From acd6db64e46c8fa5b93c07dc5ff5c5172ddfa4f6 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Tue, 17 Mar 2015 13:22:06 -0400 Subject: [PATCH] Properly handle groups info in SAML provider Also removes internal attributes (any attribute that starts with _ Fixes: https://fedorahosted.org/ipsilon/ticket/71 Signed-off-by: Simo Sorce Reviewed-by: Nathan Kinder --- ipsilon/providers/saml2/auth.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ipsilon/providers/saml2/auth.py b/ipsilon/providers/saml2/auth.py index 95751aa..ddebd8c 100644 --- a/ipsilon/providers/saml2/auth.py +++ b/ipsilon/providers/saml2/auth.py @@ -217,9 +217,15 @@ class AuthenticateRequest(ProviderPageBase): mappedattrs, _ = policy.map_attributes(userattrs) attributes = policy.filter_attributes(mappedattrs) + if '_groups' in attributes and 'groups' not in attributes: + attributes['groups'] = attributes['_groups'] + self.debug("%s's attributes: %s" % (user.name, attributes)) for key in attributes: + # skip internal info + if key[0] == '_': + continue values = attributes[key] if isinstance(values, dict): continue -- 2.20.1