configDB HTTP Authentication Notes

Requirements

configDB web service routines with no authentication required

def svc_get_version(configroot):
def svc_get_hutches(configroot):
def svc_get_device_configs(configroot):
def svc_get_aliases(configroot, hutch):
def svc_get_devices(configroot, hutch, alias):
def svc_get_configuration(configroot, hutch, alias, device):
def svc_print_device_configs(configroot, name):
def svc_print_configs(configroot, hutch):
def svc_get_history(configroot, hutch, alias, device):

configDB web service routines with authentication required

def svc_get_key(configroot, hutch):
def svc_add_alias(configroot, hutch, alias):
def svc_add_device_config(configroot, cfg):
def svc_modify_device(configroot, hutch, alias):
def svc_create_collections(configroot, hutch):

Three levels of authentication supported

URL Prefix	Authentication Level	Permissions	Notes
https://pswww.slac.stanford.edu/ws-kerb/devconfigdb/ws/	Kerberos authentication	R/W	Kerberos ticket required
https://pswww.slac.stanford.edu/ws-auth/devconfigdb/ws/	Basic authentication	R/W	Hutch operator (xppopr etc.)
https://pswww.slac.stanford.edu/ws/devconfigdb/ws/	No authentication	Read

Unit Tests

Kerberos Authentication

With and Without Kerberos Ticket

$ kdestroy -A
$ klist
klist: No credentials cache found (filename: /tmp/krb5cc_10218_avASDVDKU7)
$ configdb --url https://pswww.slac.stanford.edu/ws-kerb/devconfigdb/ws/ cp SXR/BEAM/trigger_2 SXR/BEAM/trigger_6
ERROR:root:(('Unspecified GSS failure.  Minor code may provide more information', 851968), ('No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_10218_avASDVDKU7)', -1765328243))
failed to transfer configuration
$ 
$ kinit
Password for caf@SLAC.STANFORD.EDU: 
$ 
$ configdb --url https://pswww.slac.stanford.edu/ws-kerb/devconfigdb/ws/ cp SXR/BEAM/trigger_2 SXR/BEAM/trigger_6
$ 
$ configdb cat SXR/BEAM/trigger_6 > /tmp/trigger_6.txt
$ configdb cat SXR/BEAM/trigger_2 > /tmp/trigger_2.txt
$ 
$ diff -C 2 /tmp/trigger_2.txt /tmp/trigger_6.txt
*** /tmp/trigger_2.txt  2020-04-16 17:57:29.218408467 -0700
--- /tmp/trigger_6.txt  2020-04-16 17:57:09.806479631 -0700
***************
*** 19,23 ****
   'cam': 0,
   'detId:RO': 'No serial number',
!  'detName:RO': 'trigger_2',
   'detType:RO': 'trigger',
   'doc:RO': 'No comment',
--- 19,23 ----
   'cam': 0,
   'detId:RO': 'No serial number',
!  'detName:RO': 'trigger_6',
   'detType:RO': 'trigger',
   'doc:RO': 'No comment',
$

Basic Authentication

With and Without Valid User Name

$ python
Python 3.7.7 (default, Mar 23 2020, 22:36:06)
[GCC 7.3.0] :: Anaconda, Inc. on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import psalg.configdb.configdb as cdb
>>> mycdb = cdb.configdb('https://pswww.slac.stanford.edu/ws-auth/devconfigdb/ws/', 'tst', root='configDB', user='xppopr')
>>> mycdb.get_key()
126
>>> yourcdb = cdb.configdb('https://pswww.slac.stanford.edu/ws-auth/devconfigdb/ws/', 'tst', root='configDB', user='smoothopr')
>>> yourcdb.get_key()
ERROR:root:Web server error: 401 Client Error: Unauthorized for url: https://pswww.slac.stanford.edu/ws-auth/devconfigdb/ws/configDB/get_key/tst/
[]
>>>

How To Bypass the HTTP Interface

mongoconfig.py Usage Example

>>> import psalg.configdb.mongoconfigdb as cdb
>>> mikecdb = cdb.configdb("mcbrowne:psana@psdb-dev:9306", 'SXR', root='configDB')
>>> mikecdb.get_aliases("tst")
['NOBEAM', 'BEAM']
>>>

Page tree