1249149 - Add SSH command to associate LDAP account with MozReview

Status: RESOLVED FIXED

(MozReview Graveyard :: General, defect, P1)

Description

[Gregory Szorc [:gps]]

The proper fix for bug 1239815 is somewhat involved. As a quick hack, let's deploy an SSH command that will associate the authenticated SSH/LDAP account with MozReview. That way, people can run `ssh reviewboard-hg.mozilla.org associate-ldap-account` or some such and magic ensues.

Making P1 because Git users aren't able to use Try/Autoland until we can associate LDAP accounts.

Comment 1

[Gregory Szorc [:gps]]

Attachment: MozReview Request: hgserver: pash command to associate LDAP account with MozReview (bug 1249149); r?dminor

In terms of security and compatibility with existing workflows, the easiest way to
associate a LDAP account with MozReview is over SSH. This is because an
SSH connection proves ownership of that LDAP account and SSH is already
how we associate LDAP accounts today.

This commit introduces a pash SSH command for associating an LDAP
account with MozReview. It prompts for a Bugzilla username and API Key
then makes a HTTP request to Review Board's LDAP association web API.

Everything behaves just like LDAP association is currently done except
we're not doing it from a Mercurial context.

We introduce a standalone script for performing the HTTP request because
Pash is a Python 2.6 process running out of the system Python
installation and therefore doesn't have access to the Review Board
Python package. We run the script out of the Python 2.7 virtualenv,
which is where pash-invoked `hg` processes run out of.

Comprehensive tests of the new functionality have been added.

Documentation has also been added.

We've talked about performing a reverse LDAP search to automatically
associate LDAP accounts. However, this may not always work (e.g. not
all users may have Bugzilla metadata registered in LDAP). So, a manual
solution (which this commit provides) will likely always need to exist.
While the manual association in this commit isn't the most turn-key,
it does unblock HTTP pushers (including all Git users) from not being
able to use several MozReview features. Hopefully that will be enough
until the LDAP search functionality is deployed (if ever).

Review commit: https://reviewboard.mozilla.org/r/35381/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/35381/

Comment 2

[Gregory Szorc [:gps]]

Comment on attachment 8720621 [details]
MozReview Request: hgserver: pash command to associate LDAP account with MozReview (bug 1249149); r?dminor

kang: I don't anticipate any major concerns with this feature. But I thought I'd run it by you just in case.

Comment 3

[Dan Minor [:dminor]]

Comment on attachment 8720621 [details]
MozReview Request: hgserver: pash command to associate LDAP account with MozReview (bug 1249149); r?dminor

https://reviewboard.mozilla.org/r/35381/#review32291

Sorry for the delay in reviewing this.

::: hgserver/pash/hg_helper.py:504
(Diff revision 1)
> +        print('error reading Mercurial config; please report this error')

Unless there's a good reason not to, we should display the backtrace here so it can be reported in a bug.

::: scripts/mozreview-associate-ldap:18
(Diff revision 1)
> +

nit: two blank lines here please.

Comment 4

[Gregory Szorc [:gps]]

https://hg.mozilla.org/hgcustom/version-control-tools/rev/5e7da07ff6ee24e424fe86cd4180b3c870ef3404
hgserver: pash command to associate LDAP account with MozReview (bug 1249149); r=dminor

Comment 5

[Gregory Szorc [:gps]]

https://reviewboard.mozilla.org/r/35381/#review32291

> Unless there's a good reason not to, we should display the backtrace here so it can be reported in a bug.

There is a good reason to: security. I'm paranoid that backtraces print file content, which may include passwords. I'll add an inline comment.

Comment 6

[Gregory Szorc [:gps]]

I'll hold off deploying this until next week since it is late'ish on a Friday and I'm not sure @ is safe to deploy since a number of other things have landed.

Comment 7

[Gregory Szorc [:gps]]

This is deployed.