- {{obj.comment}}
+ {{obj.comment|linebreaks}}
diff --git a/konova/tests/test_views.py b/konova/tests/test_views.py
index 860b3616..95fb8367 100644
--- a/konova/tests/test_views.py
+++ b/konova/tests/test_views.py
@@ -509,7 +509,7 @@ class BaseViewTestCase(BaseTestCase):
def setUp(self) -> None:
super().setUp()
- self.login_url = reverse("simple-sso-login")
+ self.login_url = reverse("oauth-login")
def assert_url_success(self, client: Client, urls: list):
""" Assert for all given urls a direct 200 response
diff --git a/konova/urls.py b/konova/urls.py
index 260251ad..8dc9a01f 100644
--- a/konova/urls.py
+++ b/konova/urls.py
@@ -13,21 +13,19 @@ Including another URLconf
1. Import the include() function: from django.urls import include, path
2. Add a URL to urlpatterns: path('blog/', include('blog.urls'))
"""
-import debug_toolbar
from django.contrib import admin
from django.urls import path, include
-from konova.settings import SSO_SERVER, SSO_PUBLIC_KEY, SSO_PRIVATE_KEY, DEBUG
-from konova.sso.sso import KonovaSSOClient
from konova.views.logout import LogoutView
from konova.views.geometry import GeomParcelsView, GeomParcelsContentView
from konova.views.home import HomeView
from konova.views.map_proxy import ClientProxyParcelSearch, ClientProxyParcelWFS
+from konova.views.oauth import OAuthLoginView, OAuthCallbackView
-sso_client = KonovaSSOClient(SSO_SERVER, SSO_PUBLIC_KEY, SSO_PRIVATE_KEY)
urlpatterns = [
path('admin/', admin.site.urls),
- path('login/', include(sso_client.get_urls())),
+ path('oauth/callback/', OAuthCallbackView.as_view(), name="oauth-callback"),
+ path('oauth/login/', OAuthLoginView.as_view(), name="oauth-login"),
path('logout/', LogoutView.as_view(), name="logout"),
path('', HomeView.as_view(), name="home"),
path('intervention/', include("intervention.urls")),
@@ -44,10 +42,5 @@ urlpatterns = [
path('client/proxy/wfs', ClientProxyParcelWFS.as_view(), name="client-proxy-wfs"),
]
-if DEBUG:
- urlpatterns += [
- path('__debug__/', include(debug_toolbar.urls)),
- ]
-
handler404 = "konova.views.error.get_404_view"
handler500 = "konova.views.error.get_500_view"
diff --git a/konova/views/oauth.py b/konova/views/oauth.py
new file mode 100644
index 00000000..5748d482
--- /dev/null
+++ b/konova/views/oauth.py
@@ -0,0 +1,125 @@
+"""
+Author: Michel Peltriaux
+Organization: Struktur- und Genehmigungsdirektion Nord, Rhineland-Palatinate, Germany
+Contact: ksp-servicestelle@sgdnord.rlp.de
+Created on: 26.04.24
+
+"""
+import base64
+import hashlib
+from urllib.parse import urlencode
+
+import requests
+from django.contrib.auth import login
+from django.http import HttpRequest
+from django.shortcuts import redirect
+from django.urls import reverse
+from django.utils.timezone import now
+from django.views import View
+
+from api.models import OAuthToken
+from konova.sub_settings.django_settings import BASE_URL
+from konova.sub_settings.sso_settings import SSO_SERVER_BASE, OAUTH_CODE_VERIFIER, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET
+
+
+class OAuthLoginView(View):
+ """
+ Starts OAuth Login procedure
+ -> AnonymousUser is redirected to SSO component using specific parameters
+ -> After successful login (in SSO component), user will be redirected to a specific callback url (OAuthCallbackView)
+ -> Callback view uses retrieved authorization token to get a proper access token from SSO component
+ -> SSO component answers with access token
+ -> OAuthCallbackView uses token in Authorization header to access user data of logged-in user in SSO component
+ -> OAuthCallbackView creates/updates user
+ -> OAuthCallbackView logs in user and redirects to default home view
+
+ """
+
+ def __create_code_challenge(self):
+ """
+ Creates a code verifier and code challenge for extra security.
