User login scoping (API)

app/models/authenticator/base.rb

@@ -65,7 +65,7 @@ def authenticate(username, password, request = nil, options = {})
  audit = {:event => audit_event, :userid => username}
 
  # The fail_message might or might not come from the _authenticate method
- authenticated, fail_message = options[:authorize_only] || _authenticate(username, password, request)
+ authenticated, fail_message = options[:authorize_only] || _authenticate(username, password, request: request, lookup_scope: options[:lookup_scope])
  fail_message ||= _("Authentication failed") # Fall back to the default fail_message
 
  if authenticated
@@ -76,7 +76,7 @@ def authenticate(username, password, request = nil, options = {})
  else
  # If role_mode == database we will only use the external system for authentication. Also, the user must exist in our database
  # otherwise we will fail authentication
- user_or_taskid = lookup_by_identity(username, request)
+ user_or_taskid = lookup_by_identity(username, request: request, lookup_scope: options[:lookup_scope])
  user_or_taskid ||= autocreate_user(username)
 
  unless user_or_taskid
@@ -200,8 +200,8 @@ def authenticate_with_http_basic(username, password, request = nil, options = {}
  [!!result, username]
  end
 
- def lookup_by_identity(username, *_args)
- case_insensitive_find_by_userid(username)
+ def lookup_by_identity(username, request: nil, lookup_scope: nil)
+ case_insensitive_find_by_userid(username, lookup_scope: lookup_scope)
  end
 
  # FIXME: LDAP
@@ -242,9 +242,15 @@ def failure_reason(_username, _request)
  nil
  end
 
- def case_insensitive_find_by_userid(username)
- user = User.lookup_by_userid(username)
- user || User.in_my_region.where(:lower_userid => username.downcase).order(:lastlogon).last
+ def case_insensitive_find_by_userid(username, lookup_scope: nil)
+ user_key = username.downcase
+ @lookup ||= {}
+ @lookup[user_key] ||= {}
+ return @lookup[user_key][lookup_scope] if @lookup[username][lookup_scope]
+
+ base = User.send(User::LOOKUP_SCOPES[lookup_scope])
+ user = base.lookup_by_userid(username)
+ @lookup[user_key][lookup_scope] = user || base.in_my_region.where(:lower_userid => user_key).order(:lastlogon).last
  end
 
  def userid_for(_identity, username)

app/models/authenticator/database.rb

@@ -10,8 +10,8 @@ def uses_stored_password?
 
  private
 
- def _authenticate(username, password, _request)
- user = case_insensitive_find_by_userid(username)
+ def _authenticate(username, password, request: nil, lookup_scope: nil)
+ user = case_insensitive_find_by_userid(username, lookup_scope: lookup_scope)
 
  return [false, _('Your account has been locked due to too many failed login attempts, please contact the administrator.')] if user&.locked?
 

app/models/authenticator/httpd.rb

@@ -41,7 +41,7 @@ def user_authorizable_with_system_token?
  ext_auth_is_oidc? || ext_auth_is_saml?
  end
 
- def _authenticate(_username, _password, request)
+ def _authenticate(_username, _password, request: nil, lookup_scope: nil)
  request.present? &&
  request.headers['X-REMOTE-USER'].present?
  end
@@ -85,29 +85,30 @@ def find_or_initialize_user(identity, username)
  [upn_username, user]
  end
 
- def lookup_by_identity(username, request = nil)
+ def lookup_by_identity(username, request: nil, lookup_scope: nil)
  if request
  user_attrs, _membership_list = user_details_from_headers(username, request)
  upn_username = username_to_upn_name(user_attrs)
- user = find_userid_as_upn(upn_username)
- user ||= find_userid_as_distinguished_name(user_attrs)
+ user = find_userid_as_upn(upn_username, lookup_scope: lookup_scope)
+ user ||= find_userid_as_distinguished_name(user_attrs, lookup_scope: lookup_scope)
  end
- user || case_insensitive_find_by_userid(username)
+ user || case_insensitive_find_by_userid(username, lookup_scope: lookup_scope)
  end
 
  private
 
- def find_userid_as_upn(upn_username)
- case_insensitive_find_by_userid(upn_username)
+ def find_userid_as_upn(upn_username, lookup_scope: nil)
+ case_insensitive_find_by_userid(upn_username, lookup_scope: lookup_scope)
  end
 
  def find_userid_as_username(identity, username)
  case_insensitive_find_by_userid(userid_for(identity, username))
  end
 
