Privileged ldap by ja5087 · Pull Request #157 · ocf/ocflib

ja5087 · 2019-02-12T06:25:09Z

addresses #142

dkess

Thanks for doing this, it's a welcome change. I think it should be slightly re-organized but other than that this lgtm!

dkess · 2019-02-13T20:23:39Z

Code looks good, however now tests are failing because the test runner can't find the password file. I think the best way to deal with this would be to move the tests to the manual section and prompt for the password there.

ja5087 · 2019-02-19T08:11:37Z

I'm going to try and mock the function instead of moving the tests to manual (where they may never get run), but that isn't working yet

dkess · 2019-02-19T22:45:22Z

Thanks for this, I think the new code is good now.

Instead of mocking functions, I'd say it's fine to give the test runner access to the password (it's accessible to all staff anyways) and actually running the functions. This will probably require a PR to Puppet.

dkess

lgtm, however at some point we should remove the mock and really test the function

This reverts commit ed886f7, reversing changes made to 2b27af0.

dkess · 2019-02-23T20:32:04Z

This commit needs to be temporary reverted, as it breaks ocfweb. We got the following rootspam this morning: (i've redacted some extra information here)

A problem was encountered and reported via ocflib:

An exception occured in ocfweb:

Traceback (most recent call last):
  File "/opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/base.py", line 124, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/opt/ocfweb/ocfweb/auth.py", line 53, in wrapper
    return fn(request, *args, **kwargs)
  File "/opt/ocfweb/ocfweb/account/register.py", line 51, in request_account
    if not user_attrs_ucb(calnet_uid):
  File "/opt/ocfweb/venv/lib/python3.5/site-packages/ocflib/account/search.py", line 56, in user_attrs_ucb
    base=UCB_LDAP_PEOPLE)
  File "/opt/ocfweb/venv/lib/python3.5/site-packages/ocflib/account/search.py", line 47, in user_attrs
    with connection(dn, password) as c:
  File "/opt/ocfweb/venv/lib/python3.5/site-packages/ocflib/infra/ldap.py", line 81, in ldap_ucb_privileged
    password = _read_ucb_password()
  File "/opt/ocfweb/venv/lib/python3.5/site-packages/ocflib/infra/ldap.py", line 256, in _read_ucb_password
    with open(UCB_LDAP_PASSWORD_PATH, 'r') as passwordFile:
FileNotFoundError: [Errno 2] No such file or directory: '/etc/ucbldap.passwd'



Request:
  * Host: www.ocf.berkeley.edu
  * Path: /account/register/
  * Method: GET
  * Secure: True

Request Headers:
{'CSRF_COOKIE': '<REDACTED>',
 'HTTP_CONNECTION': 'close',
 'HTTP_COOKIE': '<REDACTED>',
 'HTTP_HOST': 'www.ocf.berkeley.edu',
 'HTTP_REFERER': 'https://auth.berkeley.edu/cas/login?((redacted))

 'HTTP_VIA': '1.1 www.ocf.berkeley.edu',
 'HTTP_X_FORWARDED_HOST': 'www.ocf.berkeley.edu',
 'HTTP_X_FORWARDED_PROTO': 'https',
 'HTTP_X_FORWARDED_SERVER': 'www.ocf.berkeley.edu',
 'PATH_INFO': '/account/register/',
 'QUERY_STRING': '',
 'RAW_URI': '/account/register/',
 'REMOTE_ADDR': '127.0.0.1',
 'REMOTE_PORT': '52574',
 'REQUEST_METHOD': 'GET',
 'SCRIPT_NAME': '',
 'SERVER_NAME': '127.0.0.1',
 'SERVER_PORT': '8080',
 'SERVER_PROTOCOL': 'HTTP/1.0',
 'SERVER_SOFTWARE': 'gunicorn/19.9.0',
 'gunicorn.socket': <socket.socket fd=9, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('127.0.0.1', 8080), raddr=('127.0.0.1', 52574)>,
 'wsgi.errors': <gunicorn.http.wsgi.WSGIErrorsWrapper object at 0x7f6f312256d8>,
 'wsgi.file_wrapper': <class 'gunicorn.http.wsgi.FileWrapper'>,
 'wsgi.input': <gunicorn.http.body.Body object at 0x7f6f31225860>,
 'wsgi.multiprocess': True,
 'wsgi.multithread': False,
 'wsgi.run_once': False,
 'wsgi.url_scheme': 'https',
 'wsgi.version': (1, 0)}

