Merge lp:~stub/charms/trusty/cassandra/noauthentication into lp:~stub/charms/trusty/cassandra/ulimit-warning

[Stuart Bishop]

Allow use of the AllowAllAuthenticator, turning off authentication entirely. This is needed for legacy applications which have no facility to provide authentication credentials.

[lp:~stub/charms/trusty/cassandra/noauthentication]

428. By Stuart Bishop on 2015-11-04

Fix tests with Juju 1.25

429. By Stuart Bishop on 2015-11-12

Fix test command return code

430. By Stuart Bishop on 2015-11-13

Fix a better hidden failure from Juju 1.25 unit numbering changes

431. By Stuart Bishop on 2015-11-13

Fix remaining AllowAllAuthenticator tests

432. By Stuart Bishop on 2015-11-20

Handle rogue cqlshrc files from previous installs

Unmerged revisions

432. By Stuart Bishop on 2015-11-20

Handle rogue cqlshrc files from previous installs

431. By Stuart Bishop on 2015-11-13

Fix remaining AllowAllAuthenticator tests

430. By Stuart Bishop on 2015-11-13

Fix a better hidden failure from Juju 1.25 unit numbering changes

429. By Stuart Bishop on 2015-11-12

Fix test command return code

428. By Stuart Bishop on 2015-11-04

Fix tests with Juju 1.25

427. By Stuart Bishop on 2015-10-27

no auth tests

426. By Stuart Bishop on 2015-10-27

Fix unittests

425. By Stuart Bishop on 2015-10-27

Get AllowAllAuthenticator working

424. By Stuart Bishop on 2015-10-27

Merge ulimit-warning

423. By Stuart Bishop on 2015-10-27

Turn off code paths requiring authentication

=== modified file 'Makefile'
--- Makefile	2015-08-19 09:57:40 +0000
+++ Makefile	2015-10-27 15:23:26 +0000
@@ -82,6 +82,13 @@
 	AMULET_TIMEOUT=7200 \
 	$(NOSETESTS) tests.test_integration:Test3UnitDeployment 2>&1 | ts
 
+authtest: unittest TestAllowAllAuthenticatorDeployment
+TestAllowAllAuthenticatorDeployment: deps
+	date
+	AMULET_TIMEOUT=7200 \
+	$(NOSETESTS) \
+	tests.test_integration:TestAllowAllAuthenticatorDeployment 2>&1 | ts
+
 # Place a copy of the Oracle Java SE 7 Server Runtime tarball in ./lib
 # to run these tests.
 jretest: unittest

=== modified file 'config.yaml'
--- config.yaml	2015-06-23 11:32:12 +0000
+++ config.yaml	2015-10-27 15:23:26 +0000
@@ -242,7 +242,14 @@
         default: 7001
         description: >
             Cluster secure communication port. TODO: Unused. configure SSL.
-
+    authenticator:
+        type: string
+        default: PasswordAuthenticator
+        description: >
+            Authentication backend. Only PasswordAuthenticator and
+            AllowAllAuthenticator are supported. You should only
+            use AllowAllAuthenticator for legacy applications that
+            cannot provide authentication credentials.
     authorizer:
         type: string
         default: AllowAllAuthorizer

=== modified file 'hooks/actions.py'
--- hooks/actions.py	2015-10-27 11:32:00 +0000
+++ hooks/actions.py	2015-10-27 15:23:26 +0000
@@ -59,6 +59,7 @@
     'num_tokens',
     'max_heap_size',
     'heap_newsize',
+    'authenticator',
     'authorizer',
     'compaction_throughput_mb_per_sec',
     'stream_throughput_outbound_megabits_per_sec',
@@ -115,6 +116,21 @@
     return wrapper
 
 
+def authentication(func):
+    '''Decorated function is skipped if authentication is disabled.'''
+    @wraps(func)
+    def wrapper(*args, **kw):
+        auth = hookenv.config()['authenticator']
+        if auth == 'PasswordAuthenticator':
+            return func(*args, **kw)
+        elif auth == 'AllowAllAuthenticator':
+            hookenv.log('Skipped. Authentication disabled.', DEBUG)
+            return None
+        helpers.status_set('blocked', 'Unknown authenticator {}'.format(auth))
+        raise SystemExit(0)
+    return wrapper
+
+
 @action
 def set_proxy():
     config = hookenv.config()
@@ -432,6 +448,7 @@
 
