Package: django-allauth-ens
This package is meant to ease the management of authentication of django-apps
at the ENS.On top ofdjango-allauth, which provides easy ways to configure the
authentication of django-apps, this package provides:social authentication using Clipper (cas.eleves);ready-to-use templates in replacement of allauth’ ones;helpers to useallauth’s login and logout views instead of those
provided by third-parties (Django admin, wagtail,etc).ContentsInstallationConfigurationViewsTemplatesProvidersClipperAdaptersDemo SiteDevelopmentStylesheetsUsing bundlerTestsLocal environmentAllHowtosSignup disabled, except for clipper provider (auto-signup)InstallationFirst,install django-allauth.Then, installdjango-allauth-ens:$pipinstalldjango-allauth-ensAnd edit your settings file:INSTALLED_APPS=[# …# Above allauth to replace its templates.'allauth_ens',# Added when you installed allauth.'allauth','allauth.account','allauth.socialaccount',# Required to use CAS-based providers (e.g. Clipper).'allauth_cas',# …]ConfigurationSee also theallauth configurationandadvanced usagedocs pages.ACCOUNT_HOME_URLOptional— A view name or an url path.Used as a link from the templates ofallauth_ensto return to your
application.Examples:'home','/home/'ACCOUNT_DETAILS_URLOptional— A view name or an url path.Used as a link from the templates ofallauth_ensfor a logged in user to
access their profile in your app.Examples:'my-account','/my-account/'ALLAUTH_ENS_HIGHLIGHT_CLIPPEROptional— Boolean (default:True).When set toTrue, displays prominently the Clipper option in the login view
(if you use theallauth_enstemplates).ViewsCapture other login and logout viewsYou can use thecapture_loginandcapture_logoutviews to replace the
login and logout views of other applications. They redirect to their similarallauth’s view and forward the query string, so that if a GET parameternextis given along the initial request, user is redirected to this url on
successful login and logout.This requires to add urls before the include of the app’ urls.For example, to replace the Django admin login and logout views with allauth’s
ones:fromallauth_ens.viewsimportcapture_login,capture_logouturlpatterns=[# …# Add it before include of admin urls.url(r'^admin/login/$',capture_login),url(r'^admin/logout/$',capture_logout),url(r'^admin/$',include(admin.site.urls)),# …]TemplatesThe templates provided byallauthonly contains the bare minimum. Hopefully,
this package includes ready-to-use templates. They are automatically used if
you put'allauth_ens'before'allauth'in yourINSTALLED_APPS,ProvidersGoogle, Facebook¸ but also Clipper…To interact with an external authentication service, you must add the
corresponding provider application to yourINSTALLED_APPS.allauthalready includesseveral providers(see alsotheir python path).
In addition to that, this package adds the following providers:ClipperIt uses the CAS serverhttps://cas.eleves.ens.fr/.InstallationAdd'allauth_ens.providers.clipper'to theINSTALLED_APPS.ConfigurationAvailable settings and their default value:SOCIALACCOUNT_PROVIDERS={# …'clipper':{# These settings control whether a message containing a link to# disconnect from the CAS server is added when users log out.'MESSAGE_SUGGEST_LOGOUT_ON_LOGOUT':True,'MESSAGE_SUGGEST_LOGOUT_ON_LOGOUT_LEVEL':messages.INFO,},}Auto-signupPopulated datausername:<clipper>email (primary and verified):<clipper>@clipper.ens.frAdaptersLong Term Clipper AdapterWe provide an easy-to-use SocialAccountAdapter to handle the fact that Clipper
accounts are not eternal, and that there is no guarantee that the clipper
usernames won’t be reused later.This adapter also handles getting basic information about the user from SPI’s
LDAP.Important:If you are building on top ofallauth, take care to preserve
theextra_data['ldap']ofSocialAccountinstances related toClipper(whereprovider_idisclipperorclipper_inactive).ConfigurationSetSOCIALACCOUNT_ADAPTER='allauth_ens.adapter.LongTermClipperAccountAdapter'insettings.pyAuto-signupPopulated datausername:<clipper>@<entranceyear>email: from LDAP’smailRoutingAddressfield, or<clipper>@clipper.ens.frfirst_name,last_namefrom LDAP’scnfieldentrance_year(as 2-digit string),department_code,departmentandpromotion(department+year) parsed from LDAP’shomeDirectoryfieldextra_datain SocialAccount instance, containing all these field exceptpromotion(and available only on first connection)Account deprecationAt the beginning of each year (i.e. early November), to prevent clipper
username conflicts, you should run$ python manage.py deprecate_clippers.
