Adds SSO auth to gsutil
Code path: 1. plugins.sso_auth is imported, which adds the AuthHandler class to the global state. 2. HasConfiguredCredentials() in gslib/utils.py is called by gsutil, and will return true if "prodaccess" exists on the system, which tells the system that we don't want a no-op auth handler. 3. When a command is called, all the auth handlers are cycled through and sso_auth.SSOAuth is called, which calls a stubby command to emit a gaiamint'ed oauth2 access token, which is then used as the Authorization Header if --bypass_prodaccess is passed in, then: 1. HasConfiguredCredentials() will bypass the check for prodaccess, as if it didn't exist. 2. plugins.sso_auth does not get imported. Which will essentially cause gsutil to behave as if this patch never existed. So the expected behavior is: =.boto file does not exist, prodaccess exists, but unauthenticated= Failure: No handler was ready to authenticate. 3 handlers were checked. ['OAuth2Auth', 'HmacAuthV1Handler', 'SSOAuth'] Check your credentials. =.boto file exists, prodaccess exists, but unauthenticated= sso_auth will raise NotReadyToAuthenticate, and the .boto file will be used instead =.boto file exists, prodaccess exists, authenticated= sso_auth will be run _after_ the default gsutil authenticator, which causes the sso_auth to be used over whatever the default authentication is. bypass_prodaccess is passed in by default to upload_to_google_storage because we expect people who use upload_to_google_storage to not need prodaccess and have their own boto file already. Also the sso_auth plugin will only request a readonlyi token, which will not work for uploading. BUG=258152 Review URL: https://codereview.chromium.org/86123002 git-svn-id: svn://svn.chromium.org/chrome/trunk/tools/depot_tools@240266 0039d316-1c4b-4281-b951-d872f2087c98experimental/szager/collated-output
hinoka@chromium.org
12 years ago
parent
aeab41a341
commit
c6a2ee6930
@ -0,0 +1,105 @@
|
|||||||
|
# Copyright 2013 The Chromium Authors. All rights reserved.
|
||||||
|
# Use of this source code is governed by a BSD-style license that can be
|
||||||
|
# found in the LICENSE file.
|
||||||
|
|
||||||
|
"""AuthHandler plugin for gsutil's boto to support LOAS based auth."""
|
||||||
|
|
||||||
|
import getpass
|
||||||
|
import json
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
import subprocess
|
||||||
|
import time
|
||||||
|
import urllib2
|
||||||
|
|
||||||
|
from boto.auth_handler import AuthHandler
|
||||||
|
from boto.auth_handler import NotReadyToAuthenticate
|
||||||
|
|
||||||
|
CMD = ['stubby', '--proto2', 'call', 'blade:sso', 'CorpLogin.Exchange']
|
||||||
|
|
||||||
|
STUBBY_CMD = """target: {
|
||||||
|
scope: GAIA_USER
|
||||||
|
name: "%s"
|
||||||
|
}
|
||||||
|
target_credential: {
|
||||||
|
type: OAUTH2_TOKEN
|
||||||
|
oauth2_attributes: {
|
||||||
|
scope: 'https://www.googleapis.com/auth/devstorage.read_only'
|
||||||
|
}
|
||||||
|
}"""
|
||||||
|
|
||||||
|
COOKIE_LOCATION = os.path.expanduser('~/.devstore_token')
|
||||||
|
|
||||||
|
TOKEN_EXPIRY = 300
|
||||||
|
|
||||||
|
|
||||||
|
class SSOAuthError(Exception):
|
||||||
|
pass
|
||||||
|
|
||||||
|
|
||||||
|
class SSOAuth(AuthHandler):
|
||||||
|
"""SSO based auth handler."""
|
||||||
|
|
||||||
|
capability = ['google-oauth2', 's3']
|
||||||
|
|
||||||
|
def __init__(self, path, config, provider):
|
||||||
|
if provider.name == 'google' and self.has_prodaccess():
|
||||||
|
# If we don't have a loas token, then bypass this auth handler.
|
||||||
|
if subprocess.call('loas_check',
|
||||||
|
stdout=subprocess.PIPE,
|
||||||
|
stderr=subprocess.PIPE):
|
||||||
|
raise NotReadyToAuthenticate()
|
||||||
|
else:
|
||||||
|
raise NotReadyToAuthenticate()
|
||||||
|
self.token = None
|
||||||
|
self.expire = 0
|
||||||
|
|
||||||
|
def GetAccessToken(self):
|
||||||
|
"""Returns a valid devstore access token.
|
||||||
|
|
||||||
|
This will return from an in-memory cache if the token is there already,
|
||||||
|
then try a filesystem cache, and then runs a stubby call if none of the
|
||||||
|
caches have a valid token.
|
||||||
|
"""
|
||||||
|
if self.token and self.expire > time.time():
|
||||||
|
return self.token
|
||||||
|
|
||||||
|
# Try to retrieve token from filesystem cache.
|
||||||
|
if os.path.exists(COOKIE_LOCATION):
|
||||||
|
last_modified = os.path.getmtime(COOKIE_LOCATION)
|
||||||
|
if time.time() - last_modified < TOKEN_EXPIRY:
|
||||||
|
with open(COOKIE_LOCATION, 'rb') as f:
|
||||||
|
self.token = f.read()
|
||||||
|
self.expire = last_modified + TOKEN_EXPIRY
|
||||||
|
return self.token
|
||||||
|
|
||||||
|
# If the token is not in either caches, or has expired, then fetch token.
|
||||||
|
username = '%s@google.com' % getpass.getuser()
|
||||||
|
proc = subprocess.Popen(CMD, stdin=subprocess.PIPE, stdout=subprocess.PIPE)
|
||||||
|
out, err = proc.communicate(STUBBY_CMD % username)
|
||||||
|
if proc.returncode:
|
||||||
|
raise SSOAuthError('Stubby returned %d\n%s' % (proc.returncode, err))
|
||||||
|
token_match = re.search(r'oauth2_token: "(.*)"$', out)
|
||||||
|
|
||||||
|
if not token_match:
|
||||||
|
raise SSOAuthError('Oauth2 token not found in %s' % out)
|
||||||
|
|
||||||
|
token = token_match.group(1)
|
||||||
|
self.token = token
|
||||||
|
self.expire = time.time() + TOKEN_EXPIRY
|
||||||
|
with os.fdopen(os.open(COOKIE_LOCATION,
|
||||||
|
os.O_WRONLY | os.O_CREAT,
|
||||||
|
0600), 'wb') as f:
|
||||||
|
f.write(token)
|
||||||
|
return token
|
||||||
|
|
||||||
|
def add_auth(self, http_request):
|
||||||
|
http_request.headers['Authorization'] = 'OAuth %s' % self.GetAccessToken()
|
||||||
|
|
||||||
|
@staticmethod
|
||||||
|
def has_prodaccess():
|
||||||
|
for path in os.environ['PATH'].split(os.pathsep):
|
||||||
|
exe_file = os.path.join(path, 'prodaccess')
|
||||||
|
if os.path.exists(exe_file) and os.access(exe_file, os.X_OK):
|
||||||
|
return True
|
||||||
|
return False
|
||||||
Loading…
Reference in New Issue