(captive portal) add group enforcement, closes #1377

opnsense · Feb 7, 2017 · a7ef419 · a7ef419
1 parent 0d104a9
commit a7ef419
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 0 deletions.
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/Api/AccessController.php b/src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/Api/AccessController.php
@@ -148,6 +148,11 @@ public function logonAction($zoneid = 0)
                                 $this->request->getPost("password", "string")
                             );
 
+                            // check group when group enforcement is set
+                            if ($isAuthenticated && (string)$cpZone->authEnforceGroup != "") {
+                                $isAuthenticated = $authServer->groupAllowed($userName, $cpZone->authEnforceGroup);
+                            }
+
                             if ($isAuthenticated) {
                                 // stop trying, when authenticated
                                 break;

diff --git a/src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/forms/dialogZone.xml b/src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/forms/dialogZone.xml
@@ -26,6 +26,12 @@
         <style>tokenize</style>
         <help><![CDATA[Select authentication methods to use, leave empty for no authentication needed.]]></help>
     </field>
+    <field>
+        <id>zone.authEnforceGroup</id>
+        <label>Enforce local group</label>
+        <type>dropdown</type>
+        <help><![CDATA[Restrict access to users in the selected (local)group.]]></help>
+    </field>
     <field>
         <id>zone.idletimeout</id>
         <label>Idle timeout (minutes)</label>

diff --git a/src/opnsense/mvc/app/models/OPNsense/CaptivePortal/CaptivePortal.xml b/src/opnsense/mvc/app/models/OPNsense/CaptivePortal/CaptivePortal.xml
@@ -31,6 +31,9 @@
                     <multiple>Y</multiple>
                     <default>Local Database</default>
                 </authservers>
+                <authEnforceGroup type="AuthGroupField">
+                    <Required>N</Required>
+                </authEnforceGroup>
                 <idletimeout type="IntegerField">
                     <Required>Y</Required>
                     <Default>0</Default>