2b9873483a
Allows superusers to disable login to the UI via credentials if at least one OIDC provider is configured
79 lines
3.5 KiB
Python
79 lines
3.5 KiB
Python
import logging
|
|
|
|
from auth.auth_context import get_authenticated_user
|
|
from data.users import LDAP_CERT_FILENAME
|
|
|
|
from util.config.validators.validate_database import DatabaseValidator
|
|
from util.config.validators.validate_redis import RedisValidator
|
|
from util.config.validators.validate_storage import StorageValidator
|
|
from util.config.validators.validate_email import EmailValidator
|
|
from util.config.validators.validate_ldap import LDAPValidator
|
|
from util.config.validators.validate_keystone import KeystoneValidator
|
|
from util.config.validators.validate_jwt import JWTAuthValidator
|
|
from util.config.validators.validate_secscan import SecurityScannerValidator
|
|
from util.config.validators.validate_signer import SignerValidator
|
|
from util.config.validators.validate_torrent import BittorrentValidator
|
|
from util.config.validators.validate_ssl import SSLValidator, SSL_FILENAMES
|
|
from util.config.validators.validate_google_login import GoogleLoginValidator
|
|
from util.config.validators.validate_bitbucket_trigger import BitbucketTriggerValidator
|
|
from util.config.validators.validate_gitlab_trigger import GitLabTriggerValidator
|
|
from util.config.validators.validate_github import GitHubLoginValidator, GitHubTriggerValidator
|
|
from util.config.validators.validate_oidc import OIDCLoginValidator
|
|
from util.config.validators.validate_timemachine import TimeMachineValidator
|
|
from util.config.validators.validate_access import AccessSettingsValidator
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
class ConfigValidationException(Exception):
|
|
""" Exception raised when the configuration fails to validate for a known reason. """
|
|
pass
|
|
|
|
# Note: Only add files required for HTTPS to the SSL_FILESNAMES list.
|
|
DB_SSL_FILENAMES = ['database.pem']
|
|
JWT_FILENAMES = ['jwt-authn.cert']
|
|
ACI_CERT_FILENAMES = ['signing-public.gpg', 'signing-private.gpg']
|
|
LDAP_FILENAMES = [LDAP_CERT_FILENAME]
|
|
CONFIG_FILENAMES = (SSL_FILENAMES + DB_SSL_FILENAMES + JWT_FILENAMES + ACI_CERT_FILENAMES +
|
|
LDAP_FILENAMES)
|
|
EXTRA_CA_DIRECTORY = 'extra_ca_certs'
|
|
|
|
VALIDATORS = {
|
|
DatabaseValidator.name: DatabaseValidator.validate,
|
|
RedisValidator.name: RedisValidator.validate,
|
|
StorageValidator.name: StorageValidator.validate,
|
|
EmailValidator.name: EmailValidator.validate,
|
|
GitHubLoginValidator.name: GitHubLoginValidator.validate,
|
|
GitHubTriggerValidator.name: GitHubTriggerValidator.validate,
|
|
GitLabTriggerValidator.name: GitLabTriggerValidator.validate,
|
|
BitbucketTriggerValidator.name: BitbucketTriggerValidator.validate,
|
|
GoogleLoginValidator.name: GoogleLoginValidator.validate,
|
|
SSLValidator.name: SSLValidator.validate,
|
|
LDAPValidator.name: LDAPValidator.validate,
|
|
JWTAuthValidator.name: JWTAuthValidator.validate,
|
|
KeystoneValidator.name: KeystoneValidator.validate,
|
|
SignerValidator.name: SignerValidator.validate,
|
|
SecurityScannerValidator.name: SecurityScannerValidator.validate,
|
|
BittorrentValidator.name: BittorrentValidator.validate,
|
|
OIDCLoginValidator.name: OIDCLoginValidator.validate,
|
|
TimeMachineValidator.name: TimeMachineValidator.validate,
|
|
AccessSettingsValidator.name: AccessSettingsValidator.validate,
|
|
}
|
|
|
|
def validate_service_for_config(service, config, password=None):
|
|
""" Attempts to validate the configuration for the given service. """
|
|
if not service in VALIDATORS:
|
|
return {
|
|
'status': False
|
|
}
|
|
|
|
try:
|
|
VALIDATORS[service](config, get_authenticated_user(), password)
|
|
return {
|
|
'status': True
|
|
}
|
|
except Exception as ex:
|
|
logger.exception('Validation exception')
|
|
return {
|
|
'status': False,
|
|
'reason': str(ex)
|
|
}
|