 @leader_only
 @action
+@authentication
 @coordinator.require('repair', needs_reset_auth_keyspace_replication)
 def reset_auth_keyspace_replication():
     # Cassandra requires you to manually set the replication factor of
@@ -482,8 +499,8 @@
 
     # If our IP address has changed, we need to restart.
     if config.changed('unit_private_ip'):
-        hookenv.log('waiting',
-                    'IP address changed. Waiting for restart permission.')
+        helpers.status_set('waiting', 'IP address changed. '
+                           'Waiting for restart permission.')
         return True
 
     # If the directory paths have changed, we need to migrate data
@@ -574,6 +591,7 @@
 
 @leader_only
 @action
+@authentication
 def create_unit_superusers():
     # The leader creates and updates accounts for nodes, using the
     # encrypted password they provide in relations.PeerRelation. We
@@ -702,7 +720,7 @@
 @action
 def emit_cluster_info():
     helpers.emit_describe_cluster()
-    helpers.emit_auth_keyspace_status()
+    helpers.emit_status()
     helpers.emit_netstats()
 
 
@@ -852,6 +870,7 @@
 
 @leader_only
 @action
+@authentication
 def reset_default_password():
     if hookenv.leader_get('default_admin_password_changed'):
         hookenv.log('Default admin password already changed')
@@ -911,6 +930,7 @@
 
 
 @action
+@authentication
 def request_unit_superuser():
     relid = helpers.peer_relid()
     if relid is None:

=== modified file 'hooks/definitions.py'
--- hooks/definitions.py	2015-10-22 08:44:52 +0000
+++ hooks/definitions.py	2015-10-27 15:23:26 +0000
@@ -109,7 +109,10 @@
 
         if helpers.is_cassandra_running():
             hookenv.log('Cassandra is running')
-            if hookenv.local_unit() in helpers.get_unit_superusers():
+            auth = hookenv.config()['authenticator']
+            if auth == 'AllowAllAuthenticator':
+                return True
+            elif hookenv.local_unit() in helpers.get_unit_superusers():
                 hookenv.log('Credentials created')
                 return True
             else:

=== modified file 'hooks/helpers.py'
--- hooks/helpers.py	2015-09-11 05:07:47 +0000
+++ hooks/helpers.py	2015-10-27 15:23:26 +0000
@@ -459,8 +459,12 @@
     if username is None or password is None:
         username, password = superuser_credentials()
 
-    auth_provider = cassandra.auth.PlainTextAuthProvider(username=username,
-                                                         password=password)
+    auth = hookenv.config()['authenticator']
+    if auth == 'AllowAllAuthenticator':
+        auth_provider = None
+    else:
+        auth_provider = cassandra.auth.PlainTextAuthProvider(username=username,
+                                                             password=password)
 
     # Although we specify a reconnection_policy, it does not apply to
     # the initial connection so we retry in a loop.
@@ -519,6 +523,10 @@
 @logged
 def ensure_user(session, username, encrypted_password, superuser=False):
     '''Create the DB user if it doesn't already exist & reset the password.'''
+    auth = hookenv.config()['authenticator']
+    if auth == 'AllowAllAuthenticator':
+        return  # No authentication means we cannot create users
+
     if superuser:
         hookenv.log('Creating SUPERUSER {}'.format(username))
     else:
@@ -683,7 +691,7 @@
     # Using the same name is preferred to match the actual Cassandra
     # documentation.
     simple_config_keys = ['cluster_name', 'num_tokens',
-                          'partitioner', 'authorizer',
+                          'partitioner', 'authorizer', 'authenticator',
                           'compaction_throughput_mb_per_sec',
                           'stream_throughput_outbound_megabits_per_sec',
                           'tombstone_warn_threshold',
@@ -704,11 +712,6 @@
     dirs = get_all_database_directories()
     cassandra_yaml.update(dirs)
 
-    # The charm only supports password authentication. In the future we
-    # may also support AllowAllAuthenticator. I'm not sure if others
-    # such as Kerboros can be supported or are useful.
-    cassandra_yaml['authenticator'] = 'PasswordAuthenticator'
-
     # GossipingPropertyFileSnitch is the only snitch recommended for
     # production. It we allow others, we need to consider how to deal
     # with the system_auth keyspace replication settings.
@@ -745,7 +748,7 @@
             # is not running.
             os.kill(pid, 0)
 
-            if subprocess.call(["nodetool", "status", "system_auth"],
+            if subprocess.call(["nodetool", "status"],
                                stdout=subprocess.DEVNULL,
                                stderr=subprocess.DEVNULL) == 0:
                 hookenv.log(
@@ -870,9 +873,9 @@
 
