@ -7,12 +7,10 @@ import logging
from django . db import models
from django . utils . translation import ugettext_lazy as _
from django . core . validators import MinValueValidator , MaxValueValidator
from django . core . cache import cache
from common . utils import signer , get_object_or_none
from common . utils import signer
from . base import BaseUser
from . asset import Asset
from . authbook import AuthBook
__all__ = [ ' AdminUser ' , ' SystemUser ' , ' ProtocolMixin ' ]
@ -82,155 +80,11 @@ class ProtocolMixin:
return self . protocol in self . ASSET_CATEGORY_PROTOCOLS
class AuthMixin :
username_same_with_user : bool
protocol : str
ASSET_CATEGORY_PROTOCOLS : list
login_mode : str
LOGIN_MANUAL : str
id : str
username : str
password : str
private_key : str
public_key : str
def set_temp_auth ( self , asset_or_app_id , user_id , auth , ttl = 300 ) :
if not auth :
raise ValueError ( ' Auth not set ' )
key = ' TEMP_PASSWORD_ {} _ {} _ {} ' . format ( self . id , asset_or_app_id , user_id )
logger . debug ( f ' Set system user temp auth: { key } ' )
cache . set ( key , auth , ttl )
def get_temp_auth ( self , asset_or_app_id , user_id ) :
key = ' TEMP_PASSWORD_ {} _ {} _ {} ' . format ( self . id , asset_or_app_id , user_id )
logger . debug ( f ' Get system user temp auth: { key } ' )
password = cache . get ( key )
return password
def _clean_auth_info_if_manual_login_mode ( self ) :
if self . login_mode == self . LOGIN_MANUAL :
self . password = ' '
self . private_key = ' '
self . public_key = ' '
def _load_tmp_auth_if_has ( self , asset_or_app_id , user_id ) :
if self . login_mode != self . LOGIN_MANUAL :
return
if not asset_or_app_id or not user_id :
return
auth = self . get_temp_auth ( asset_or_app_id , user_id )
if not auth :
return
username = auth . get ( ' username ' )
password = auth . get ( ' password ' )
if username :
self . username = username
if password :
self . password = password
def load_app_more_auth ( self , app_id = None , username = None , user_id = None ) :
# 清除认证信息
self . _clean_auth_info_if_manual_login_mode ( )
# 先加载临时认证信息
if self . login_mode == self . LOGIN_MANUAL :
self . _load_tmp_auth_if_has ( app_id , user_id )
return
# Remote app
from applications . models import Application
app = get_object_or_none ( Application , pk = app_id )
if app and app . category_remote_app :
# Remote app
self . _load_remoteapp_more_auth ( app , username , user_id )
return
# Other app
# 更新用户名
from users . models import User
user = get_object_or_none ( User , pk = user_id ) if user_id else None
if self . username_same_with_user :
if user and not username :
_username = user . username
else :
_username = username
self . username = _username
def _load_remoteapp_more_auth ( self , app , username , user_id ) :
asset = app . get_remote_app_asset ( raise_exception = False )
if asset :
self . load_asset_more_auth ( asset_id = asset . id , username = username , user_id = user_id )
def load_asset_special_auth ( self , asset , username = ' ' ) :
"""
AuthBook 的数据状态
| asset | systemuser | username |
1 | * | * | x |
2 | * | x | * |
当前 AuthBook 只有以上两种状态 ， systemuser 与 username 不会并存 。
正常的资产与系统用户关联产生的是第1种状态 ， 改密则产生第2种状态 。 改密之后
只有 username 而没有 systemuser 。
Freq : 关联同一资产的多个系统用户指定同一用户名时 ， 修改用户密码会影响所有系统用户
这里有一个不对称的行为 ， 同名系统用户密码覆盖
当有相同 username 的多个系统用户时 ， 有改密动作之后 ， 所有的同名系统用户都使用最后
一次改动 ， 但如果没有发生过改密 ， 同名系统用户使用的密码还是各自的 。
"""
if username == ' ' :
username = self . username
authbook = AuthBook . objects . filter (
asset = asset , username = username , systemuser__isnull = True
) . order_by ( ' -date_created ' ) . first ( )
if not authbook :
authbook = AuthBook . objects . filter (
asset = asset , systemuser = self
) . order_by ( ' -date_created ' ) . first ( )
if not authbook :
return None
