Extend the Login IP Filters functionality to regular users

[davidjrh]

Description of problem

The current code base that implements the logic for the Login IP Filters only takes in consideration Superusers and users under the Administrator role. While this is not mentioned anywhere in the persona bar settings, I thought it was intended for all users.

The code below is on https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Website/DesktopModules/Admin/Authentication/Login.ascx.cs#L1298

  // Obtain the current client IP
  var userRequestIpAddressController = UserRequestIPAddressController.Instance;
  var ipAddress = userRequestIpAddressController.GetUserRequestIPAddress(new HttpRequestWrapper(this.Request));

  // check if the user is an admin/host and validate their IP
  if (Host.EnableIPChecking)
  {
      bool isAdminUser = objUser.IsSuperUser || objUser.IsInRole(this.PortalSettings.AdministratorRoleName);
      if (isAdminUser)
      {
          var clientIp = ipAddress;
          if (IPFilterController.Instance.IsIPBanned(clientIp))
          {
              PortalSecurity.Instance.SignOut();
              this.AddModuleMessage("IPAddressBanned", ModuleMessage.ModuleMessageType.RedError, true);
              okToShowPanel = false;
              break;
          }
      }
  }

I understand that I can restrict the access by IP using other mechanisms such as touching the web.config, adding rules at hosting level, etc. but extending this to regular users would allow Authenticatin Extensions like the Azure AD module to use this configuration for several purposes such as the one mentioned at davidjrh/dnn.azureadprovider#50

Is there any reason to restrict this to superusers and admins? Could be extended to regular users? If we agree, I'm happy to do a PR.

[valadas]

I am not disagreeing but if that is done, it needs to be an option to not break how it works now. A lot of people do it to prevent getting hacked as a bad admin/host only.

[mitchelsellers]

I personally had not noticed this limitation. I think adding a option for who it applies to would make sense here.

[jeremy-farrance]

I like this. Key points:

• the existing UI needs its labelling and info improved ASAP (should that be a separate Issue and tackled soon?)
• if enhanced, the default/existing behavior should not change

My off the cuff opinion (possibly less than 2 cents) or suggestion for consideration:

If this is enhanced, the new behavior should be tied to Roles only, no option for individual users. For example, an Allow rule for "All Logins" would effectively be set on the "Registered Users" role.

[davidjrh]

Cool, based on the comments above the following UI would allow to extend it to "Registered Users" and be backwards compatible.

Agree?

[sleupold]

but roles "registered Users" and "administrators" are system defined, but individual per portal (and you shouldn't rely on the role name)

[davidjrh]

Of course, the idea was to populate that dropdown with the current portal roles, and change the currenct check objUser.IsInRole(this.PortalSettings.AdministratorRoleName) for something like objUser.IsInRole(this.PortalSettings.IPAddressCheckRoleName).

Or perhaps would be better to just change that dropdown for a switch called "Check IP Addresses for all Registered Users"? (Default false for backwards compatibility). Perhaps this is a simpler option easier to implement and with less impact (i.e. if somebody changes the "Administrator" role for other one).

[stale]

We have detected this issue has not had any activity during the last 90 days. That could mean this issue is no longer relevant and/or nobody has found the necessary time to address the issue. We are trying to keep the list of open issues limited to those issues that are relevant to the majority and to close the ones that have become 'stale' (inactive). If no further activity is detected within the next 14 days, the issue will be closed automatically.
If new comments are are posted and/or a solution (pull request) is submitted for review that references this issue, the issue will not be closed. Closed issues can be reopened at any time in the future. Please remember those participating in this open source project are volunteers trying to help others and creating a better DNN Platform for all. Thank you for your continued involvement and contributions!