Downloading a job binary while using proxy domain creates an error

Bug #1384889 reported by Michael McCune
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Sahara
Fix Released
Medium
Michael McCune

Bug Description

If a user attempts to download a Job Binary from the UI, or /data end-point, while using the proxy domain for Swift access, the operation will fail with an error about requiring a username and password. The exact error text is: "Error: Unable to fetch job binary: Authorization Failure. A username and password or token is required."

Steps to reproduce:
1. create a Swift object
2. create a Job Binary from the Swift object
3. download the Job Binary using the UI or a GET on the /data endpoint

This is caused by there being no proxy user created to authenticate with Swift. This is an issue with the nature of when proxy users are created. Currently they are only created during job execution.

A possible solution is to create a proxy user when a download is requested, but this could create other issues with regards to creating/deleting proxy users with high frequency. Another solution could be to create a token based on the current user to access the binary.

description: updated
Revision history for this message
Andrew Lazarev (alazarev) wrote :

I don't think we need proxy user for each download. If it is possible to create token based on the current user - this should be right way to solve issue.

Changed in sahara:
assignee: nobody → Michael McCune (mimccune)
status: New → In Progress
importance: Undecided → Medium
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to sahara (master)

Fix proposed to branch: master
Review: https://review.openstack.org/145960

description: updated
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to sahara (master)

Reviewed: https://review.openstack.org/145960
Committed: https://git.openstack.org/cgit/openstack/sahara/commit/?id=8007c2abeb23433c7957ca643365c057b6076238
Submitter: Jenkins
Branch: master

commit 8007c2abeb23433c7957ca643365c057b6076238
Author: Michael McCune <email address hidden>
Date: Thu Jan 8 17:46:02 2015 -0500

    Refactoring swift binary retrievers to allow context auth

    This change is needed to fix an issue with using proxy domains and
    downloading job binaries through the ".../data" endpoint. A new function
    is added to retrieve binaries from swift using the context credentials.
    The raw data retrievers for swift have been refactored to allow a more
    modular approach.

    Changes
    * adding an option to the raw binary dispatch routine to allow
      requesting of context authentication
    * adding a new swift client method to create a connection with an auth
      token
    * adding a new binary retriever function to use the context auth token
    * refactoring the internal swift retrievers module to be more modular
    * adding tests for all internal swift retrievers
    * adding a new test suite for binary dispatch

    Change-Id: I5e3ce1c9b61d4e2043a15702cbcc9225f9924d44
    Closes-Bug: 1384889

Changed in sahara:
status: In Progress → Fix Committed
Changed in sahara:
milestone: none → kilo-2
Thierry Carrez (ttx)
Changed in sahara:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in sahara:
milestone: kilo-2 → 2015.1.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.