Repository: privacyidea/privacyidea

Issue:
audit_data not available, when requiring a remote user
When using remote user the following error can occur:

~~~~log
   File "/opt/privacyidea/local/lib/python2.7/site-packages/privacyidea/api/lib/prepolicy.py", line 1226, in is_remote_user_allowed
     audit_data=g.audit_object.audit_data)
   File "/opt/privacyidea/local/lib/python2.7/site-packages/werkzeug/local.py", line 347, in __getattr__
     return getattr(self._get_current_object(), name)
 AttributeError: '_AppCtxGlobals' object has no attribute 'audit_object'
~~~~
audit_data not available, when requiring a remote user
When using remote user the following error can occur:

~~~~log
   File "/opt/privacyidea/local/lib/python2.7/site-packages/privacyidea/api/lib/prepolicy.py", line 1226, in is_remote_user_allowed
     audit_data=g.audit_object.audit_data)
   File "/opt/privacyidea/local/lib/python2.7/site-packages/werkzeug/local.py", line 347, in __getattr__
     return getattr(self._get_current_object(), name)
 AttributeError: '_AppCtxGlobals' object has no attribute 'audit_object'
~~~~


Discussion:
This error occurs when the GET request to webui/login.py is called.
This is the GET request for the login dialog. This login dialog is not recorded in the audit log anyways.
So we are safe to remove the audit_data from the policy call.
This error occurs when the GET request to webui/login.py is called.
This is the GET request for the login dialog. This login dialog is not recorded in the audit log anyways.
So we are safe to remove the audit_data from the policy call.

Resolving patch:
diff --git a/privacyidea/api/lib/prepolicy.py b/privacyidea/api/lib/prepolicy.py
--- a/privacyidea/api/lib/prepolicy.py
+++ b/privacyidea/api/lib/prepolicy.py
@@ -1218,12 +1218,17 @@ def is_remote_user_allowed(req):
                                         get_from_config(SYSCONF.OVERRIDECLIENT))
         if "policy_object" not in g:
             g.policy_object = PolicyClass()
+        if "audit_object" in g:
+            audit_data = g.audit_object.audit_data
+        else:
+            audit_data = None
+
         ruser_active = g.policy_object.get_action_values(ACTION.REMOTE_USER,
                                                          scope=SCOPE.WEBUI,
                                                          user=loginname,
                                                          realm=realm,
                                                          client=g.client_ip,
-                                                         audit_data=g.audit_object.audit_data)
+                                                         audit_data=audit_data)
 
         res = bool(ruser_active)
 


Test patch:
diff --git a/tests/test_api_roles.py b/tests/test_api_roles.py
--- a/tests/test_api_roles.py
+++ b/tests/test_api_roles.py
@@ -84,6 +84,16 @@ def test_02_REMOTE_USER(self):
             self.assertEqual(result.get("value").get("role"), "admin")
             self.assertTrue(result.get("status"), res.data)
 
+        # Check if the /auth request writes the policyname "remote" to the audit entry
+        with self.app.test_request_context('/audit/',
+                                           method='GET',
+                                           headers={'Authorization':
+                                                        self.at}):
+            res = self.app.full_dispatch_request()
+            self.assertTrue(res.status_code == 200, res)
+            auditentry = res.json.get("result").get("value").get("auditdata")[0]
+            self.assertTrue("remote" in auditentry.get("policies"))
+
         self.setUp_user_realms()
         # User "cornelius" from the default realm as normale user
         with self.app.test_request_context('/auth', method='POST',