fix roles assigned in the ui for sso (#1017)

This commit fixes the ability to assign roles to people in the ui
when the user is SSO. The idea is if a role is ever assigned via
SSO it becomes a "SSO Role" or a "Third Party" Role. by setting
third_party to true on the role object.

Once a role is marked as third party it can no longer be controlled
through the ui for SSO Users. (for ui users this poses no functional
change). It must be controlled via SSO.

lemur/auth/ldap.py

@@ -65,7 +65,7 @@ class LdapPrincipal():
         else:
             # we add 'lemur' specific roles, so they do not get marked as removed
             for ur in user.roles:
-                if ur.authority_id:
+                if not ur.third_party:
                     roles.add(ur)
 
             # update any changes to the user
@@ -97,13 +97,18 @@ class LdapPrincipal():
         if self.ldap_default_role:
             role = role_service.get_by_name(self.ldap_default_role)
             if role:
+                if not role.third_party:
+                    role = role.set_third_party(role.id, third_party_status=True)
                 roles.add(role)
 
         # update their 'roles'
         role = role_service.get_by_name(self.ldap_principal)
         if not role:
             description = "auto generated role based on owner: {0}".format(self.ldap_principal)
-            role = role_service.create(self.ldap_principal, description=description)
+            role = role_service.create(self.ldap_principal, description=description,
+                third_party=True)
+        if not role.third_party:
+            role = role_service.set_third_party(role.id, third_party_status=True)
         roles.add(role)
         if not self.ldap_groups_to_roles:
             return roles
@@ -113,6 +118,8 @@ class LdapPrincipal():
             if role:
                 if ldap_group_name in self.ldap_groups:
                     current_app.logger.debug("assigning role {0} to ldap user {1}".format(self.ldap_principal, role))
+                    if not role.third_party:
+                        role = role_service.set_third_party(role.id, third_party_status=True)
                     roles.add(role)
         return roles
 

lemur/auth/views.py

@@ -211,13 +211,17 @@ class Ping(Resource):
         for group in profile['googleGroups']:
             role = role_service.get_by_name(group)
             if not role:
-                role = role_service.create(group, description='This is a google group based role created by Lemur')
+                role = role_service.create(group, description='This is a google group based role created by Lemur', third_party=True)
+            if not role.third_party:
+                role = role_service.set_third_party(role.id, third_party_status=True)
             roles.append(role)
 
         role = role_service.get_by_name(profile['email'])
 
         if not role:
-            role = role_service.create(profile['email'], description='This is a user specific role')
+            role = role_service.create(profile['email'], description='This is a user specific role', third_party=True)
+        if not role.third_party:
+            role = role_service.set_third_party(role.id, third_party_status=True)
 
         roles.append(role)
 
@@ -226,6 +230,8 @@ class Ping(Resource):
             default = role_service.get_by_name(current_app.config['LEMUR_DEFAULT_ROLE'])
             if not default:
                 default = role_service.create(current_app.config['LEMUR_DEFAULT_ROLE'], description='This is the default Lemur role.')
+            if not default.third_party:
+                role_service.set_third_party(default.id, third_party_status=True)
             roles.append(default)
 
         # if we get an sso user create them an account
@@ -242,7 +248,7 @@ class Ping(Resource):
         else:
             # we add 'lemur' specific roles, so they do not get marked as removed
             for ur in user.roles:
-                if ur.authority_id:
+                if not ur.third_party:
                     roles.append(ur)
 
             # update any changes to the user
@@ -352,12 +358,16 @@ class OAuth2(Resource):
             for group in profile['roles']:
                 role = role_service.get_by_name(group)
                 if not role:
-                    role = role_service.create(group, description='This is a group configured by identity provider')
+                    role = role_service.create(group, description='This is a group configured by identity provider', third_party=True)
+                if not role.third_party:
+                    role = role_service.set_third_party(role.id, third_party_status=True)
                 roles.append(role)
 
         role = role_service.get_by_name(profile['email'])
         if not role:
-            role = role_service.create(profile['email'], description='This is a user specific role')
+            role = role_service.create(profile['email'], description='This is a user specific role', third_party=True)
+        if not role.third_party:
+            role = role_service.set_third_party(role.id, third_party_status=True)
         roles.append(role)
 
         # if we get an sso user create them an account
@@ -365,6 +375,8 @@ class OAuth2(Resource):
             # every user is an operator (tied to a default role)
             if current_app.config.get('LEMUR_DEFAULT_ROLE'):
                 v = role_service.get_by_name(current_app.config.get('LEMUR_DEFAULT_ROLE'))
+                if not v.third_party:
+                    v = role_service.set_third_party(v.id, third_party_status=True)
                 if v:
                     roles.append(v)
 
@@ -380,7 +392,7 @@ class OAuth2(Resource):
         else:
             # we add 'lemur' specific roles, so they do not get marked as removed
             for ur in user.roles:
-                if ur.authority_id:
+                if not ur.third_party:
                     roles.append(ur)
 
             # update any changes to the user