mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
7dd22661d6
BookWyrm core has no OIDC/LDAP login, so behind the oauth2-proxy a gated visitor only reaches BookWyrm's own login form. Add a trusted-header SSO bridge (files/sso/header_auth.py: RemoteUser middleware + backend) that turns the oauth2-proxy identity (X-Forwarded-Preferred-Username, set by Keycloak after OIDC or LDAP-federated login) into a real BookWyrm session, auto-provisioning the local user. Active only when PROXY_HEADER_SSO is truthy (= sso is_proxy_gated, centralised in BOOKWYRM_SSO_PROXY_GATED). Supporting fixes: USE_S3_FOR_EXPORTS=false (exports stay local; SeaweedFS has no per-bucket ACL so private exports must not share the public media bucket) fixes the fresh-build settings crash / preferences 502; proxy_pass_request_body off on the keycloak sso_proxy /oauth2/ block so the auth_request subrequest no longer hangs 60s on gated POST bodies (504->500); split playwright.spec.js into per-test files; add positive (oidc/ldap -> authenticated session) + negative (forged header -> gated) SSO e2e tests; fix the avatar test (form-scoped Save locator + valid PNG); remove dead BookWyrm OIDC_* env; unit tests for the bridge + the gated settings patch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
13 lines
559 B
Python
13 lines
559 B
Python
# ruff: noqa: F821
|
|
import os as _infinito_sso_os
|
|
|
|
if _infinito_sso_os.environ.get("PROXY_HEADER_SSO", "").lower() in ("true", "1", "yes"):
|
|
_infinito_auth_mw = "django.contrib.auth.middleware.AuthenticationMiddleware"
|
|
_infinito_sso_mw = "bookwyrm.header_auth.ProxyHeaderMiddleware"
|
|
if _infinito_sso_mw not in MIDDLEWARE:
|
|
MIDDLEWARE.insert(MIDDLEWARE.index(_infinito_auth_mw) + 1, _infinito_sso_mw)
|
|
AUTHENTICATION_BACKENDS = [
|
|
"bookwyrm.header_auth.ProxyHeaderBackend",
|
|
"django.contrib.auth.backends.ModelBackend",
|
|
]
|