You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
98 lines
4.2 KiB
98 lines
4.2 KiB
# -*- coding: utf-8 -*-
|
|
##############################################################################
|
|
#
|
|
# OpenERP, Open Source Management Solution
|
|
# This module copyright (C) 2012 Therp BV (<http://therp.nl>).
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as
|
|
# published by the Free Software Foundation, either version 3 of the
|
|
# License, or (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
##############################################################################
|
|
|
|
from openerp.osv import fields, orm
|
|
import logging
|
|
import users_ldap_groups_operators
|
|
import inspect
|
|
import sys
|
|
|
|
class CompanyLDAPGroupMapping(orm.Model):
|
|
_name='res.company.ldap.group_mapping'
|
|
_rec_name='ldap_attribute'
|
|
_order='ldap_attribute'
|
|
|
|
def _get_operators(self, cr, uid, context=None):
|
|
operators=[]
|
|
for name, operator in inspect.getmembers(users_ldap_groups_operators,
|
|
lambda cls: inspect.isclass(cls)
|
|
and cls!=users_ldap_groups_operators.LDAPOperator):
|
|
operators.append((name, name))
|
|
return tuple(operators)
|
|
|
|
_columns={
|
|
'ldap_id': fields.many2one('res.company.ldap', 'LDAP server',
|
|
required=True),
|
|
'ldap_attribute': fields.char('LDAP attribute', size=64,
|
|
help='The LDAP attribute to check.\n'
|
|
'For active directory, use memberOf.'),
|
|
'operator': fields.selection(_get_operators, 'Operator',
|
|
help='The operator to check the attribute against the value\n'
|
|
'For active directory, use \'contains\'', required=True),
|
|
'value': fields.char('Value', size=1024,
|
|
help='The value to check the attribute against.\n'
|
|
'For active directory, use the dn of the desired group',
|
|
required=True),
|
|
'group': fields.many2one('res.groups', 'OpenERP group',
|
|
help='The OpenERP group to assign', required=True),
|
|
}
|
|
|
|
class CompanyLDAP(orm.Model):
|
|
_inherit='res.company.ldap'
|
|
|
|
_columns={
|
|
'group_mappings': fields.one2many('res.company.ldap.group_mapping',
|
|
'ldap_id', 'Group mappings',
|
|
help='Define how OpenERP groups are assigned to ldap users'),
|
|
'only_ldap_groups': fields.boolean('Only ldap groups',
|
|
help='If this is checked, manual changes to group membership are '
|
|
'undone on every login (so OpenERP groups are always synchronous '
|
|
'with LDAP groups). If not, manually added groups are preserved.')
|
|
}
|
|
|
|
_default={
|
|
'only_ldap_groups': False
|
|
}
|
|
|
|
def get_or_create_user(self, cr, uid, conf, login, ldap_entry, context=None):
|
|
user_id=super(CompanyLDAP, self).get_or_create_user(cr, uid, conf, login,
|
|
ldap_entry, context)
|
|
if not user_id:
|
|
return user_id
|
|
logger=logging.getLogger('users_ldap_groups')
|
|
mappingobj=self.pool.get('res.company.ldap.group_mapping')
|
|
userobj=self.pool.get('res.users')
|
|
conf_all=self.read(cr, uid, conf['id'], ['only_ldap_groups'])
|
|
if(conf_all['only_ldap_groups']):
|
|
logger.debug('deleting all groups from user %d' % user_id)
|
|
userobj.write(cr, uid, user_id, {'groups_id': [(5, )]})
|
|
|
|
for mapping in mappingobj.read(cr, uid, mappingobj.search(cr, uid,
|
|
[('ldap_id', '=', conf['id'])]), []):
|
|
operator=getattr(users_ldap_groups_operators, mapping['operator'])()
|
|
logger.debug('checking mapping %s' % mapping)
|
|
if operator.check_value(ldap_entry, mapping['ldap_attribute'],
|
|
mapping['value'], conf, self, logger):
|
|
logger.debug('adding user %d to group %s' %
|
|
(user_id, mapping['group'][1]))
|
|
userobj.write(cr, uid, user_id,
|
|
{'groups_id': [(4, mapping['group'][0])]})
|
|
return user_id
|