From 257b16c10174701678b6ddc29fa214e18225b6cf Mon Sep 17 00:00:00 2001
From: Hanne Moa <hanne.moa@uninett.no>
Date: Thu, 8 Oct 2020 12:12:52 +0200
Subject: [PATCH 1/3] Add and turn on django-su

---
 requirements-frozen.txt           | 2 ++
 requirements/base.txt             | 1 +
 src/easydmp/auth/admin.py         | 2 ++
 src/easydmp/site/settings/base.py | 3 +++
 src/easydmp/site/urls.py          | 1 +
 5 files changed, 9 insertions(+)

diff --git a/requirements-frozen.txt b/requirements-frozen.txt
index a782fa71..88fb6039 100644
--- a/requirements-frozen.txt
+++ b/requirements-frozen.txt
@@ -65,6 +65,8 @@ django==2.2.18
     #   django-select2
     #   djangorestframework
     #   drf-spectacular
+django-su==0.9.0
+    # via -r requirements/./base.txt
 djangorestframework-jwt==1.11.0
     # via -r requirements/./base.txt
 djangorestframework==3.12.2
diff --git a/requirements/base.txt b/requirements/base.txt
index ef783372..199da09c 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -18,3 +18,4 @@ Sphinx>=3.3
 whitenoise>=5.2
 drf-spectacular>=0.11
 weasyPrint==52.1
+django-su>=0.9.0
diff --git a/src/easydmp/auth/admin.py b/src/easydmp/auth/admin.py
index 804a0060..bd6edcf6 100644
--- a/src/easydmp/auth/admin.py
+++ b/src/easydmp/auth/admin.py
@@ -9,6 +9,8 @@
 
 @admin.register(User)
 class EasyDMPUserAdmin(UserAdmin):
+    change_form_template = "admin/auth/user/change_form.html"  # For Django-su
+    change_list_template = "admin/auth/user/change_list.html"  # For Django-su
     date_hierarchy = 'date_joined'
     list_display = ('username', 'email', 'full_name', 'is_staff')
     search_fields = ('username', 'full_name', 'email')
diff --git a/src/easydmp/site/settings/base.py b/src/easydmp/site/settings/base.py
index 05444435..3f79c4ff 100644
--- a/src/easydmp/site/settings/base.py
+++ b/src/easydmp/site/settings/base.py
@@ -31,6 +31,7 @@
 # Application definition
 
 INSTALLED_APPS = [
+    'django_su',
     'django.contrib.admin',
     'django.contrib.admindocs',
     'django.contrib.auth',
@@ -92,6 +93,7 @@
                 'django.template.context_processors.request',
                 'django.contrib.auth.context_processors.auth',
                 'django.contrib.messages.context_processors.messages',
+                'django_su.context_processors.is_su',
                 'easydmp.lib.context_processors.common',
             ],
         },
@@ -194,6 +196,7 @@
 LOGIN_REDIRECT_URL = '/plan/'
 
 AUTHENTICATION_BACKENDS = [
+    'django_su.backends.SuBackend',
     'django.contrib.auth.backends.RemoteUserBackend',
     'django.contrib.auth.backends.ModelBackend',
     'guardian.backends.ObjectPermissionBackend',
diff --git a/src/easydmp/site/urls.py b/src/easydmp/site/urls.py
index bd218323..a0a1e8e0 100644
--- a/src/easydmp/site/urls.py
+++ b/src/easydmp/site/urls.py
@@ -28,6 +28,7 @@
     path('logout', logout_view, name='logout'),
     path('privacy/', PublicTemplateView.as_view(template_name='privacy.html'), name='privacy'),
     path('account/', include('easydmp.auth.urls')),
+    path('^su/', include('django_su.urls')),
 
     path('plan/', include('easydmp.plan.urls')),
     path('invitation/', include('easydmp.invitation.urls')),

From 20b4bbb41565a254ce6364f725b25c3f359b63ff Mon Sep 17 00:00:00 2001
From: Hanne Moa <hanne.moa@uninett.no>
Date: Thu, 8 Oct 2020 12:23:08 +0200
Subject: [PATCH 2/3] Warn impersonators that they are impersonating

---
 src/easydmp/site/templates/base.html | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/easydmp/site/templates/base.html b/src/easydmp/site/templates/base.html
index a1471392..2c2fd0ea 100644
--- a/src/easydmp/site/templates/base.html
+++ b/src/easydmp/site/templates/base.html
@@ -53,8 +53,13 @@
 <body>
   <header role="banner">
   <div class="navbar navbar-default navbar-fixed-top" role="navigation">
-    {% if instance_message or messages %}
+    {% if instance_message or messages or IS_SU %}
     <div class="container messages">
+      {% if IS_SU %}
+      <div role="alert" class="alert impersonation">You are impersonating {{ request.user }} 
+          <a href="{% url 'su_logout' %}">Switch back to yourself</a>
+      </div>
+      {% endif %}
       {% if instance_message %}
       <div role="alert" class="alert instance">{{ instance_message }}</div>
       {% endif %}

From 9cbf0aac31240decd0d99a930026463b8949d370 Mon Sep 17 00:00:00 2001
From: Hanne Moa <hanne.moa@uninett.no>
Date: Thu, 15 Oct 2020 13:45:24 +0200
Subject: [PATCH 3/3] Log su-ing to event log

---
 src/easydmp/auth/lib.py           | 17 +++++++++++++++++
 src/easydmp/site/settings/base.py |  4 ++++
 2 files changed, 21 insertions(+)
 create mode 100644 src/easydmp/auth/lib.py

diff --git a/src/easydmp/auth/lib.py b/src/easydmp/auth/lib.py
new file mode 100644
index 00000000..3a304e4c
--- /dev/null
+++ b/src/easydmp/auth/lib.py
@@ -0,0 +1,17 @@
+from django.contrib.auth import login
+
+from easydmp.eventlog.utils import log_event
+
+
+def su_login(request, user):
+    original_user = request.user
+    switch_to_user = user
+    exit_users_pk = request.session.get("exit_users_pk", default=[])
+    if exit_users_pk:
+        template = '{timestamp} {actor} impersonated {target}'
+        verb = 'impersonate'
+    else:
+        template = '{timestamp} {actor} stopped impersonating {target}'
+        verb = 'stop impersonating'
+    log_event(request.user, 'impersonate', target=user, template='')
+    login(request, user)
diff --git a/src/easydmp/site/settings/base.py b/src/easydmp/site/settings/base.py
index 3f79c4ff..cf8e56c9 100644
--- a/src/easydmp/site/settings/base.py
+++ b/src/easydmp/site/settings/base.py
@@ -208,6 +208,10 @@
 
 X_FRAME_OPTIONS = 'ALLOW-FROM https://bibsys.no/'
 
+# Django-su
+
+SU_CUSTOM_LOGIN_ACTION = 'easydmp.auth.lib.su_login'
+
 # REST API
 
 REST_FRAMEWORK = {