tyler.durden
/
icingaweb2
mirror of https://github.com/Icinga/icingaweb2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Auth: do not ask for unrelated group membership 

If a specific User-Backend has been assigned to a Group Backend, and
the User has been authenticated by another User-Backend, then there is
no need to ask the unrelated Groups Backend for membership.
This commit is contained in:
Thomas Gelf 2018-12-18 11:59:56 +01:00
parent df486d829d
commit 08c879249b
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
library/Icinga/Authentication/Auth.php
View File

@ -139,7 +139,20 @@ class Auth
$this->getResponse()->setReloadCss(true);
$user->setPreferences($preferences);
$groups = $user->getGroups();
$userBackendName = $user->getAdditional('backend_name');
foreach (Config::app('groups') as $name => $config) {
$groupsUserBackend = $config->user_backend;
if ($groupsUserBackend
&& $groupsUserBackend !== 'none'
&& $userBackendName !== null
&& $groupsUserBackend !== $userBackendName
) {
// Do not ask for Group membership if a specific User Backend
// has been assigned to that Group Backend, and the user has
// been authenticated by another User Backend
continue;
}
try {
$groupBackend = UserGroupBackend::create($name, $config);
$groupsFromBackend = $groupBackend->getMemberships($user);