IdP: parallel user init + rename idp-h-sep to idp-gsep

`--idp-h-sep` is still supported and will map to its new name
This commit is contained in:
ed 2024-03-12 21:21:53 +00:00
parent f193f398c1
commit e8b7f65f82
5 changed files with 21 additions and 8 deletions

View file

@ -956,7 +956,7 @@ def add_auth(ap):
ap2 = ap.add_argument_group('IdP / identity provider / user authentication options')
ap2.add_argument("--idp-h-usr", metavar="HN", type=u, default="", help="bypass the copyparty authentication checks and assume the request-header \033[33mHN\033[0m contains the username of the requesting user (for use with authentik/oauth/...)\n\033[1;31mWARNING:\033[0m if you enable this, make sure clients are unable to specify this header themselves; must be washed away and replaced by a reverse-proxy")
ap2.add_argument("--idp-h-grp", metavar="HN", type=u, default="", help="assume the request-header \033[33mHN\033[0m contains the groupname of the requesting user; can be referenced in config files for group-based access control")
ap2.add_argument("--idp-h-sep", metavar="RE", type=u, default="|:;+,", help="if there are multiple groups in \033[33m--idp-h-grp\033[0m, they are separated by one of the characters in \033[33mRE\033[0m")
ap2.add_argument("--idp-gsep", metavar="RE", type=u, default="|:;+,", help="if there are multiple groups in \033[33m--idp-h-grp\033[0m, they are separated by one of the characters in \033[33mRE\033[0m")
def add_zeroconf(ap):
@ -1438,6 +1438,7 @@ def main(argv: Optional[list[str]] = None) -> None:
deprecated: list[tuple[str, str]] = [
("--salt", "--warksalt"),
("--hdr-au-usr", "--idp-h-usr"),
("--idp-h-sep", "--idp-gsep"),
("--th-no-crop", "--th-crop=n"),
]
for dk, nk in deprecated:

View file

@ -824,7 +824,7 @@ class AuthSrv(object):
if self.idp_usr_gh.get(uname) == gname:
return False
gnames = [x.strip() for x in self.args.idp_h_sep.split(gname)]
gnames = [x.strip() for x in self.args.idp_gsep.split(gname)]
gnames.sort()
with self.mutex:
@ -842,7 +842,7 @@ class AuthSrv(object):
self._reload()
return True
broker.ask("_reload", False).get()
broker.ask("_reload_blocking", False).get()
return True
def _map_volume_idp(

View file

@ -500,7 +500,7 @@ class SvcHub(object):
if ptn:
setattr(self.args, k, re.compile(ptn))
for k in ["idp_h_sep"]:
for k in ["idp_gsep"]:
ptn = getattr(self.args, k)
if "]" in ptn:
ptn = "]" + ptn.replace("]", "")
@ -706,6 +706,19 @@ class SvcHub(object):
self.broker.reload()
self.reloading = 0
def _reload_blocking(self, rescan_all_vols: bool = True) -> None:
while True:
with self.up2k.mutex:
if self.reloading < 2:
self.reloading = 1
break
time.sleep(0.05)
# try to handle multiple pending IdP reloads at once:
time.sleep(0.2)
self._reload(rescan_all_vols=rescan_all_vols)
def stop_thr(self) -> None:
while not self.stop_req:
with self.stop_cond:

View file

@ -836,10 +836,9 @@ class Up2k(object):
self.log(msg, c=1)
thr = None
if self.mtag:
if self.mtag and scan_vols:
t = "online (running mtp)"
if scan_vols:
thr = Daemon(self._run_all_mtp, "up2k-mtp-scan", (gid,), r=False)
thr = Daemon(self._run_all_mtp, "up2k-mtp-scan", (gid,), r=False)
else:
self.pp = None
t = "online, idle"

View file

@ -146,7 +146,7 @@ class Cfg(Namespace):
E=E,
dbd="wal",
fk_salt="a" * 16,
idp_h_sep=re.compile("[|:;+,]"),
idp_gsep=re.compile("[|:;+,]"),
lang="eng",
log_badpwd=1,
logout=573,