 
 @logged
-def emit_auth_keyspace_status():
-    '''Run 'nodetool status system_auth' for the logs.'''
-    nodetool('status', 'system_auth')  # Implicit emit
+def emit_status():
+    '''Run 'nodetool status' for the logs.'''
+    nodetool('status')  # Implicit emit
 
 
 @logged
@@ -883,7 +886,7 @@
 
 def emit_cluster_info():
     emit_describe_cluster()
-    emit_auth_keyspace_status()
+    emit_status()
     emit_netstats()
 
 

=== modified file 'tests/test_actions.py'
--- tests/test_actions.py	2015-09-10 07:22:22 +0000
+++ tests/test_actions.py	2015-10-27 15:23:26 +0000
@@ -833,7 +833,7 @@
         self.assertIn(expected, contents)
 
     @patch('helpers.emit_netstats')
-    @patch('helpers.emit_auth_keyspace_status')
+    @patch('helpers.emit_status')
     @patch('helpers.emit_describe_cluster')
     def test_emit_cluster_info(self, emit_desc, emit_status, emit_netstats):
         actions.emit_cluster_info('')

=== modified file 'tests/test_helpers.py'
--- tests/test_helpers.py	2015-09-04 11:12:27 +0000
+++ tests/test_helpers.py	2015-10-27 15:23:26 +0000
@@ -890,7 +890,7 @@
         is_running.return_value = True
         backoff.return_value = repeat(True)
         check_output.side_effect = iter(['ONE Error: stuff', 'TWO OK'])
-        self.assertEqual(helpers.nodetool('status', 'system_auth'), 'TWO OK')
+        self.assertEqual(helpers.nodetool('status'), 'TWO OK')
 
         # The output was emitted.
         helpers.emit.assert_called_once_with('TWO OK')
@@ -908,7 +908,7 @@
             subprocess.CalledProcessError([], 1, 'fail 4'),
             subprocess.CalledProcessError([], 1, 'fail 5'),
             'OK'])
-        self.assertEqual(helpers.nodetool('status', 'system_auth'), 'OK')
+        self.assertEqual(helpers.nodetool('status'), 'OK')
 
         # Later fails and final output was emitted.
         helpers.emit.assert_has_calls([call('fail 5'), call('OK')])
@@ -1261,9 +1261,9 @@
         nodetool.assert_called_once_with('describecluster')
 
     @patch('helpers.nodetool')
-    def test_emit_auth_keyspace_status(self, nodetool):
-        helpers.emit_auth_keyspace_status()
-        nodetool.assert_called_once_with('status', 'system_auth')
+    def test_emit_status(self, nodetool):
+        helpers.emit_status()
+        nodetool.assert_called_once_with('status')
 
     @patch('helpers.nodetool')
     def test_emit_netstats(self, nodetool):

=== modified file 'tests/test_integration.py'
--- tests/test_integration.py	2015-08-19 09:57:40 +0000
+++ tests/test_integration.py	2015-10-27 15:23:26 +0000
@@ -314,7 +314,6 @@
                         found = set(contents['directories'])
                         self.assertIn(keyspace, found)
                         self.assertIn('system', found)
-                        self.assertIn('system_auth', found)
                         break
                     except Exception:
                         if time.time() > timeout:
@@ -544,6 +543,23 @@
         super(TestDSEDeployment, cls).setUpClass()
 
 
+class TestAllowAllAuthenticatorDeployment(Test3UnitDeployment):
+    test_config = dict(authenticator='AllowAllAuthenticator')
+
+    def client_session(self, relname):
+        '''A session using invalid credentials.'''
+        relinfo = self.get_client_relinfo(relname)
+        self.assertIn('host', relinfo.keys())
+        cluster = self.cluster('random', 'nonsense',
+                               [relinfo['host']],
+                               int(relinfo['native_transport_port']))
+        session = cluster.connect()
+        self.addCleanup(session.shutdown)
+        return session
+
+    test_default_superuser_account_closed = None
+
+
 class Test20Deployment(Test1UnitDeployment):
     """Tests run on a single node Apache Cassandra 2.0 cluster.
     """

=== modified file 'tests/tests.yaml'
--- tests/tests.yaml	2015-06-29 10:09:24 +0000
+++ tests/tests.yaml	2015-10-27 15:23:26 +0000
@@ -10,3 +10,4 @@
     - Test1UnitDeployment
     - Test3UnitDeployment
     - Test20Deployment
+    - TestAllowAllAuthenticatorDeployment