Skip to content

Commit 13ff878

Browse files
authored
Fix issue where RADIUS auth logged to root logger (ansible#637)
I was looking for this, because I made the same kind of mistake in another library. TBH, I think SonarCloud should create a rule to find these cases. `logging.info` goes to the _root_ logger. That is almost never what you want. Any configuration of the `ansible_base` logger will be ignored. I don't think we even customize the root logger in most cases, so the messages would likely be lost. The python standard library is deceptively permissive of this. Even though these cases are almost certainly a typo/goof, python accepts it as the programmer's intention.
1 parent 7933f91 commit 13ff878

File tree

1 file changed

+10
-7
lines changed

1 file changed

+10
-7
lines changed

ansible_base/authentication/authenticator_plugins/_radiusauth.py

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@
3939
#Handle custom user models
4040
from django.contrib.auth import get_user_model
4141
from django.contrib.auth.models import Group
42+
43+
logger = logging.getLogger('ansible_base.authentication.authenticator_plugins._radiusauth')
44+
4245
User = get_user_model()
4346

4447
DICTIONARY = u"""
@@ -149,23 +152,23 @@ def _perform_radius_auth(self, client, packet):
149152
try:
150153
reply = client.SendPacket(packet)
151154
except Timeout as e:
152-
logging.error("RADIUS timeout occurred contacting %s:%s" % (
155+
logger.error("RADIUS timeout occurred contacting %s:%s" % (
153156
client.server, client.authport))
154157
return None
155158
except Exception as e:
156-
logging.error("RADIUS error: %s" % e)
159+
logger.error("RADIUS error: %s" % e)
157160
return None
158161

159162
if reply.code == AccessReject:
160-
logging.warning("RADIUS access rejected for user '%s'" % (
163+
logger.warning("RADIUS access rejected for user '%s'" % (
161164
packet['User-Name']))
162165
return None
163166
elif reply.code != AccessAccept:
164-
logging.error("RADIUS access error for user '%s' (code %s)" % (
167+
logger.error("RADIUS access error for user '%s' (code %s)" % (
165168
packet['User-Name'], reply.code))
166169
return None
167170

168-
logging.info("RADIUS access granted for user '%s'" % (
171+
logger.info("RADIUS access granted for user '%s'" % (
169172
packet['User-Name']))
170173

171174
if "Class" not in reply.keys():
@@ -190,7 +193,7 @@ def _perform_radius_auth(self, client, packet):
190193
elif role == "superuser":
191194
is_superuser = True
192195
else:
193-
logging.warning("RADIUS Attribute Class contains unknown role '%s'. Only roles 'staff' and 'superuser' are allowed" % cl)
196+
logger.warning("RADIUS Attribute Class contains unknown role '%s'. Only roles 'staff' and 'superuser' are allowed" % cl)
194197
return groups, is_staff, is_superuser
195198

196199
def _radius_auth(self, server, username, password):
@@ -232,7 +235,7 @@ def get_user_groups(self, group_names):
232235
groups = Group.objects.filter(name__in=group_names)
233236
if len(groups) != len(group_names):
234237
local_group_names = [g.name for g in groups]
235-
logging.warning("RADIUS reply contains %d user groups (%s), but only %d (%s) found" % (
238+
logger.warning("RADIUS reply contains %d user groups (%s), but only %d (%s) found" % (
236239
len(group_names), ", ".join(group_names), len(groups), ", ".join(local_group_names)))
237240
return groups
238241

0 commit comments

Comments
 (0)