mirror of
https://github.com/jumpserver/jumpserver.git
synced 2026-07-16 17:15:18 +00:00
caa5060ecd
* [Update] 控制组织管理员不允许编辑（更新、删除）超级用户 - 待续（控制批量更新API） * [Update] 修改方法名称 * [Update] 控制组织管理员不允许批量更新包含超级用户的用户列表 * [Bugfix] 修复所有ViewSet API进行批量更新时rest_framework_bulk库内部的bug * [Update] 修改 OpenID Middleware 日志输出模式 info => debug
46 lines
1.5 KiB
Python
46 lines
1.5 KiB
Python
# coding:utf-8
|
|
#
|
|
|
|
from django.conf import settings
|
|
from django.contrib.auth import logout
|
|
from django.utils.deprecation import MiddlewareMixin
|
|
from django.contrib.auth import BACKEND_SESSION_KEY
|
|
|
|
from common.utils import get_logger
|
|
from .utils import new_client
|
|
from .models import OIDT_ACCESS_TOKEN
|
|
|
|
BACKEND_OPENID_AUTH_CODE = 'OpenIDAuthorizationCodeBackend'
|
|
logger = get_logger(__file__)
|
|
__all__ = ['OpenIDAuthenticationMiddleware']
|
|
|
|
|
|
class OpenIDAuthenticationMiddleware(MiddlewareMixin):
|
|
"""
|
|
Check openid user single logout (with access_token)
|
|
"""
|
|
|
|
def process_request(self, request):
|
|
# Don't need openid auth if AUTH_OPENID is False
|
|
if not settings.AUTH_OPENID:
|
|
logger.debug("Not settings.AUTH_OPENID")
|
|
return
|
|
# Don't need check single logout if user not authenticated
|
|
if not request.user.is_authenticated:
|
|
logger.debug("User is not authenticated")
|
|
return
|
|
elif not request.session[BACKEND_SESSION_KEY].endswith(
|
|
BACKEND_OPENID_AUTH_CODE):
|
|
logger.debug("BACKEND_SESSION_KEY is not BACKEND_OPENID_AUTH_CODE")
|
|
return
|
|
|
|
# Check openid user single logout or not with access_token
|
|
client = new_client()
|
|
try:
|
|
client.openid_connect_client.userinfo(
|
|
token=request.session.get(OIDT_ACCESS_TOKEN)
|
|
)
|
|
except Exception as e:
|
|
logout(request)
|
|
logger.error(e)
|