-
-
Notifications
You must be signed in to change notification settings - Fork 5.6k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
* Add setting for a JSON that maps LDAP groups to Org Teams. * Add log when removing or adding team members. * Sync is being run on login and periodically. * Existing group filter settings are reused. * Adding and removing team members. * Sync not existing LDAP group. * Login with broken group map JSON.
- Loading branch information
1 parent
26718a7
commit 832ce40
Showing
14 changed files
with
423 additions
and
65 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| // Copyright 2021 The Gitea Authors. All rights reserved. | ||
| // Use of this source code is governed by a MIT-style | ||
| // license that can be found in the LICENSE file. | ||
|
|
||
| package ldap | ||
|
|
||
| import ( | ||
| "code.gitea.io/gitea/models" | ||
| user_model "code.gitea.io/gitea/models/user" | ||
| "code.gitea.io/gitea/modules/log" | ||
| ) | ||
|
|
||
| // SyncLdapGroupsToTeams maps LDAP groups to organization and team memberships | ||
| func (source *Source) SyncLdapGroupsToTeams(user *user_model.User, ldapTeamAdd, ldapTeamRemove map[string][]string, orgCache map[string]*models.Organization, teamCache map[string]*models.Team) { | ||
| var err error | ||
| if source.GroupsEnabled && source.GroupTeamMapRemoval { | ||
| // when the user is not a member of configs LDAP group, remove mapped organizations/teams memberships | ||
| removeMappedMemberships(user, ldapTeamRemove, orgCache, teamCache) | ||
| } | ||
| for orgName, teamNames := range ldapTeamAdd { | ||
| org, ok := orgCache[orgName] | ||
| if !ok { | ||
| org, err = models.GetOrgByName(orgName) | ||
| if err != nil { | ||
| // organization must be created before LDAP group sync | ||
| log.Warn("LDAP group sync: Could not find organisation %s: %v", orgName, err) | ||
| continue | ||
| } | ||
| orgCache[orgName] = org | ||
| } | ||
| if isMember, err := models.IsOrganizationMember(org.ID, user.ID); !isMember && err == nil { | ||
| log.Trace("LDAP group sync: adding user [%s] to organization [%s]", user.Name, org.Name) | ||
| err = org.AddMember(user.ID) | ||
| if err != nil { | ||
| log.Error("LDAP group sync: Could not add user to organization: %v", err) | ||
| continue | ||
| } | ||
| } | ||
| for _, teamName := range teamNames { | ||
| team, ok := teamCache[orgName+teamName] | ||
| if !ok { | ||
| team, err = org.GetTeam(teamName) | ||
| if err != nil { | ||
| // team must be created before LDAP group sync | ||
| log.Warn("LDAP group sync: Could not find team %s: %v", teamName, err) | ||
| continue | ||
| } | ||
| teamCache[orgName+teamName] = team | ||
| } | ||
| if isMember, err := models.IsTeamMember(org.ID, team.ID, user.ID); !isMember && err == nil { | ||
| log.Trace("LDAP group sync: adding user [%s] to team [%s]", user.Name, org.Name) | ||
| } else { | ||
| continue | ||
| } | ||
| err := team.AddMember(user.ID) | ||
| if err != nil { | ||
| log.Error("LDAP group sync: Could not add user to team: %v", err) | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // remove membership to organizations/teams if user is not member of corresponding LDAP group | ||
| // e.g. lets assume user is member of LDAP group "x", but LDAP group team map contains LDAP groups "x" and "y" | ||
| // then users membership gets removed for all organizations/teams mapped by LDAP group "y" | ||
| func removeMappedMemberships(user *user_model.User, ldapTeamRemove map[string][]string, orgCache map[string]*models.Organization, teamCache map[string]*models.Team) { | ||
| var err error | ||
| for orgName, teamNames := range ldapTeamRemove { | ||
| org, ok := orgCache[orgName] | ||
| if !ok { | ||
| org, err = models.GetOrgByName(orgName) | ||
| if err != nil { | ||
| // organization must be created before LDAP group sync | ||
| log.Warn("LDAP group sync: Could not find organisation %s: %v", orgName, err) | ||
| continue | ||
| } | ||
| orgCache[orgName] = org | ||
| } | ||
| for _, teamName := range teamNames { | ||
| team, ok := teamCache[orgName+teamName] | ||
| if !ok { | ||
| team, err = org.GetTeam(teamName) | ||
| if err != nil { | ||
| // team must must be created before LDAP group sync | ||
| log.Warn("LDAP group sync: Could not find team %s: %v", teamName, err) | ||
| continue | ||
| } | ||
| } | ||
| if isMember, err := models.IsTeamMember(org.ID, team.ID, user.ID); isMember && err == nil { | ||
| log.Trace("LDAP group sync: removing user [%s] from team [%s]", user.Name, org.Name) | ||
| } else { | ||
| continue | ||
| } | ||
| err = team.RemoveMember(user.ID) | ||
| if err != nil { | ||
| log.Error("LDAP group sync: Could not remove user from team: %v", err) | ||
| } | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.