diff --git a/.credentials/KANIDM_SECRET b/.credentials/KANIDM_SECRET new file mode 100644 index 0000000..ccedbb7 --- /dev/null +++ b/.credentials/KANIDM_SECRET @@ -0,0 +1 @@ +MpWq4pgWKhVZDFve1Acy4DvjBrCSBe1Q4y2VUfYUSFXBfP9G diff --git a/default.nix b/default.nix index 78c35f9..a339fb9 100644 --- a/default.nix +++ b/default.nix @@ -60,6 +60,7 @@ in CREDENTIALS_DIRECTORY = builtins.toString ./.credentials; DGSI_DEBUG = "true"; DGSI_STATIC_ROOT = builtins.toString ./.static; + DGSI_KANIDM_CLIENT = "dgsi_test"; }; shellHook = '' diff --git a/src/app/settings.py b/src/app/settings.py index 8982aa3..af2393f 100644 --- a/src/app/settings.py +++ b/src/app/settings.py @@ -33,6 +33,12 @@ INSTALLED_APPS = [ "shared.staticfiles.StaticFilesApp", # Overrides the default staticfiles app to filter out the sccs sources "sass_processor", "bulma", + # Authentication + "allauth", + "allauth.account", + "allauth.socialaccount", + "allauth.socialaccount.providers.openid_connect", + # Main app "dgsi", ] @@ -47,6 +53,7 @@ MIDDLEWARE = [ "django.contrib.auth.middleware.AuthenticationMiddleware", "django.contrib.messages.middleware.MessageMiddleware", "django.middleware.clickjacking.XFrameOptionsMiddleware", + "allauth.account.middleware.AccountMiddleware", ] ### @@ -96,8 +103,31 @@ DATABASES = { ### +# Authentication configuration # Disable password validation, no authentication should use local passwords +AUTHENTICATION_BACKENDS = [ + "allauth.account.auth_backends.AuthenticationBackend", +] + +SOCIALACCOUNT_ONLY = True +SOCIALACCOUNT_PROVIDERS = { + "openid_connect": { + "OAUTH_PKCE_ENABLED": True, + "APPS": [ + { + "provider_id": "kanidm", + "name": "DGNum", + "client_id": credentials["KANIDM_CLIENT"], + "secret": credentials["KANIDM_SECRET"], + "settings": { + "server_url": f"https://sso.dgnum.eu/oauth2/openid/{credentials['KANIDM_CLIENT']}", + }, + } + ], + }, +} + AUTH_PASSWORD_VALIDATORS = [] diff --git a/src/app/urls.py b/src/app/urls.py index 97fcd2c..19fb416 100644 --- a/src/app/urls.py +++ b/src/app/urls.py @@ -22,7 +22,9 @@ from django.views.generic import TemplateView urlpatterns = [ path("", TemplateView.as_view(template_name="home.html"), name="index"), + path("login", TemplateView.as_view(template_name="login.html"), name="login"), path("", include("dgsi.urls")), + path("accounts/", include("allauth.urls")), ] if settings.DEBUG: diff --git a/src/dgsi/auth.py b/src/dgsi/auth.py deleted file mode 100644 index e69de29..0000000 diff --git a/src/shared/templates/_footer.html b/src/shared/templates/_footer.html new file mode 100644 index 0000000..f58de5e --- /dev/null +++ b/src/shared/templates/_footer.html @@ -0,0 +1,6 @@ +{% load django_browser_reload %} + + diff --git a/src/shared/templates/_hero.html b/src/shared/templates/_hero.html new file mode 100644 index 0000000..a791240 --- /dev/null +++ b/src/shared/templates/_hero.html @@ -0,0 +1,26 @@ +{% load i18n %} + +
+
+
+
+
+