Session:
{'calnet_uid': ((redacted)), 'login_return_path': '/about/staff'}


====
Hostname: ce044e06d63a
Callstack:
    at /opt/ocfweb/venv/lib/python3.5/site-packages/ocflib/misc/mail.py:95 (send_problem_report)
        by /opt/ocfweb/ocfweb/middleware/errors.py:86 (process_exception)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/base.py:166 (process_exception_by_middleware)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/base.py:126 (_get_response)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/utils/deprecation.py:91 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/ocfweb/middleware/errors.py:42 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/utils/deprecation.py:91 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/utils/deprecation.py:91 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/utils/deprecation.py:91 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/utils/deprecation.py:91 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/utils/deprecation.py:91 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/utils/deprecation.py:91 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/exception.py:34 (inner)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/base.py:78 (get_response)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/django/core/handlers/wsgi.py:142 (__call__)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/workers/sync.py:176 (handle_request)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/workers/sync.py:135 (handle)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/workers/sync.py:30 (accept)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/workers/sync.py:68 (run_for_one)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/workers/sync.py:124 (run)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/workers/base.py:134 (init_process)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/arbiter.py:583 (spawn_worker)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/arbiter.py:616 (spawn_workers)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/arbiter.py:545 (manage_workers)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/arbiter.py:203 (run)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/app/base.py:72 (run)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/app/base.py:223 (run)
        by /opt/ocfweb/venv/lib/python3.5/site-packages/gunicorn/app/wsgiapp.py:61 (run)
        by /opt/ocfweb/venv/bin/gunicorn:11 (<module>)

Looks like this is happening because the password file isn't inside the docker container that ocfweb is running in. We'll have to change the container configuration. The password should also perhaps be part of the ocfweb development configuration.

This reverts commit bec7635.

ja5087 added 2 commits February 11, 2019 22:17

reenabled LDAP privileged binds

4ea7358

minor style fixes

cf92261

ja5087 requested review from abizer, cg505 and dkess February 12, 2019 06:33

dkess suggested changes Feb 12, 2019

View reviewed changes

Comment thread ocflib/infra/ldap.py Outdated

Comment thread ocflib/infra/ldap.py Outdated

ja5087 added 2 commits February 12, 2019 19:56

allow both unprivileged/privileged binds and dependent changes

f7ad601

minor style fixes

af23ec0

modified tests to mock read_ucb_password

ac4e65a

fixed tests again

74b1ca1

abizer reviewed Feb 19, 2019

View reviewed changes

Comment thread ocflib/infra/ldap.py Outdated

abizer reviewed Feb 19, 2019

View reviewed changes

Comment thread ocflib/infra/ldap.py Outdated

ja5087 added 4 commits February 19, 2019 01:12

fixed using constant for string and more tests

2cf8287

refactored to keep password in file, fixed tests

02610d2

moved untestable to manual, refactor to make pw access transparent

c5aea5b

added note explaining failure case for manual test

f87eb6f

dkess approved these changes Feb 19, 2019

View reviewed changes

ja5087 merged commit ed886f7 into ocf:master Feb 23, 2019

dkess added a commit that referenced this pull request Feb 23, 2019

Revert "Merge pull request #157 from ja5087/privileged_ldap"

bec7635

This reverts commit ed886f7, reversing changes made to 2b27af0.

dkess mentioned this pull request Mar 12, 2019

use LDAP privileged bind in account creation #142

Closed

ja5087 mentioned this pull request Apr 20, 2019

Privileged LDAP (again) #169

Open

cg505 added a commit that referenced this pull request Apr 22, 2019

Revert "Revert "Merge pull request #157 from ja5087/privileged_ldap""

e93fa9b

This reverts commit bec7635.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Privileged ldap#157

Privileged ldap#157
ja5087 merged 10 commits into
ocf:masterfrom
ja5087:privileged_ldap

ja5087 commented Feb 12, 2019

Uh oh!

dkess left a comment

Uh oh!

Uh oh!

Uh oh!

dkess commented Feb 13, 2019

Uh oh!

ja5087 commented Feb 19, 2019

Uh oh!

Uh oh!

Uh oh!

dkess commented Feb 19, 2019

Uh oh!

dkess left a comment

Uh oh!

dkess commented Feb 23, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

ja5087 commented Feb 12, 2019

Uh oh!

dkess left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dkess commented Feb 13, 2019

Uh oh!

ja5087 commented Feb 19, 2019

Uh oh!

Uh oh!

Uh oh!

dkess commented Feb 19, 2019

Uh oh!

dkess left a comment

Choose a reason for hiding this comment

Uh oh!

dkess commented Feb 23, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants