Bug 1214231

Summary:	[RFE] forced anonymous mode for beaker client
Product:	[Retired] Beaker	Reporter:	Jiri Jaburek <jjaburek>
Component:	command line	Assignee:	beaker-dev-list
Status:	CLOSED DUPLICATE	QA Contact:	tools-bugs <tools-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	0.18	CC:	dcallagh, ebaak, jstancek, rjoost
Target Milestone:	---	Keywords:	FutureFeature
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-06-14 05:54:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jiri Jaburek 2015-04-22 09:38:12 UTC

Description of problem:

The beaker client (bkr) is sometimes used in automated scripts, possibly querying machines and distros / distro trees or reserving/provisioning machines.

While some actions may need privileged login, some others do not and doing authentication in those cases significantly slows down the operation if the beaker server is far away.

$ time bkr system-status --format=json f.q.d.n > /dev/null

real    0m3.676s
user    0m0.428s
sys     0m0.078s

$ time curl -sk https://hub/systems/f.q.d.n/status > /dev/null

real    0m0.898s
user    0m0.059s
sys     0m0.106s

The authentication is, however, useful by default as some systems might not be visible via anonymous access (and re-trying would just cause more delay). It should be up to the person using bkr(1) to choose between anonymous/authenticated access for a given command.

Therefore I propose something like --skip-auth for bkr(1), which would override even ~/.beaker_client/config.

Alternatively (for another bug), beaker client could support semi-persistent auth tokens, so that subsequent calls wouldn't need to authenticate all over again.


Version-Release number of selected component (if applicable):
beaker-client-19.1-1.fc19

Comment 1 Jan Stancek 2015-04-22 10:27:00 UTC

Possible workaround:

$ cat example.py
#!/usr/bin/python

import os
import sys
import xmlrpclib
import xml.dom.minidom
from bkr.client import conf
from bkr.common.hub import HubProxy

hub = HubProxy(conf=conf, auto_login=False)
print hub.auth.who_am_i()


$ time python example.py 
Traceback (most recent call last):
  File "example.py", line 11, in <module>
    print hub.auth.who_am_i()
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1224, in __call__
    return self.__send(self.__name, args)
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1578, in __request
    verbose=self.__verbose
  File "/usr/lib/python2.7/site-packages/bkr/common/xmlrpc.py", line 560, in request
    result = transport_class.request(self, *args, **kwargs)
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1264, in request
    return self.single_request(host, handler, request_body, verbose)
  File "/usr/lib/python2.7/site-packages/bkr/common/xmlrpc.py", line 461, in _single_request
    return self.parse_response(response)
  File "/usr/lib64/python2.7/xmlrpclib.py", line 1473, in parse_response
    return u.close()
  File "/usr/lib64/python2.7/xmlrpclib.py", line 793, in close
    raise Fault(**self._stack[0])
xmlrpclib.Fault: <Fault 1: "<class 'bkr.server.identity.IdentityFailure'>: Anonymous access denied">

real    0m0.823s
user    0m0.099s
sys     0m0.021s

Comment 2 Jan Stancek 2015-04-22 10:36:52 UTC

Or if you'd prefer 'bkr' command line, overriding HubProxy class could also work. For example:

$ cat anonym_bkr.py
#!/usr/bin/python

import bkr.common.hub

class AnonymousHubProxy(bkr.common.hub.HubProxy):
        """A Hub client (thin ServerProxy wrapper)."""
        def __init__(self, conf, client_type=None, logger=None, transport=None,
                auto_login=True, auto_logout=True, **kwargs):
                auto_login = False
                super(bkr.common.hub.HubProxy, self).__init__(conf, client_type,
                        logger, transport, auto_login, auto_logout, **kwargs)

bkr.common.hub.HubProxy = AnonymousHubProxy

g = globals()
l = {}
execfile('/usr/bin/bkr', g, l)

$ time ./anonym_bkr.py whoami
XML-RPC fault: <class 'bkr.server.identity.IdentityFailure'>: Anonymous access denied

real    0m0.895s
user    0m0.183s
sys     0m0.028s

Comment 3 Dan Callaghan 2016-06-14 05:54:44 UTC

In bug 1323921 we added AUTH_METHOD="none" for this use case, although there's no equivalent command line option for it as requested here, just the config file setting. I assume that limitation is fine though.

*** This bug has been marked as a duplicate of bug 1323921 ***