Make it possible to block OAuth signin to accounts

This adds a checkbox to each user account letting the user block the use
of OAuth to this account, forcing the use of internal authentication.

diff --git a/pgweb/account/oauthclient.py b/pgweb/account/oauthclient.py
index 808d284bcb1821da1b32f9e31fb548efddf8f989..e6765a0ff9891b4c296a8c81ec2f9692ad938fe5 100644 (file)
--- a/pgweb/account/oauthclient.py
+++ b/pgweb/account/oauthclient.py
@@ -6,6 +6,7 @@ from django.contrib.auth.models import User
 import sys
 
 from pgweb.util.misc import get_client_ip
+from pgweb.core.models import UserProfile
 
 import logging
 log = logging.getLogger(__name__)
@@ -59,6 +60,10 @@ def _login_oauth(request, provider, authurl, tokenurl, scope, authdatafunc):
             return HttpResponseRedirect('/account/signup/oauth/')
 
         log.info("Oauth signin of {0} using {1} from {2}.".format(email, provider, get_client_ip(request)))
+        if UserProfile.objects.filter(user=user).exists():
+            if UserProfile.objects.get(user=user).block_oauth:
+                log.warning("Account {0} ({1}) is blocked from OAuth login".format(user.username, email))
+                return HttpResponse("OAuth login not allowed to this account.")
 
         user.backend = settings.AUTHENTICATION_BACKENDS[0]
         django_login(request, user)

diff --git a/pgweb/core/migrations/0002_block_oauth.py b/pgweb/core/migrations/0002_block_oauth.py
new file mode 100644 (file)
index 0000000..b5d2364
--- /dev/null
+++ b/pgweb/core/migrations/0002_block_oauth.py
@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.17 on 2019-02-10 13:21
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='userprofile',
+            name='block_oauth',
+            field=models.BooleanField(default=False, help_text='Disallow login to this account using OAuth providers like Google or Microsoft.', verbose_name='Block OAuth login'),
+        ),
+    ]

diff --git a/pgweb/core/models.py b/pgweb/core/models.py
index e03d7458f5a089291be448b5c8bd9726b0a38e58..22b403d92219f5f2009d60e925610c8c829289eb 100644 (file)
--- a/pgweb/core/models.py
+++ b/pgweb/core/models.py
@@ -198,6 +198,9 @@ class UserProfile(models.Model):
     user = models.OneToOneField(User, null=False, blank=False, primary_key=True)
     sshkey = models.TextField(null=False, blank=True, verbose_name="SSH key", help_text="Paste one or more public keys in OpenSSH format, one per line.", validators=[validate_sshkey, ])
     lastmodified = models.DateTimeField(null=False, blank=False, auto_now=True)
+    block_oauth = models.BooleanField(null=False, blank=False, default=False,
+                                      verbose_name="Block OAuth login",
+                                      help_text="Disallow login to this account using OAuth providers like Google or Microsoft.")
 
 
 # Notifications sent for any moderated content.