+ See https://django-oauth-toolkit.readthedocs.io/en/latest/getting_started.html#authorization-code for further
+ information
+
+ Returns:
+
+ """
+ code_verifier = OAUTH_CODE_VERIFIER
+
+ code_challenge = hashlib.sha256(code_verifier.encode('utf-8')).digest()
+ code_challenge = base64.urlsafe_b64encode(code_challenge).decode('utf-8').replace('=', '')
+ return code_verifier, code_challenge
+
+ def get(self, request: HttpRequest, *args, **kwargs):
+ """
+ Redirects user to OAuth SSO webservice for credential based login there
+
+ Args:
+ request ():
+ *args ():
+ **kwargs ():
+
+ Returns:
+
+ """
+ oauth_authentication_code_url = f"{SSO_SERVER_BASE}o/authorize/"
+ redirect_uri = f'{BASE_URL}{reverse("oauth-callback")}'
+
+ code_verifier, code_challenge = self.__create_code_challenge()
+
+ urlencode_params = urlencode(
+ {
+ "response_type": "code",
+ "code_challenge": code_challenge,
+ "code_challenge_method": "S256",
+ "client_id": OAUTH_CLIENT_ID,
+ "redirect_uri": redirect_uri,
+ }
+ )
+ url = f"{oauth_authentication_code_url}?{urlencode_params}"
+ return redirect(url)
+
+
+class OAuthCallbackView(View):
+ """
+ Callback view for OAuth2.0 authentication token.
+ Authentication tokens will be exchanged for access token.
+ Access Token will be used for fetching user data from SSO component.
+ User data will be used for creating/updating user data inside this app.
+ User will be logged-in and redirected to default home view.
+
+ """
+
+ def get(self, request: HttpRequest, *args, **kwargs):
+ authentication_code = request.GET.get("code")
+ oauth_acces_token_url = f"{SSO_SERVER_BASE}o/token/"
+
+ callback_url = f'{BASE_URL}{reverse("oauth-callback")}'
+
+ params = {
+ "grant_type": "authorization_code",
+ "code": authentication_code,
+ "redirect_uri": callback_url,
+ "code_verifier": OAUTH_CODE_VERIFIER,
+ "client_id": OAUTH_CLIENT_ID,
+ "client_secret": OAUTH_CLIENT_SECRET
+ }
+ access_code_response = requests.post(
+ oauth_acces_token_url,
+ data=params
+ )
+ received_on = now()
+
+ access_code_response_body = access_code_response.content.decode("utf-8")
+ status_code_invalid = access_code_response.status_code != 200
+ if status_code_invalid:
+ raise RuntimeError(f"OAuth access token could not be fetched: {access_code_response.text}")
+
+ oauth_access_token = OAuthToken.from_access_token_response(access_code_response_body, received_on)
+ oauth_access_token.save()
+ user = oauth_access_token.update_and_get_user()
+ user.oauth_replace_token(oauth_access_token)
+
+ login(request, user)
+ return redirect("home")
+
diff --git a/requirements.txt b/requirements.txt
index 6d031927..e1815ae8 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,40 +1,45 @@
amqp==5.2.0
-asgiref==3.7.2
+asgiref==3.8.1
async-timeout==4.0.3
-beautifulsoup4==4.12.3
+beautifulsoup4==4.13.0b2
billiard==4.2.0
cached-property==1.5.2
-celery==5.3.6
-certifi==2024.2.2
+celery==5.4.0
+certifi==2024.6.2
+cffi==1.17.0rc1
chardet==5.2.0
charset-normalizer==3.3.2
click==8.1.7
-click-didyoumean==0.3.0
+click-didyoumean==0.3.1
click-plugins==1.1.1
click-repl==0.3.0
-coverage==7.3.3
+coverage==7.5.3
+cryptography==42.0.8
Deprecated==1.2.14
-Django==5.0.3
+Django==5.0.6
django-autocomplete-light==3.11.0
django-bootstrap-modal-forms==3.0.4
-django-bootstrap4==24.1
-django-debug-toolbar==4.2.0
+django-bootstrap4==24.3
django-environ==0.11.2
-django-filter==24.1
+django-filter==24.2
django-fontawesome-5==1.0.18
-django-simple-sso==1.2.0
+django-oauth-toolkit==2.4.0
django-tables2==2.7.0
et-xmlfile==1.1.0
-idna==3.6
-importlib_metadata==7.0.2
-itsdangerous==0.24
-kombu==5.3.5
+gunicorn==22.0.0
+idna==3.7
+importlib_metadata==7.1.0
+jwcrypto==1.5.6
+kombu==5.3.7
+oauthlib==3.2.2
openpyxl==3.2.0b1
-packaging==24.0
+packaging==24.1
pika==1.3.2
-prompt-toolkit==3.0.43
-psycopg==3.1.18
-psycopg-binary==3.1.18
+pillow==10.3.0
+prompt_toolkit==3.0.47
+psycopg==3.1.19
+psycopg-binary==3.1.19
+pycparser==2.22
pyparsing==3.1.2
pypng==0.20220715.0
pyproj==3.6.1
@@ -42,17 +47,16 @@ python-dateutil==2.9.0.post0