Every association clipper username <-> user will then be put on hold, and at
the first subsequent connection, a verification of the account will be made
(using LDAP), so that a known user keeps his account, but a newcomer won’t
inherit an archicube’s.CustomizeYou can customize the SocialAccountAdapter by inheritingallauth_ens.adapter.LongTermClipperAccountAdapter. You might want to
modifyget_username(clipper, data)to change the default username format.
By default,get_usernameraises aValueErrorwhen the connexion to the
LDAP failed or did not allow to retrieve the user’s entrance year. Overridingget_username(as done in the example website) allows to get rid of that
behaviour, and for instance attribute a default entrance year.Initial migrationDescriptionIf you used allauth without LongTermClipperAccountAdapter, or another CAS
interface to log in, you need to update the Users to the new username policy,
and (in the second case) to create the SocialAccount instances to link CAS and
Users. This can be done easily with$ python manage.py install_longterm.Install_longterm options--use-socialaccounts: Use the existing SocialAccounts rather than all the Users. Useful if you are already using Allauth and don’t wantinstall_longtermto mess with the non-clipper authentications.--keep-usernames: Do not apply the username template (e.g.clipper@promo) to the existing accounts, only populate the SocialAccounts with LDAP informations. Useful if you don’t want to change the usernames of previous users, but do want such a template for future accounts.--clipper-field<field_name>: Use a special field rather than the username to get the clipper username (for LDAP lookup and SocialAccount creation/update). This parameter is compatible with ForeignKeys (e.g.profile.clipper). Note:--use-socialaccountswill ignore the--clipper-fieldparameter.--fake: Do not modify the database. Use it to test there is no conflict, and be sure the changes are the ones expected. This command does not check for uniqueness errors, so there it may succeed and the actual command fail eventually.Typical use casesDjango-cas-ng -> Longterm: Useinstall_longtermwithout parameters, or maybe--keep-usernames. If you had a custom username handling,--clipper_fieldmay be useful.Allauth -> Longterm: Useinstall_longtermwith--use-socialaccounts, and maybe--keep-usernames.Demo SiteSeeexample/README.DevelopmentFirst, you need to clone the repository.StylesheetsThis project usescompassto compile SCSS files to CSS.Using bundlerRequirementsEnsure Ruby is installed ($ ruby-v) orinstall RubyEnsure bundler is installed ($ bundle-v) or install bundler
($ gem install bundler)Install dependencies:$ bundle installCompileWatch changes and recompile:$ bundle exec compass watchTestsLocal environmentRequirementsfakeldap and mock, install with$ pip install mock fakeldapRun$ ./runtests.pyAllRequirementstox, install with$ pip install toxpython{2.7,3.4,3.5,3.6}must be available on your system pathRunall (django/python with combined coverage + flake8 + isort):$ toxHowtosAssuming you use the following settings (when needed):ACCOUNT_ADAPTER='shared.allauth_adapter.AccountAdapter'SOCIALACCOUNT_ADAPTER='shared.allauth_adapter.SocialAccountAdapter'Signup disabled, except for clipper provider (auto-signup)Inshared/allauth_adapter.py:classAccountAdapter(DefaultAccountAdapter):defis_open_for_signup(self,request):returnFalseclassSocialAccountAdapter(DefaultSocialAccountAdapter):defis_open_for_signup(self,request,sociallogin):# sociallogin.account is a SocialAccount instance.# See https://github.com/pennersr/django-allauth/blob/master/allauth/socialaccount/models.pyifsociallogin.account.provider=='clipper':returnTrue# It returns AccountAdapter.is_open_for_signup().# See https://github.com/pennersr/django-allauth/blob/master/allauth/socialaccount/adapter.pyreturnsuper().is_open_for_signup(request,sociallogin)