search

AzMoo / django-okta-auth

Django Okta Auth is a library that acts as a client for the Okta OpenID Connect provider.
MIT License
30 stars 23 forks source link

Update tokens.py #2

Closed bab3l closed 3 years ago

bab3l commented 3 years ago

Updating user flags when a superuser_group is not set ends up wiping out admin users on first login. This change checks that superusers are being managed before wiping the permissions.

AzMoo commented 3 years ago

Thanks again. I would like a test that verifies the issue before I merge though, to prevent regressions in the future. If you would like to write it feel free, otherwise I will, but it's going to take me a bit of time due to Covid.

bab3l commented 3 years ago

Thanks - I changed the code to use the MANAGE_GROUPS flag, created a new test, and added that to the applicable current tests. Let me know if that covers it.

KoreyPeters commented 3 years ago

To me a better fix would just be to set staff/superuser status on first login (when the Django User is created) and then just ignore it from that point on.

But in either case, the clobbering of staff/superuser on each login means all users must either be not staff and not superuser, or they must be staff and superuser. There cannot exist a user which is just staff and not supuruser. I'll happily take just the first fix if that was available.