
  13. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. # GNU Affero General Public License for more details.
  16. #
  17. # You should have received a copy of the GNU Affero General Public License
  18. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  19. #
  20. ##############################################################################
  21. from openerp.osv import fields, orm
  22. import logging
  23. import users_ldap_groups_operators
  24. import inspect
  25. import sys
  26. class CompanyLDAPGroupMapping(orm.Model):
  27. _name='res.company.ldap.group_mapping'
  28. _rec_name='ldap_attribute'
  29. _order='ldap_attribute'
  30. def _get_operators(self, cr, uid, context=None):
  31. operators=[]
  32. for name, operator in inspect.getmembers(users_ldap_groups_operators,
  33. lambda cls: inspect.isclass(cls)
  34. and cls!=users_ldap_groups_operators.LDAPOperator):
  35. operators.append((name, name))
  36. return tuple(operators)
  37. _columns={
  38. 'ldap_id': fields.many2one('res.company.ldap', 'LDAP server',
  39. required=True),
  40. 'ldap_attribute': fields.char('LDAP attribute', size=64,
  41. help='The LDAP attribute to check.\n'
  42. 'For active directory, use memberOf.'),
  43. 'operator': fields.selection(_get_operators, 'Operator',
  44. help='The operator to check the attribute against the value\n'
  45. 'For active directory, use \'contains\'', required=True),
  46. 'value': fields.char('Value', size=1024,
  47. help='The value to check the attribute against.\n'
  48. 'For active directory, use the dn of the desired group',
  49. required=True),
  50. 'group': fields.many2one('res.groups', 'OpenERP group',
  51. help='The OpenERP group to assign', required=True),
  52. }
  53. class CompanyLDAP(orm.Model):
  54. _inherit='res.company.ldap'
  55. _columns={
  56. 'group_mappings': fields.one2many('res.company.ldap.group_mapping',
  57. 'ldap_id', 'Group mappings',
  58. help='Define how OpenERP groups are assigned to ldap users'),
  59. 'only_ldap_groups': fields.boolean('Only ldap groups',
  60. help='If this is checked, manual changes to group membership are '
  61. 'undone on every login (so OpenERP groups are always synchronous '
  62. 'with LDAP groups). If not, manually added groups are preserved.')
  63. }
  64. _default={
  65. 'only_ldap_groups': False
  66. }
  67. def get_or_create_user(self, cr, uid, conf, login, ldap_entry, context=None):
  68. user_id=super(CompanyLDAP, self).get_or_create_user(cr, uid, conf, login,
  69. ldap_entry, context)
  70. if not user_id:
  71. return user_id
  72. logger=logging.getLogger('users_ldap_groups')
  73. mappingobj=self.pool.get('res.company.ldap.group_mapping')
  74. userobj=self.pool.get('res.users')
  75. conf_all=self.read(cr, uid, conf['id'], ['only_ldap_groups'])
  76. if(conf_all['only_ldap_groups']):
  77. logger.debug('deleting all groups from user %d' % user_id)
  78. userobj.write(cr, uid, [user_id], {'groups_id': [(5, )]})
  79. for mapping in mappingobj.read(cr, uid, mappingobj.search(cr, uid,
  80. [('ldap_id', '=', conf['id'])]), []):
  81. operator=getattr(users_ldap_groups_operators, mapping['operator'])()
  82. logger.debug('checking mapping %s' % mapping)
  83. if operator.check_value(ldap_entry, mapping['ldap_attribute'],
  84. mapping['value'], conf, self, logger):
  85. logger.debug('adding user %d to group %s' %
  86. (user_id, mapping['group'][1]))
  87. userobj.write(cr, uid, [user_id],
  88. {'groups_id': [(4, mapping['group'][0])]})
  89. return user_id