Преглед изворни кода

[desktop] Support environment variable Database/LDAP/SMTP/SSL passwords

Erick Tryzelaar пре 10 година
родитељ
комит
0e15a17b09
2 измењених фајлова са 84 додато и 23 уклоњено
  1. 58 22
      apps/beeswax/src/beeswax/tests.py
  2. 26 1
      desktop/core/src/desktop/conf.py

+ 58 - 22
apps/beeswax/src/beeswax/tests.py

@@ -40,7 +40,12 @@ from django.core.urlresolvers import reverse
 from django.db import transaction
 
 from desktop.lib.exceptions_renderable import PopupException
-from desktop.conf import AUTH_USERNAME as DEFAULT_AUTH_USERNAME, AUTH_PASSWORD as DEFAULT_AUTH_PASSWORD, LDAP_USERNAME, LDAP_PASSWORD
+from desktop.conf import \
+    AUTH_USERNAME as DEFAULT_AUTH_USERNAME, \
+    AUTH_PASSWORD as DEFAULT_AUTH_PASSWORD, \
+    AUTH_PASSWORD_SCRIPT as DEFAULT_AUTH_PASSWORD_SCRIPT, \
+    LDAP_USERNAME, \
+    LDAP_PASSWORD
 from desktop import redaction
 from desktop.redaction import logfilter
 from desktop.redaction.engine import RedactionPolicy, RedactionRule
@@ -2830,32 +2835,63 @@ def test_auth_pass_through():
       f()
 
   # Password file specific and use common username
-  with tempfile.NamedTemporaryFile(delete=False) as pwd_file:
-    pwd_file.write('''#!/usr/bin/env bash
+  finish = []
+  finish.append(LDAP_USERNAME.set_for_testing('deprecated_default_username'))
+  finish.append(LDAP_PASSWORD.set_for_testing('deprecated_default_password'))
 
-echo "my_hue_secret"''')
-    pwd_file.flush()
-    pwd_file.close() # Closing as getting "Text file busy" otherwise
-    os.chmod(pwd_file.name, 0770)
+  finish.append(DEFAULT_AUTH_USERNAME.set_for_testing('default_username'))
+  finish.append(DEFAULT_AUTH_PASSWORD.set_for_testing(present=False))
 
-    finish = []
-    finish.append(LDAP_USERNAME.set_for_testing('deprecated_default_username'))
-    finish.append(LDAP_PASSWORD.set_for_testing('deprecated_default_password'))
+  finish.append(AUTH_USERNAME.set_for_testing(present=False))
+  finish.append(AUTH_PASSWORD.set_for_testing(present=False))
+  finish.append(AUTH_PASSWORD_SCRIPT.set_for_testing('/bin/echo "my_hue_secret"'))
+
+  try:
+    assert_equal('default_username', AUTH_USERNAME.get())
+    assert_equal('my_hue_secret', AUTH_PASSWORD.get())
+  finally:
+    for f in finish:
+      f()
 
-    finish.append(DEFAULT_AUTH_USERNAME.set_for_testing('default_username'))
-    finish.append(DEFAULT_AUTH_PASSWORD.set_for_testing(present=False))
+  # Make sure global auth password script can be used.
+  finish = []
+  finish.append(LDAP_USERNAME.set_for_testing('deprecated_default_username'))
+  finish.append(LDAP_PASSWORD.set_for_testing('deprecated_default_password'))
 
-    finish.append(AUTH_USERNAME.set_for_testing(present=False))
-    finish.append(AUTH_PASSWORD.set_for_testing(present=False))
-    finish.append(AUTH_PASSWORD_SCRIPT.set_for_testing(pwd_file.name))
+  finish.append(DEFAULT_AUTH_USERNAME.set_for_testing('default_username'))
+  finish.append(DEFAULT_AUTH_PASSWORD.set_for_testing(present=False))
+  finish.append(DEFAULT_AUTH_PASSWORD_SCRIPT.set_for_testing('/bin/echo "my_hue_secret"'))
 
