From 75afa2f3974ee125a05b3c9b714fb669cebafb82 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adam=20Zahradn=C3=ADk?= Date: Wed, 10 Jun 2026 17:30:40 +0200 Subject: [PATCH] add admin access automatically --- poukazky/settings.py | 2 +- poukazky/users/auth.py | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/poukazky/settings.py b/poukazky/settings.py index 33035b8..0e31374 100644 --- a/poukazky/settings.py +++ b/poukazky/settings.py @@ -85,7 +85,7 @@ OIDC_OP_AUTHORIZATION_ENDPOINT = "https://id.trojsten.sk/oauth/authorize/" OIDC_OP_USER_ENDPOINT = "https://id.trojsten.sk/oauth/userinfo/" OIDC_OP_TOKEN_ENDPOINT = "https://id.trojsten.sk/oauth/token/" -OIDC_RP_SCOPES = "openid email profile" +OIDC_RP_SCOPES = "openid email profile groups" OIDC_RP_SIGN_ALGO = "RS256" OIDC_RP_CLIENT_ID = env("OIDC_RP_CLIENT_ID", default="") OIDC_RP_CLIENT_SECRET = env("OIDC_RP_CLIENT_SECRET", default="") diff --git a/poukazky/users/auth.py b/poukazky/users/auth.py index 4e18983..ef54a02 100644 --- a/poukazky/users/auth.py +++ b/poukazky/users/auth.py @@ -1,7 +1,11 @@ +from django.contrib.auth.models import Group from mozilla_django_oidc.auth import OIDCAuthenticationBackend from .models import User +ADMIN_OIDC_GROUP = "poukazky@iam.trojsten.sk" +ADMIN_DJANGO_GROUP = "admin" + def logout_url(request): return "https://id.trojsten.sk/oauth/logout" @@ -33,3 +37,12 @@ def _update_user(self, user, claims): user.username = claims.get("preferred_username") user.first_name = claims.get("given_name", "") user.last_name = claims.get("family_name", "") + + oidc_groups = claims.get("groups", []) + is_admin = ADMIN_OIDC_GROUP in oidc_groups + user.is_staff = is_admin + + if is_admin: + admin_group, _ = Group.objects.get_or_create(name=ADMIN_DJANGO_GROUP) + user.save() # when creating user, he will not exist at this time, so we need to save him. + user.groups.add(admin_group)