authbook . load_auth ( )
self . password = authbook . password
self . private_key = authbook . private_key
self . public_key = authbook . public_key
def load_asset_more_auth ( self , asset_id = None , username = None , user_id = None ) :
from users . models import User
self . _clean_auth_info_if_manual_login_mode ( )
# 加载临时认证信息
if self . login_mode == self . LOGIN_MANUAL :
self . _load_tmp_auth_if_has ( asset_id , user_id )
return
# 更新用户名
user = get_object_or_none ( User , pk = user_id ) if user_id else None
if self . username_same_with_user :
if user and not username :
_username = user . username
else :
_username = username
self . username = _username
# 加载某个资产的特殊配置认证信息
asset = get_object_or_none ( Asset , pk = asset_id ) if asset_id else None
if not asset :
logger . debug ( ' Asset not found, pass ' )
return
self . load_asset_special_auth ( asset , self . username )
class SystemUser ( ProtocolMixin , AuthMixin , BaseUser ) :
class SystemUser ( ProtocolMixin , BaseUser ) :
LOGIN_AUTO = ' auto '
LOGIN_MANUAL = ' manual '
LOGIN_MODE_CHOICES = (
( LOGIN_AUTO , _ ( ' Automatic managed ' ) ) ,
( LOGIN_AUTO , _ ( ' 使用账号 ' ) ) ,
( LOGIN_MANUAL , _ ( ' Manually input ' ) )
)
@ -246,13 +100,19 @@ class SystemUser(ProtocolMixin, AuthMixin, BaseUser):
)
users = models . ManyToManyField ( ' users.User ' , blank = True , verbose_name = _ ( " Users " ) )
groups = models . ManyToManyField ( ' users.UserGroup ' , blank = True , verbose_name = _ ( " User groups " ) )
type = models . CharField ( max_length = 16 , choices = Type . choices , default = Type . common , verbose_name = _ ( ' Type ' ) )
priority = models . IntegerField ( default = 81 , verbose_name = _ ( " Priority " ) , help_text = _ ( " 1-100, the lower the value will be match first " ) , validators = [ MinValueValidator ( 1 ) , MaxValueValidator ( 100 ) ] )
priority = models . IntegerField (
default = 81 , verbose_name = _ ( " Priority " ) ,
help_text = _ ( " 1-100, the lower the value will be match first " ) ,
validators = [ MinValueValidator ( 1 ) , MaxValueValidator ( 100 ) ]
)
protocol = models . CharField ( max_length = 16 , choices = ProtocolMixin . Protocol . choices , default = ' ssh ' , verbose_name = _ ( ' Protocol ' ) )
auto_push = models . BooleanField ( default = True , verbose_name = _ ( ' Auto push ' ) )
login_mode = models . CharField ( choices = LOGIN_MODE_CHOICES , default = LOGIN_AUTO , max_length = 10 , verbose_name = _ ( ' Login mode ' ) )
auto_create_account = models . BooleanField ( default = False , verbose_name = _ ( " 自动创建账号 " ) )
auto_push_account = models . BooleanField ( default = True , verbose_name = _ ( ' 推送账号到资产 ' ) )
type = models . CharField ( max_length = 16 , choices = Type . choices , default = Type . common , verbose_name = _ ( ' Type ' ) )
sudo = models . TextField ( default = ' /bin/whoami ' , verbose_name = _ ( ' Sudo ' ) )
shell = models . CharField ( max_length = 64 , default = ' /bin/bash ' , verbose_name = _ ( ' Shell ' ) )
login_mode = models . CharField ( choices = LOGIN_MODE_CHOICES , default = LOGIN_AUTO , max_length = 10 , verbose_name = _ ( ' Login mode ' ) )
sftp_root = models . CharField ( default = ' tmp ' , max_length = 128 , verbose_name = _ ( " SFTP Root " ) )
token = models . TextField ( default = ' ' , verbose_name = _ ( ' Token ' ) )
home = models . CharField ( max_length = 4096 , default = ' ' , verbose_name = _ ( ' Home ' ) , blank = True )
@ -277,7 +137,7 @@ class SystemUser(ProtocolMixin, AuthMixin, BaseUser):
return self . get_login_mode_display ( )
def is_need_push ( self ) :
if self . auto_push and self . is_protocol_support_push :
if self . auto_push_account and self . is_protocol_support_push :
return True
else :
return False
ibuler
2 years ago