commit fdc476db9c045ffd6148473e676f77eebae4207e
Author: Jan Pazdziora <jpazdziora@redhat.com>
Date:   Wed Mar 26 15:48:06 2014 +0100

    fixes #3892 - process REMOTE_USER_GROUP_N and REMOTE_USER_GROUP_#, add user to groups based on external user groups.

diff --git a/app/models/user.rb b/app/models/user.rb
index c31ceffa7..beb5d05e1 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -208,7 +208,11 @@ class User < ActiveRecord::Base
       User.as :admin do
         options = { :name => auth_source_name }
         auth_source = AuthSource.where(options).first || AuthSourceExternal.create!(options)
+        external_groups = attrs.delete(:groups)
         user = User.create!(attrs.merge(:auth_source => auth_source))
+        if external_groups.present?
+          user.usergroups = ExternalUsergroup.where(:auth_source_id => auth_source, :name => external_groups).map(&:usergroup).uniq
+        end
         user.post_successful_login
       end
       return true
diff --git a/app/services/sso/apache.rb b/app/services/sso/apache.rb
index bf6601a1e..732a20438 100644
--- a/app/services/sso/apache.rb
+++ b/app/services/sso/apache.rb
@@ -31,6 +31,12 @@ module SSO
     def authenticated?
       return false unless (self.user = request.env[CAS_USERNAME])
       attrs = { :login => self.user }.merge(additional_attributes)
+      group_count = request.env['REMOTE_USER_GROUP_N'].to_i
+      if group_count > 0
+        attrs[:groups] = []
+        group_count.times { |i| attrs[:groups]<< request.env["REMOTE_USER_GROUP_#{i+1}"] }
+      end
+
       return false unless User.find_or_create_external_user(attrs, Setting['authorize_login_delegation_auth_source_user_autocreate'])
       store
       true
diff --git a/test/factories/user_related.rb b/test/factories/user_related.rb
index 783a6e073..bebfd83cf 100644
--- a/test/factories/user_related.rb
+++ b/test/factories/user_related.rb
@@ -3,6 +3,12 @@ FactoryGirl.define do
     sequence(:name) {|n| "usergroup#{n}" }
   end
 
+  factory :external_usergroup do
+    sequence(:name) {|n| "external_usergroup#{n}" }
+    usergroup { FactoryGirl.create :usergroup }
+    auth_source { FactoryGirl.create :auth_source_external }
+  end
+
   factory :user do
     auth_source { AuthSourceInternal.first }
     password 'password'
diff --git a/test/unit/sso/apache_test.rb b/test/unit/sso/apache_test.rb
index acee0ad3d..b0f15669f 100644
--- a/test/unit/sso/apache_test.rb
+++ b/test/unit/sso/apache_test.rb
@@ -59,6 +59,21 @@ class ApacheTest < ActiveSupport::TestCase
     assert apache.authenticated?
   end
 
+  def test_authenticated_parses_user_groups
+    Setting['authorize_login_delegation_auth_source_user_autocreate'] = 'apache'
+    apache = get_apache_method
+
+    apache.controller.request.env[SSO::Apache::CAS_USERNAME] = 'ares'
+    apache.controller.request.env['REMOTE_USER_GROUP_N']     = 2
+    existing = FactoryGirl.create :usergroup
+    apache.controller.request.env['REMOTE_USER_GROUP_1']     = existing.name
+    apache.controller.request.env['REMOTE_USER_GROUP_2']     = 'does-not-exist-for-sure'
+    User.expects(:find_or_create_external_user).
+        with({:login => 'ares', :groups => [existing.name, 'does-not-exist-for-sure']}, 'apache').
+        returns(true)
+    assert apache.authenticated?
+  end
+
   def test_convert_encoding
     apache = get_apache_method
     assert apache.send(:convert_encoding, 'fó✗@e✗amp✓e.com')
diff --git a/test/unit/user_test.rb b/test/unit/user_test.rb
index 90b38d651..a6c81e0b5 100644
--- a/test/unit/user_test.rb
+++ b/test/unit/user_test.rb
@@ -409,6 +409,18 @@ class UserTest < ActiveSupport::TestCase
     assert_equal 'foobar@example.com', user.mail
     assert_equal 'Foo', user.firstname
     assert_equal 'Bar', user.lastname
+
+    # with existing user groups that are assigned
+    apache_source = AuthSourceExternal.find_or_create_by_name('apache_module')
+    usergroup = FactoryGirl.create :usergroup
+    FactoryGirl.create :external_usergroup, :usergroup => usergroup, 
+                                            :auth_source => apache_source, 
+                                            :name => usergroup.name
+    assert User.find_or_create_external_user({:login => 'not_existing_user_4',
+                                              :groups => [usergroup.name, 'does-not-exists-for-sure-123']},
+                                             apache_source.name)
+    user = User.find_by_login('not_existing_user_4')
+    assert_equal [usergroup], user.usergroups
   end
 
 
