PES Adjustments, Check is User is in enviPath Entra Group

epauth/views.py

@@ -9,7 +9,7 @@ from django.shortcuts import redirect
 
 from epdb.logic import UserManager, GroupManager
 from epdb.models import Group
-from epdb.views import get_remote_address
+from epdb.views import get_remote_address, error
 
 auth_log = logging.getLogger("auth")
 
@@ -72,6 +72,15 @@ def entra_callback(request):
 
     claims = result["id_token_claims"]
 
+    if claims.get("roles") is None or claims.get("roles") == [] or "envipath_registered_user" not in claims.get("roles"):
+        auth_log.error(f"Login attempt by {get_remote_address(request)} failed due to missing role")
+        return error(
+            request,
+            "Login Failed",
+            "The user is not authenticated. A reason for this might be a missing assignment to the respective enviPath group.",
+            403,
+        )
+
     user_name = claims.get("name")
     # preferred_username is a fallback for 2nd CWID
     user_email = claims.get("emailaddress", claims.get("email", claims.get("preferred_username")))