Эх сурвалжийг харах

HUE-5846 [metadata] Update conf file to read the latest properties

Romain Rigaux 8 жил өмнө
parent
commit
3331de5

+ 24 - 9
desktop/conf.dist/hue.ini

@@ -1624,17 +1624,32 @@
 
   [[navigator]]
     # For tagging tables, files and getting lineage of data.
-    # Navigator API URL (without version suffix)
+    # Navigator API URL (without version suffix).
     ## api_url=http://localhost:7187/api
 
-    # Navigator API HTTP authentication username and password
-    # Override the desktop default username and password of the hue user used for authentications with other services.
-    # e.g. Used for LDAP/PAM pass-through authentication.
-    ## auth_username=hue
-    ## auth_password=
-
-    # Execute this script to produce the auth password. This will be used when `auth_password` is not set.
-    ## auth_password_script=
+    # Which authentication to use: CM or external via LDAP or SAML.
+    ## navmetaserver_auth_type=CMDB
+
+    # Username of the CM user used for authentication.
+    ## auth_cmusername=hue
+    # CM password of the user used for authentication.
+    ## auth_cmpassword=
+    # Execute this script to produce the CM password. This will be used when the plain password is not set.
+    # auth_password_script=
+
+    # Username of the LDAP user used for authentication.
+    ## auth_ldapusername=hue
+    # LDAP password of the user used for authentication.
+    ## auth_ldappassword=
+    # Execute this script to produce the LDAP password. This will be used when the plain password is not set.
+    ## auth_ldappassword_script=
+
+    # Username of the SAML user used for authentication.
+    ## auth_samlusername=hue
+    ## SAML password of the user used for authentication.
+    # auth_samlpassword=
+    # Execute this script to produce the SAML password. This will be used when the plain password  is not set.
+    ## auth_samlpassword_script=
 
     # Perform Sentry privilege filtering.
     # Default to true automatically if the cluster is secure.

+ 24 - 9
desktop/conf/pseudo-distributed.ini.tmpl

@@ -1628,17 +1628,32 @@
 
   [[navigator]]
     # For tagging tables, files and getting lineage of data.
-    # Navigator API URL (without version suffix)
+    # Navigator API URL (without version suffix).
     ## api_url=http://localhost:7187/api
 
-    # Navigator API HTTP authentication username and password
-    # Override the desktop default username and password of the hue user used for authentications with other services.
-    # e.g. Used for LDAP/PAM pass-through authentication.
-    ## auth_username=hue
-    ## auth_password=
-
-    # Execute this script to produce the auth password. This will be used when `auth_password` is not set.
-    ## auth_password_script=
+    # Which authentication to use: CM or external via LDAP or SAML.
+    ## navmetaserver_auth_type=CMDB
+
+    # Username of the CM user used for authentication.
+    ## auth_cmusername=hue
+    # CM password of the user used for authentication.
+    ## auth_cmpassword=
+    # Execute this script to produce the CM password. This will be used when the plain password is not set.
+    # auth_password_script=
+
+    # Username of the LDAP user used for authentication.
+    ## auth_ldapusername=hue
+    # LDAP password of the user used for authentication.
+    ## auth_ldappassword=
+    # Execute this script to produce the LDAP password. This will be used when the plain password is not set.
+    ## auth_ldappassword_script=
+
+    # Username of the SAML user used for authentication.
+    ## auth_samlusername=hue
+    ## SAML password of the user used for authentication.
+    # auth_samlpassword=
+    # Execute this script to produce the SAML password. This will be used when the plain password  is not set.
+    ## auth_samlpassword_script=
 
     # Perform Sentry privilege filtering.
     # Default to true automatically if the cluster is secure.

+ 83 - 13
desktop/libs/metadata/src/metadata/conf.py

@@ -48,7 +48,6 @@ def default_navigator_url():
 def get_optimizer_url():
   return OPTIMIZER.API_URL.get() and OPTIMIZER.API_URL.get().strip('/')
 
-
 def has_optimizer():
   return bool(get_optimizer_url())
 
@@ -56,9 +55,8 @@ def has_optimizer():
 def get_navigator_url():
   return NAVIGATOR.API_URL.get() and NAVIGATOR.API_URL.get().strip('/')[:-3]
 
-
 def has_navigator(user):
-  return bool(get_navigator_url() and NAVIGATOR.AUTH_PASSWORD.get()) \
+  return bool(get_navigator_url() and get_navigator_auth_password()) \
       and (user.is_superuser or user.has_hue_permission(action="access", app=DJANGO_APPS[0]))
 
 
@@ -132,9 +130,43 @@ OPTIMIZER = ConfigSection(
 )
 