- def find_userid_as_distinguished_name(user_attrs)
+ def find_userid_as_distinguished_name(user_attrs, lookup_scope: nil)
  dn_domain = user_attrs[:domain].downcase.split(".").map { |s| "dc=#{s}" }.join(",")
- user = User.in_my_region.where("userid LIKE ?", "%=#{user_attrs[:username]},%,#{dn_domain}").last
+ base = User.send(User::LOOKUP_SCOPES[lookup_scope])
+ user = base.in_my_region.where("userid LIKE ?", "%=#{user_attrs[:username]},%,#{dn_domain}").last
  user
  end
 

app/models/authenticator/ldap.rb

@@ -66,7 +66,7 @@ def normalize_username(username)
  miq_ldap.normalize(miq_ldap.fqusername(username))
  end
 
- def _authenticate(username, password, _request)
+ def _authenticate(username, password, request: nil, lookup_scope: nil)
  password.present? &&
  ldap_bind(username, password)
  end

app/models/user.rb

@@ -58,6 +58,25 @@ class User < ApplicationRecord
 
  scope :with_same_userid, ->(id) { where(:userid => User.where(:id => id).pluck(:userid)) }
 
+ # This just creates the following Hash:
+ #
+ # {
+ # :api_includes => :api_includes
+ # }
+ #
+ # Where :default_scoped is the value for anything that doesn't match a key in
+ # the original array. The "lookup hash" was chossen since it is much faster
+ # to do a hash table lookup than a `Array.includes?(KEY)`.
+ LOOKUP_SCOPES = Hash.new(:default_scoped).merge({:api_includes => :api_includes}).freeze
+
+ scope :api_includes, -> {
+ eager_load(:current_group => [
+ :miq_user_role,
+ :tenant,
+ :entitlement
+ ])
+ }
+
  def self.with_roles_excluding(identifier)
  where.not(:id => User.unscope(:select).joins(:miq_groups => :miq_product_features)
  .where(:miq_product_features => {:identifier => identifier})
@@ -263,8 +282,8 @@ def self.authenticate_with_http_basic(username, password, request = nil, options
  authenticator(username).authenticate_with_http_basic(username, password, request, options)
  end
 
- def self.lookup_by_identity(username)
- authenticator(username).lookup_by_identity(username)
+ def self.lookup_by_identity(username, lookup_scope: :none)
+ authenticator(username).lookup_by_identity(username, lookup_scope: lookup_scope)
  end
 
  def self.authorize_user(userid)

spec/models/authenticator/httpd_spec.rb

@@ -107,19 +107,19 @@
  end
 
  it "finds existing users as username" do
- expect(subject.lookup_by_identity('alice', request)).to eq(alice)
+ expect(subject.lookup_by_identity('alice', request: request)).to eq(alice)
  end
 
  it "finds existing users as UPN" do
- expect(subject.lookup_by_identity('cheshire', request)).to eq(cheshire)
+ expect(subject.lookup_by_identity('cheshire', request: request)).to eq(cheshire)
  end
 
  it "finds existing users as distinguished name" do
- expect(subject.lookup_by_identity('towmater', request)).to eq(towmater_dn)
+ expect(subject.lookup_by_identity('towmater', request: request)).to eq(towmater_dn)
  end
 
  it "doesn't create new users" do
- expect(subject.lookup_by_identity('bob', request)).to be_nil
+ expect(subject.lookup_by_identity('bob', request: request)).to be_nil
  end
  end