Merge pull request #106 from gapitio/ldap_email

Feat: add edit of email when using ldap
gapitio · Jul 2, 2024 · 363b85d · 363b85d
2 parents 129d45e + 59448f6
commit 363b85d
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 1 deletion.
diff --git a/alerta/auth/basic_ldap.py b/alerta/auth/basic_ldap.py
@@ -127,8 +127,10 @@ def login():
         user = User(name=name, login=login, password='', email=email,
                     roles=current_app.config['USER_ROLES'], text='LDAP user', email_verified=email_verified)
         user = user.create()
-    else:
+    elif not current_app.config.get('LDAP_ALLOW_EMAIL_EDIT'):
         user.update(login=login, email=email, email_verified=email_verified)
+    else:
+        user.update(login=login)
 
     if ldap_bind_username:
         try:

diff --git a/alerta/settings.py b/alerta/settings.py
@@ -135,6 +135,7 @@
 LDAP_DEFAULT_DOMAIN = ''  # if set allows users to login with bare username
 LDAP_CONFIG = {}  # type: Dict[str, Any]
 ALLOWED_LDAP_GROUPS = ['*']
+LDAP_ALLOW_EMAIL_EDIT = True
 
 # Microsoft Identity Platform (v2.0)
 AZURE_TENANT = 'common'  # "common", "organizations", "consumers" or tenant ID

diff --git a/alerta/utils/config.py b/alerta/utils/config.py
@@ -66,6 +66,7 @@ def get_user_config():
             config['ALLOWED_OIDC_ROLES'] = get_config('ALLOWED_KEYCLOAK_ROLES', default=[], type=list, config=config)
 
         config['LDAP_BIND_PASSWORD'] = get_config('LDAP_BIND_PASSWORD', default=None, type=str, config=config)
+        config['LDAP_ALLOW_EMAIL_EDIT'] = get_config('LDAP_ALLOW_EMAIL_EDIT', default=True, type=str, config=config)
 
         config['OIDC_ISSUER_URL'] = get_config('OIDC_ISSUER_URL', default=None, type=str, config=config)
         config['ALLOWED_OIDC_ROLES'] = get_config('ALLOWED_OIDC_ROLES', default=[], type=list, config=config)

diff --git a/alerta/views/config.py b/alerta/views/config.py
@@ -22,6 +22,7 @@ def config():
                 'previous_severity': alarm_model.DEFAULT_PREVIOUS_SEVERITY
             }
         },
+        'ldap_email_edit': current_app.config['LDAP_ALLOW_EMAIL_EDIT'],
         'auth_required': current_app.config['AUTH_REQUIRED'],
         'delete_alert_scope_enforced': 'delete:alerts' in current_app.config['DELETE_SCOPES'],
         'allow_readonly': current_app.config['ALLOW_READONLY'],