pytz==2024.1
PyYAML==6.0.1
qrcode==7.3.1
-redis==5.1.0a1
-requests==2.31.0
+redis==5.1.0b6
+requests==2.32.3
six==1.16.0
soupsieve==2.5
-sqlparse==0.4.4
-typing_extensions==4.10.0
+sqlparse==0.5.0
+typing_extensions==4.12.2
tzdata==2024.1
urllib3==2.2.1
vine==5.1.0
-wcwidth==0.2.12
-webservices==0.7
+wcwidth==0.2.13
wrapt==1.16.0
xmltodict==0.13.0
-zipp==3.17.0
+zipp==3.19.2
diff --git a/user/admin.py b/user/admin.py
index bf5f5f86..ff848e53 100644
--- a/user/admin.py
+++ b/user/admin.py
@@ -29,6 +29,7 @@ class UserAdmin(admin.ModelAdmin):
"is_staff",
"is_superuser",
"api_token",
+ "oauth_token",
"groups",
"notifications",
"date_joined",
diff --git a/user/migrations/0009_user_oauth_token.py b/user/migrations/0009_user_oauth_token.py
new file mode 100644
index 00000000..6d4f11cd
--- /dev/null
+++ b/user/migrations/0009_user_oauth_token.py
@@ -0,0 +1,20 @@
+# Generated by Django 5.0.4 on 2024-04-30 07:20
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+ dependencies = [
+ ('api', '0003_oauthtoken'),
+ ('user', '0008_alter_user_id'),
+ ]
+
+ operations = [
+ migrations.AddField(
+ model_name='user',
+ name='oauth_token',
+ field=models.ForeignKey(blank=True, db_comment='OAuth token for the user', null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to='api.oauthtoken'),
+ ),
+ ]
diff --git a/user/models/user.py b/user/models/user.py
index dde88dcd..33390885 100644
--- a/user/models/user.py
+++ b/user/models/user.py
@@ -9,7 +9,7 @@ from django.contrib.auth.models import AbstractUser
from django.db import models
-from api.models import APIUserToken
+from api.models import APIUserToken, OAuthToken
from konova.settings import ZB_GROUP, DEFAULT_GROUP, ETS_GROUP
from konova.utils.mailer import Mailer
from user.enums import UserNotificationEnum
@@ -24,6 +24,14 @@ class User(AbstractUser):
help_text="The user's API token",
on_delete=models.SET_NULL
)
+ oauth_token = models.ForeignKey(
+ "api.OAuthToken",
+ blank=True,
+ null=True,
+ on_delete=models.SET_NULL,
+ db_comment="OAuth token for the user",
+ related_name="+"
+ )
def is_notification_setting_set(self, notification_enum: UserNotificationEnum):
return self.notifications.filter(
@@ -214,4 +222,46 @@ class User(AbstractUser):
shared_teams = self.teams.filter(
deleted__isnull=True
)
- return shared_teams
\ No newline at end of file
+ return shared_teams
+
+ @staticmethod
+ def oauth_update_user(user_data: dict):
+ """
+ Get or create a user depending on given user_data.
+ If the user record already exists, it's data will be updated using user_data.
+
+ Args:
+ user_data (dict): User data from OAuth SSO component
+
+ Returns:
+ user (User): The resolved user
+ """
+ username = user_data.get("username")
+ user, is_created = User.objects.get_or_create(
+ username=username
+ )
+
+ if is_created:
+ user.set_unusable_password()
+
+ user.first_name = user_data.get("first_name")
+ user.last_name = user_data.get("last_name")
+ user.email = user_data.get("email")
+
+ return user
+
+ def oauth_replace_token(self, token: OAuthToken):
+ """
+ Drops old token (if existing) and stores given token.
+
+ Args:
+ token (OAuthToken): New token
+
+ Returns:
+ user (User)
+ """
+ if self.oauth_token:
+ self.oauth_token.delete()
+ self.oauth_token = token
+ self.save()
+ return self
\ No newline at end of file
diff --git a/user/urls.py b/user/urls.py
index ed975488..cb6e20b0 100644
--- a/user/urls.py
+++ b/user/urls.py
@@ -9,11 +9,13 @@ from django.urls import path
from user.autocomplete.share import ShareUserAutocomplete, ShareTeamAutocomplete
from user.autocomplete.team import TeamAdminAutocomplete
-from user.views import *
+from user.views.propagate import PropagateUserView
+from user.views.views import *
app_name = "user"
urlpatterns = [
path("", index_view, name="index"),
+ path("propagate/", PropagateUserView.as_view(), name="propagate"),
path("notifications/", notifications_view, name="notifications"),
path("token/api", api_token_view, name="api-token"),
path("contact/