+ Dossier Général des Services Informagiques +

+

Système d'information de la DGNum

+
+
+ + + {% trans "Connexion" %} + + + + + +
+
+
+
+
diff --git a/src/shared/templates/_links.html b/src/shared/templates/_links.html new file mode 100644 index 0000000..14ee324 --- /dev/null +++ b/src/shared/templates/_links.html @@ -0,0 +1,12 @@ +{% load sass_tags static %} + + + + + + + + + + + diff --git a/src/shared/templates/allauth/elements/button.html b/src/shared/templates/allauth/elements/button.html new file mode 100644 index 0000000..e168e8e --- /dev/null +++ b/src/shared/templates/allauth/elements/button.html @@ -0,0 +1,13 @@ +{% load allauth %} +{% comment %} djlint:off {% endcomment %} +<{% if attrs.href %}a href="{{ attrs.href }}"{% else %}button{% endif %} +{% if attrs.form %}form="{{ attrs.form }}"{% endif %} +{% if attrs.id %}id="{{ attrs.id }}"{% endif %} +{% if attrs.name %}name="{{ attrs.name }}"{% endif %} +{% if attrs.value %}value="{{ attrs.value }}"{% endif %} +{% if attrs.type %}type="{{ attrs.type }}"{% endif %} +class="button is-fullwidth" +> +{% slot %} +{% endslot %} + diff --git a/src/shared/templates/allauth/elements/fields.html b/src/shared/templates/allauth/elements/fields.html new file mode 100644 index 0000000..e291ba1 --- /dev/null +++ b/src/shared/templates/allauth/elements/fields.html @@ -0,0 +1 @@ +{% include "bulma/form.html" with form=attrs.form %} diff --git a/src/shared/templates/allauth/elements/provider.html b/src/shared/templates/allauth/elements/provider.html new file mode 100644 index 0000000..36bc3f7 --- /dev/null +++ b/src/shared/templates/allauth/elements/provider.html @@ -0,0 +1 @@ +{{ attrs.name }} diff --git a/src/shared/templates/allauth/elements/provider_list.html b/src/shared/templates/allauth/elements/provider_list.html new file mode 100644 index 0000000..8430750 --- /dev/null +++ b/src/shared/templates/allauth/elements/provider_list.html @@ -0,0 +1,6 @@ +{% load allauth %} + +
+ {% slot default %} + {% endslot %} +
diff --git a/src/shared/templates/allauth/layouts/base.html b/src/shared/templates/allauth/layouts/base.html new file mode 100644 index 0000000..3746ddc --- /dev/null +++ b/src/shared/templates/allauth/layouts/base.html @@ -0,0 +1,77 @@ +{% load django_browser_reload i18n sass_tags static %} + + + + + + + + + DGNum + + {% include "_links.html" %} + + + + {% include "_hero.html" %} + +
+ + +
+ +
+ {% block content %} + {% endblock content %} +
+
+ + {% include "_footer.html" %} + + diff --git a/src/shared/templates/base.html b/src/shared/templates/base.html index 18ce3f7..3432ddc 100644 --- a/src/shared/templates/base.html +++ b/src/shared/templates/base.html @@ -1,5 +1,3 @@ -{% load django_browser_reload sass_tags static %} - @@ -9,48 +7,17 @@ DGNum - - - - - - - - - + {% include "_links.html" %} -
-
-
-

- Dossier Général des Services Informagiques -

-

Système d'information de la DGNum

-
-
-
+ {% include "_hero.html" %}
{% block content %} {% endblock content %}
- + {% include "_footer.html" %} diff --git a/src/shared/templates/login.html b/src/shared/templates/login.html index e69de29..03e6ca0 100644 --- a/src/shared/templates/login.html +++ b/src/shared/templates/login.html @@ -0,0 +1,29 @@ +{% extends "base.html" %} + +{% load i18n socialaccount %} + +{% block content %} +
+
+ + + + + + {% trans "Connexion via la DGNum" %} + + + + + + + + + {% trans "Connexion via l'ENS" %} + + +
+
+{% endblock content %}