瀏覽代碼

[sdxaas] Improve JWT fetching from Knox HA setup (#3363)

- No need now to use .replace() to clean the incoming config.
- Also slight improvements in checks to that we don't do 2 redundant calls to Knox for non-HA mode

How was this patch tested?
- Running existing unit tests.
- Tested E2E in HA setup.
Harsh Gupta 2 年之前
父節點
當前提交
7f07a4474d
共有 2 個文件被更改,包括 12 次插入8 次删除
  1. 1 1
      desktop/core/src/desktop/conf.py
  2. 11 7
      desktop/core/src/desktop/lib/sdxaas/knox_jwt.py

+ 1 - 1
desktop/core/src/desktop/conf.py

@@ -2194,7 +2194,7 @@ SDXAAS = ConfigSection(
     TOKEN_URL=Config(
       key='token_url',
       help=_('Comma separated host URLs to fetch token from.'),
-      type=str,
+      type=coerce_string,
       default='',
     )
   )

+ 11 - 7
desktop/core/src/desktop/lib/sdxaas/knox_jwt.py

@@ -29,25 +29,29 @@ _KNOX_TOKEN_GET_PARAM_STRING = '?knox.token.include.groups=true'
 
 
 def handle_knox_ha():
-  knox_urls = SDXAAS.TOKEN_URL.get()
-  auth_handler = requests_kerberos.HTTPKerberosAuth(mutual_authentication=requests_kerberos.OPTIONAL)
   res = None
+  auth_handler = requests_kerberos.HTTPKerberosAuth(mutual_authentication=requests_kerberos.OPTIONAL)
+
+  knox_urls = SDXAAS.TOKEN_URL.get()
+  if not knox_urls:
+    return None
 
-  if knox_urls:
-    # Config format is "['url1', 'url2']" for HA, so we need to clean up and split correctly in list.
-    # For non-HA, its normal url string.
-    knox_urls_list = knox_urls.replace("%20", "").replace("['", "").replace("']", "").replace("'", "").split(',')
+  if "," in knox_urls:
+    knox_urls_list = knox_urls.split(',')
 
     for k_url in knox_urls_list:
       try:
         res = requests.get(k_url.rstrip('/') + _KNOX_TOKEN_API, auth=auth_handler, verify=False)
       except Exception as e:
-        if 'Name or service not known' in str(e):
+        if 'Failed to establish a new connection' in str(e):
           LOG.warning('Knox URL %s is not available.' % k_url)
 
       # Check response for None and if response code is successful (200) or authentication needed (401), use that host URL.
       if (res is not None) and (res.status_code in (200, 401)):
         return k_url
+  else:
+    # For non-HA, it's normal url string.
+    return knox_urls
 
 
 def fetch_jwt():