Resolve "Support custom authentication backends"

hansegucker commented

2020-07-15 11:34:55 +02:00

Owner

Close #295

nik commented

2020-07-15 12:16:14 +02:00

Owner

This MR is lacking screenshots and a related issue. Please open a feature request issue and outlay the idea behind this, the current use cases, and security considerations (e.g. how do you prevent a malicious app from wreaking havoc? Consider attack chains — i.e. some third-party, or even official, app is replaced by malicious code, how do you keep the impact small? This change potentially allows an app to completely disable authentication.)

hansegucker commented

2020-07-15 13:52:14 +02:00

Author

Owner

changed title from {-Custom authentication backends-} to {+Resolve "Support custom authentication backends"+}

changed title from **{-Custom authentication backends-}** to **{+Resolve "Support custom authentication backends"+}**

hansegucker commented

2020-07-15 13:52:14 +02:00

Author

Owner

changed the description

hansegucker commented

2020-07-15 15:20:39 +02:00

Author

Owner

I understand that you're concerned about security risks. But actually an app can provide a public view which internally creates an user and logins the user directly – the authentication is completely disabled, too. Please help me to understand how this differs.

nik commented

2020-07-15 15:47:52 +02:00

Owner

Have you ever done a code audit?

Some things (like calling createsuperuser()) are easier to spot than swapping if/else in an authentication conditional ;).

Have you ever done a code audit? Some things (like calling createsuperuser()) are easier to spot than swapping if/else in an authentication conditional ;).

hansegucker commented

2020-07-15 15:51:18 +02:00

Author

Owner

Have you ever done a code audit?

As you can imagine, no, I have never done.

Some things (like calling createsuperuser()) are easier to spot than swapping if/else in an authentication conditional ;).

I have multiple possible ideas:

Logging a warning if there are additional backends included
Show all included backends in system status
Let users activate backends by site preferences

> Have you ever done a code audit? As you can imagine, no, I have never done. > Some things (like calling createsuperuser()) are easier to spot than swapping if/else in an authentication conditional ;). I have multiple possible ideas: - Logging a warning if there are additional backends included - Show all included backends in system status - Let users activate backends by site preferences

nik commented

2020-07-15 15:56:56 +02:00

Owner

Having a whitelist is site preferences seems like a good step.

hansegucker commented

2020-07-15 17:17:06 +02:00

Author

Owner

added 1 commit

71b3c2ad - Make custom authentication backends configurable via site preferences

Compare with previous version

added 1 commit <ul><li>71b3c2ad - Make custom authentication backends configurable via site preferences</li></ul> [Compare with previous version](/AlekSIS/official/AlekSIS/-/merge_requests/334/diffs?diff_id=2830&start_sha=4d8b48a38e1a6f4619011f47771280e57aa1a58d)

hansegucker commented

2020-07-15 17:17:50 +02:00

Author

Owner

OK, I did some work on this topic.

hansegucker commented

2020-07-15 17:17:52 +02:00

Author

Owner

resolved all threads

hansegucker commented

2020-07-15 17:19:28 +02:00

Author

Owner

### With alternative login options ![image](/uploads/3a0edb81c26b036b900376493f3a13be/image.png) ### Without alternative login options ![image](/uploads/1adb9d20cf2a573c9196d8773b61477f/image.png)

nik scheduled this pull request to auto merge when all checks succeed

2020-07-15 17:20:16 +02:00

nik commented

2020-07-17 12:41:24 +02:00

Owner

Please add a test case that tries to add a backend and login using this backend, without enabling it in site preferences.

hansegucker commented

2020-07-20 17:22:30 +02:00

Author

Owner

aborted the automatic merge because source branch was updated

hansegucker commented

2020-07-20 17:22:31 +02:00

Author

Owner

added 1 commit

5680c5d0 - Provide alternativ login options as backend list, too

Compare with previous version

added 1 commit <ul><li>5680c5d0 - Provide alternativ login options as backend list, too</li></ul> [Compare with previous version](/AlekSIS/official/AlekSIS/-/merge_requests/334/diffs?diff_id=2861&start_sha=71b3c2adece411c7eed2c802183f065eb3ba9071)

hansegucker commented

2020-07-21 20:32:10 +02:00

Author

Owner

added 1 commit

b20a9566 - Add test for custom authentication backends and fix a little bit

Compare with previous version

added 1 commit <ul><li>b20a9566 - Add test for custom authentication backends and fix a little bit</li></ul> [Compare with previous version](/AlekSIS/official/AlekSIS/-/merge_requests/334/diffs?diff_id=2865&start_sha=5680c5d0868af0dfa5faeffa987ec1401877ce7c)

hansegucker commented

2020-07-21 20:32:25 +02:00

Author

Owner

Done.