Denis Ledoux
e050d9150c
- A user using ldap to sign in can now changes his password, providing hid old password. - When the ldap password is changed, empty the possible value for the password set in database so it can no longer be used. - Usually, in all res.users methods auth_ldap replaces, we first try to call `super` before fallbacking to ldap if the call to super fails. e.g. when authenticating, we first check the regular (super) credentials, before fallbacking to ldap if it fails. In this case, we do the opposite on purpose, to give the priority to ldap in case a user changes of password. e.g. a user has the same password in ldap and in database, when he changes, we rather like changing the ldap password and then empty the internal password. closes odoo/odoo#50144 X-original-commit: 8bff93feee0c40dd9ee73ed8217cfdd6abb7de3b Signed-off-by: Olivier Dony (odo) <odo@openerp.com> Signed-off-by: Denis Ledoux (dle) <dle@odoo.com>
60 lines
2.1 KiB
Python
60 lines
2.1 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.exceptions import AccessDenied
|
|
|
|
from odoo import api, models, registry, SUPERUSER_ID
|
|
|
|
|
|
class Users(models.Model):
|
|
_inherit = "res.users"
|
|
|
|
@classmethod
|
|
def _login(cls, db, login, password):
|
|
try:
|
|
return super(Users, cls)._login(db, login, password)
|
|
except AccessDenied as e:
|
|
with registry(db).cursor() as cr:
|
|
cr.execute("SELECT id FROM res_users WHERE lower(login)=%s", (login,))
|
|
res = cr.fetchone()
|
|
if res:
|
|
raise e
|
|
|
|
env = api.Environment(cr, SUPERUSER_ID, {})
|
|
Ldap = env['res.company.ldap']
|
|
for conf in Ldap._get_ldap_dicts():
|
|
entry = Ldap._authenticate(conf, login, password)
|
|
if entry:
|
|
return Ldap._get_or_create_user(conf, login, entry)
|
|
raise e
|
|
|
|
def _check_credentials(self, password):
|
|
try:
|
|
super(Users, self)._check_credentials(password)
|
|
except AccessDenied:
|
|
if self.env.user.active:
|
|
Ldap = self.env['res.company.ldap']
|
|
for conf in Ldap._get_ldap_dicts():
|
|
if Ldap._authenticate(conf, self.env.user.login, password):
|
|
return
|
|
raise
|
|
|
|
@api.model
|
|
def change_password(self, old_passwd, new_passwd):
|
|
if new_passwd:
|
|
Ldap = self.env['res.company.ldap']
|
|
for conf in Ldap._get_ldap_dicts():
|
|
changed = Ldap._change_password(conf, self.env.user.login, old_passwd, new_passwd)
|
|
if changed:
|
|
uid = self.env.user.id
|
|
self._set_empty_password(uid)
|
|
self.invalidate_cache(['password'], [uid])
|
|
return True
|
|
return super(Users, self).change_password(old_passwd, new_passwd)
|
|
|
|
def _set_empty_password(self, uid):
|
|
self.env.cr.execute(
|
|
'UPDATE res_users SET password=NULL WHERE id=%s',
|
|
(uid,)
|
|
)
|