wip

epauth/views.py

@@ -77,7 +77,7 @@ def entra_callback(request):
         return error(
             request,
             "Login Failed",
-            "The user is not authenticated. A reason for this might be a missing assignment to the respective enviPath group.",
+            "Request access to role 1230/MON/APPS/Envipath/Envipath_Prod on go/idnow",
             403,
         )
 
@@ -139,10 +139,16 @@ def entra_callback(request):
                 auth_log.info(f"Login Group Sync: Adding {u.username} to Group {g.name} ({ uuid })")
         else:
             g = Group.objects.get(uuid=uuid)
-            if g.user_member.contains(u):
+            # Do not remove users from All enviPath Users
+            if g.user_member.contains(u) and g.name != 'All enviPath Users':
                 g.user_member.remove(u)
                 auth_log.info(f"Login Group Sync: Removing {u.username} from Group {g.name} ({ uuid })")
 
+    # Ensure people are part of All enviPath Users -> they have to as, envipath_registered_user is granted
+    all_envipath_users = Group.objects.get(name="All enviPath Users")
+    if not all_envipath_users.user_member.contains(u):
+        all_envipath_users.user_member.add(u)
+
     if registered:
         # #72 make package secret if user is part of a secret group
         for id, name in s.ENTRA_SECRET_GROUPS.items():