Auth log

epauth/views.py

@@ -1,3 +1,5 @@
+import logging
+
 import msal
 from django.conf import settings as s
 from django.contrib.auth import get_user_model
@@ -8,6 +10,7 @@ from django.shortcuts import redirect
 from epdb.logic import UserManager, GroupManager
 from epdb.models import Group
 
+auth_log = logging.getLogger("auth")
 
 def get_msal_app_with_cache(request):
     """
@@ -28,8 +31,21 @@ def get_msal_app_with_cache(request):
 
     return msal_app, cache
 
+def get_remote_address(request):
+    remote_address = ""
+
+    if request is not None:
+        remote_address = request.META.get("HTTP_X_FORWARDED_FOR")
+
+        if not remote_address:
+            remote_address = request.META.get("REMOTE_ADDR", "")
+
+    return remote_address
 
 def entra_login(request):
+
+    auth_log.info(f"Login request from {get_remote_address(request)}")
+
     msal_app = msal.ConfidentialClientApplication(
         client_id=s.MS_ENTRA_CLIENT_ID,
         client_credential=s.MS_ENTRA_CLIENT_SECRET,
@@ -54,6 +70,10 @@ def entra_callback(request):
     # Acquire token using the flow and callback request
     result = msal_app.acquire_token_by_auth_code_flow(flow, request.GET)
 
+    if "error" in result:
+        auth_log.error(f"Login attempt by {get_remote_address(request)} failed due to {result['error']}")
+        return redirect("/")
+
     # Save the token cache to session
     if cache.has_state_changed:
         request.session["msal_token_cache"] = cache.serialize()
@@ -61,7 +81,8 @@ def entra_callback(request):
     claims = result["id_token_claims"]
 
     user_name = claims.get("name")
-    user_email = claims.get("emailaddress", claims.get("email"))
+    # preferred_username is a fallback for 2nd CWID
+    user_email = claims.get("emailaddress", claims.get("email", claims.get("preferred_username")))
     user_oid = claims.get("oid")
 
     if not all([user_name, user_email, user_oid]):
@@ -78,8 +99,10 @@ def entra_callback(request):
             u.save()
 
     else:
+        auth_log.info(f"Registering {user_name} with OID {user_oid}")
         u = UserManager.create_user(user_name, user_email, None, uuid=user_oid, is_active=True)
 
+    auth_log.info(f"User {user_name} {"(admin)" if u.is_superuser else ""} with OID {user_oid} successfully logged in as {u.username} from {get_remote_address(request)}")
     login(request, u)
 
     # EDIT START
@@ -102,10 +125,20 @@ def entra_callback(request):
         else:
             g = Group.objects.get(uuid=id)
 
-    for group_uuid in claims.get("groups", []):
-        if Group.objects.filter(uuid=group_uuid).exists():
-            g = Group.objects.get(uuid=group_uuid)
-            g.user_member.add(u)
+    sync_groups = list(s.ENTRA_GROUPS.keys()) + list(s.ENTRA_SECRET_GROUPS.keys())
+    user_groups = claims.get("groups", [])
+
+    for uuid in sync_groups:
+        if uuid in user_groups:
+            g = Group.objects.get(uuid=uuid)
+            if not g.user_member.contains(u):
+                g.user_member.add(u)
+                auth_log.info(f"Login Group Sync: Adding {u.username} to Group {g.name} ({ uuid })")
+        else:
+            g = Group.objects.get(uuid=uuid)
+            if g.user_member.contains(u):
+                g.user_member.remove(u)
+                auth_log.info(f"Login Group Sync: Removing {u.username} from Group {g.name} ({ uuid })")
 
     # EDIT END