-    try:
-      assert_equal('default_username', AUTH_USERNAME.get())
-      assert_equal('my_hue_secret', AUTH_PASSWORD.get())
-    finally:
-      os.remove(pwd_file.name)
-      for f in finish:
-        f()
+  finish.append(AUTH_USERNAME.set_for_testing(present=False))
+  finish.append(AUTH_PASSWORD.set_for_testing(present=False))
+  finish.append(AUTH_PASSWORD_SCRIPT.set_for_testing(present=False))
+
+  try:
+    assert_equal('default_username', AUTH_USERNAME.get())
+    assert_equal('my_hue_secret', AUTH_PASSWORD.get())
+  finally:
+    for f in finish:
+      f()
+
+  # Make sure local auth password script overrides global password.
+  finish = []
+  finish.append(LDAP_USERNAME.set_for_testing('deprecated_default_username'))
+  finish.append(LDAP_PASSWORD.set_for_testing('deprecated_default_password'))
+
+  finish.append(DEFAULT_AUTH_USERNAME.set_for_testing('default_username'))
+  finish.append(DEFAULT_AUTH_PASSWORD.set_for_testing(present=False))
+  finish.append(DEFAULT_AUTH_PASSWORD_SCRIPT.set_for_testing('/bin/echo "not_my_secret"'))
+
+  finish.append(AUTH_USERNAME.set_for_testing(present=False))
+  finish.append(AUTH_PASSWORD.set_for_testing(present=False))
+  finish.append(AUTH_PASSWORD_SCRIPT.set_for_testing('/bin/echo "my_hue_secret"'))
+
+  try:
+    assert_equal('default_username', AUTH_USERNAME.get())
+    assert_equal('my_hue_secret', AUTH_PASSWORD.get())
+  finally:
+    for f in finish:
+      f()
 
 
 def hive_site_xml(is_local=False, use_sasl=False, thrift_uris='thrift://darkside-1234:9999',

+ 26 - 1
desktop/core/src/desktop/conf.py

@@ -197,10 +197,19 @@ AUTH_USERNAME = Config(
 
 def get_auth_password():
   """Get from script or backward compatibility"""
+
+  password = os.environ.get('HUE_AUTH_PASSWORD')
+  if password is not None:
+    return password
+
   password = AUTH_PASSWORD_SCRIPT.get()
   if password:
     return password
 
+  password = os.environ.get('HUE_LDAP_PASSWORD')
+  if password is not None:
+    return password
+
   password = LDAP_PASSWORD.get() # 2 levels for backward compatibility
   if password:
     return password
@@ -1057,7 +1066,7 @@ def validate_ldap(user, config):
   if config.SEARCH_BIND_AUTHENTICATION.get():
     if config.LDAP_URL.get() is not None:
       bind_dn = config.BIND_DN.get()
-      bind_password = config.BIND_PASSWORD.get() or config.BIND_PASSWORD_SCRIPT.get()
+      bind_password = get_ldap_bind_password(config)
 
       if bool(bind_dn) != bool(bind_password):
         if bind_dn == None:
@@ -1189,6 +1198,10 @@ def get_secret_key():
 
 
 def get_ssl_password():
+  password = os.environ.get('HUE_SSL_PASSWORD')
+  if password is not None:
+    return password
+
   password = SSL_PASSWORD.get()
   if not password:
     password = SSL_PASSWORD_SCRIPT.get()
@@ -1197,6 +1210,10 @@ def get_ssl_password():
 
 
 def get_database_password():
+  password = os.environ.get('HUE_DATABASE_PASSWORD')
+  if password is not None:
+    return password
+
   password = DATABASE.PASSWORD.get()
   if not password:
     password = DATABASE.PASSWORD_SCRIPT.get()
@@ -1205,6 +1222,10 @@ def get_database_password():
 
 
 def get_smtp_password():
+  password = os.environ.get('HUE_SMTP_PASSWORD')
+  if password is not None:
+    return password
+
   password = SMTP.PASSWORD.get()
   if not password:
     password = SMTP.PASSWORD_SCRIPT.get()
@@ -1213,6 +1234,10 @@ def get_smtp_password():
 
 
 def get_ldap_bind_password(ldap_config):
+  password = os.environ.get('HUE_LDAP_BIND_PASSWORD')
+  if password is not None:
+    return password
+
   password = ldap_config.BIND_PASSWORD.get()
   if not password:
     password = ldap_config.BIND_PASSWORD_SCRIPT.get()