 
+def get_navigator_auth_type():
+  return NAVIGATOR.AUTH_TYPE.get().lower()
+
+
+def get_navigator_auth_username():
+  '''Get the username to authenticate with.'''
+
+  if get_navigator_auth_type() == 'ldap':
+    return NAVIGATOR.AUTH_LDAP_USERNAME.get()
+  elif get_navigator_auth_type() == 'saml':
+    return NAVIGATOR.AUTH_SAML_USERNAME.get()
+  else:
+    return NAVIGATOR.AUTH_CM_USERNAME.get()
+
 def get_navigator_auth_password():
+  '''Get the password to authenticate with.'''
+
+  if get_navigator_auth_type() == 'ldap':
+    return NAVIGATOR.AUTH_LDAP_PASSWORD.get()
+  elif get_navigator_auth_type() == 'saml':
+    return NAVIGATOR.AUTH_SAML_PASSWORD.get()
+  else:
+    return NAVIGATOR.AUTH_CM_PASSWORD.get()
+
+
+def get_navigator_cm_password():
+  '''Get default password from secured file'''
+  return NAVIGATOR.AUTH_CM_PASSWORD_SCRIPT.get()
+
+def get_navigator_ldap_password():
   '''Get default password from secured file'''
-  return NAVIGATOR.AUTH_PASSWORD_SCRIPT.get()
+  return NAVIGATOR.AUTH_LDAP_PASSWORD_SCRIPT.get()
+
+def get_navigator_saml_password():
+  '''Get default password from secured file'''
+  return NAVIGATOR.AUTH_SAML_PASSWORD_SCRIPT.get()
+
 
 def get_security_default():
   '''Get default security value from Hadoop'''
@@ -152,21 +184,59 @@ NAVIGATOR = ConfigSection(
       key='api_url',
       help=_t('Base URL to Navigator API.'),
       dynamic_default=default_navigator_url),
-    AUTH_USERNAME=Config(
-      key="auth_username",
-      help=_t("Auth username of the hue user used for authentications."),
+    AUTH_TYPE=Config(
+      key="navmetaserver_auth_type",
+      help=_t("Which authentication to use: CM or external via LDAP or SAML."),
+      default='CMDB'),
+
+    AUTH_CM_USERNAME=Config(
+      key="auth_cmusername",
+      help=_t("Username of the CM user used for authentication."),
       dynamic_default=get_auth_username),
-    AUTH_PASSWORD=Config(
-      key="auth_password",
-      help=_t("LDAP/PAM/.. password of the hue user used for authentications."),
+    AUTH_CM_PASSWORD=Config(
+      key="auth_cmpassword",
+      help=_t("CM password of the user used for authentication."),
       private=True,
-      dynamic_default=get_navigator_auth_password),
-    AUTH_PASSWORD_SCRIPT=Config(
+      dynamic_default=get_navigator_cm_password),
+    AUTH_CM_PASSWORD_SCRIPT=Config(
       key="auth_password_script",
-      help=_t("Execute this script to produce the auth password. This will be used when `auth_password` is not set."),
+      help=_t("Execute this script to produce the CM password. This will be used when the plain password is not set."),
       private=True,
       type=coerce_password_from_script,
       default=None),
+
+    AUTH_LDAP_USERNAME=Config(
+      key="auth_ldapusername",
+      help=_t("Username of the LDAP user used for authentication."),
+      dynamic_default=get_auth_username),
+    AUTH_LDAP_PASSWORD=Config(
+      key="auth_ldappassword",
+      help=_t("LDAP password of the user used for authentication."),
+      private=True,
+      dynamic_default=get_navigator_ldap_password),
+    AUTH_LDAP_PASSWORD_SCRIPT=Config(
+      key="auth_ldappassword_script",
+      help=_t("Execute this script to produce the LDAP password. This will be used when the plain password is not set."),
+      private=True,
+      type=coerce_password_from_script,
+      default=None),
+
+    AUTH_SAML_USERNAME=Config(
+      key="auth_samlusername",
+      help=_t("Username of the SAML user used for authentication."),
+      dynamic_default=get_auth_username),
+    AUTH_SAML_PASSWORD=Config(
+      key="auth_samlpassword",
+      help=_t("SAML password of the user used for authentication."),
+      private=True,
+      dynamic_default=get_navigator_saml_password),
+    AUTH_SAML_PASSWORD_SCRIPT=Config(
+      key="auth_samlpassword_script",
+      help=_t("Execute this script to produce the SAML password. This will be used when the plain password  is not set."),
+      private=True,
+      type=coerce_password_from_script,
+      default=None),
+
     CONF_DIR = Config(
       key='conf_dir',
       help=_t('Navigator configuration directory, where navigator.client.properties is located.'),

