def _authorize()

in lemur/auth/ldap.py [0:0]

• 41 lines of code
• 14 McCabe index (conditional complexity)

    def _authorize(self):
        """
        check groups and roles to confirm access.
        return a list of roles if ok.
        raise an exception on error.
        """
        if not self.ldap_principal:
            return None

        if self.ldap_required_group:
            # ensure the user has the required group in their group list
            if self.ldap_required_group not in self.ldap_groups:
                return None

        roles = set()
        if self.ldap_default_role:
            role = role_service.get_by_name(self.ldap_default_role)
            if role:
                if not role.third_party:
                    role = role_service.set_third_party(role.id, third_party_status=True)
                roles.add(role)

        # update their 'roles'
        role = role_service.get_by_name(self.ldap_principal)
        if not role:
            description = "auto generated role based on owner: {0}".format(
                self.ldap_principal
            )
            role = role_service.create(
                self.ldap_principal, description=description, third_party=True
            )
        if not role.third_party:
            role = role_service.set_third_party(role.id, third_party_status=True)
        roles.add(role)
        if not self.ldap_groups_to_roles:
            return roles

        for ldap_group_name, role_name in self.ldap_groups_to_roles.items():
            role = role_service.get_by_name(role_name)
            if role:
                if ldap_group_name in self.ldap_groups:
                    current_app.logger.debug(
                        "assigning role {0} to ldap user {1}".format(
                            self.ldap_principal, role
                        )
                    )
                    if not role.third_party:
                        role = role_service.set_third_party(
                            role.id, third_party_status=True
                        )
                    roles.add(role)
        return roles