+ 4 - 3
desktop/libs/metadata/src/metadata/metadata_sites.py

@@ -44,7 +44,7 @@ def get_conf(name='navigator'):
 
 def get_navigator_server_url():
   """Returns the navigator.server.url"""
-  return get_conf().get(_CONF_NAVIGATOR_SERVER_URL, 'http://localhost:7187')
+  return get_conf('navigator-lineage').get(_CONF_NAVIGATOR_SERVER_URL, 'http://localhost:7187')
 
 
 def get_navigator_audit_log_dir():
@@ -59,7 +59,7 @@ def get_navigator_audit_max_file_size():
 
 
 def get_navigator_hue_server_name():
-  return get_conf().get(_CONF_NAVIGATOR_HUE_SERVER_NAME, '')
+  return get_conf('navigator-lineage').get(_CONF_NAVIGATOR_HUE_SERVER_NAME, '')
 
 
 def _parse_sites():
@@ -69,7 +69,8 @@ def _parse_sites():
   _SITE_DICT ={}
 
   paths = [
-    ('navigator', os.path.join(NAVIGATOR.CONF_DIR.get(), 'navigator.client.properties')),
+    ('navigator', os.path.join(NAVIGATOR.CONF_DIR.get(), 'navigator.client.properties')), # 'audit'
+    ('navigator-lineage', os.path.join(NAVIGATOR.CONF_DIR.get(), 'navigator.lineage.client.properties')),
   ]
 
   for name, path in paths:

+ 3 - 3
desktop/libs/metadata/src/metadata/navigator_client.py

@@ -29,7 +29,7 @@ from hadoop.conf import HDFS_CLUSTERS
 from libsentry.privilege_checker import PrivilegeChecker
 from libsentry.sentry_site import get_hive_sentry_provider
 
-from metadata.conf import NAVIGATOR
+from metadata.conf import NAVIGATOR, get_navigator_auth_password, get_navigator_auth_username
 from metadata.metadata_sites import get_navigator_hue_server_name
 
 
@@ -58,8 +58,8 @@ class NavigatorApi(object):
 
   def __init__(self, user=None):
     self._api_url = '%s/%s' % (NAVIGATOR.API_URL.get().strip('/'), VERSION)
-    self._username = NAVIGATOR.AUTH_USERNAME.get()
-    self._password = NAVIGATOR.AUTH_PASSWORD.get()
+    self._username = get_navigator_auth_username()
+    self._password = get_navigator_auth_password()
 
     self.user = user
     self._client = HttpClient(self._api_url, logger=LOG)

+ 34 - 1
desktop/libs/metadata/src/metadata/navigator_tests.py

@@ -30,7 +30,8 @@ from desktop.lib.django_test_util import make_logged_in_client
 from desktop.lib.test_utils import add_to_group, grant_access
 from hadoop.pseudo_hdfs4 import is_live_cluster
 
-from metadata.conf import has_navigator
+from metadata.conf import has_navigator, NAVIGATOR, get_navigator_auth_password,\
+  get_navigator_auth_username
 from metadata.navigator_api import _augment_highlighting
 from metadata.navigator_client import NavigatorApi
 
@@ -160,3 +161,35 @@ class TestNavigatorAPI(object):
 
     _augment_highlighting(query_s, records)
     assert_equal('', records[0]['parentPath'])
+
+  def test_navigator_conf(self):
+    resets = [
+      NAVIGATOR.AUTH_CM_USERNAME.set_for_testing('cm_username'),
+      NAVIGATOR.AUTH_CM_PASSWORD.set_for_testing('cm_pwd'),
+      NAVIGATOR.AUTH_LDAP_USERNAME.set_for_testing('ldap_username'),
+      NAVIGATOR.AUTH_LDAP_PASSWORD.set_for_testing('ldap_pwd'),
+      NAVIGATOR.AUTH_SAML_USERNAME.set_for_testing('saml_username'),
+      NAVIGATOR.AUTH_SAML_PASSWORD.set_for_testing('saml_pwd'),
+    ]
+
+    reset = NAVIGATOR.AUTH_TYPE.set_for_testing('CMDB')
+
+    try:
+      assert_equal('cm_username', get_navigator_auth_username())
+      assert_equal('cm_pwd', get_navigator_auth_password())
+
+      reset()
+      reset = NAVIGATOR.AUTH_TYPE.set_for_testing('ldap')
+
+      assert_equal('ldap_username', get_navigator_auth_username())
+      assert_equal('ldap_pwd', get_navigator_auth_password())
+
+      reset()
+      reset = NAVIGATOR.AUTH_TYPE.set_for_testing('SAML')
+
+      assert_equal('saml_username', get_navigator_auth_username())
+      assert_equal('saml_pwd', get_navigator_auth_password())
+    finally:
+      reset()
+      for _reset in resets:
+        _reset()