1332154 - change autoland to use bmo api-key for authentication instead of password

Status: RESOLVED FIXED

(Conduit Graveyard :: Transplant, defect, P1)

Description

[:glob ✱]

when autoland posts transplant results to review board it uses bugzilla username+password to authenticate.

as this is deprecated (rightly so) we need to switch to api-key auth.

Comment 1

[:glob ✱]

Attachment: autoland: support both user/pass and user/api-key auth (bug 1332154)

Adds support api-key authentication over HTTP basic auth by checking for an
"apikey%" prefix to the username.  If present, the api-key is expected to be in
the password field.  eg. "[e-mail]"

This allows clients to trivially migrate from the deprecated user/password
authentication to api-keys.

Review commit: https://reviewboard.mozilla.org/r/108730/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/108730/

Comment 2

[Steven MacLeod [:smacleod]]

Comment on attachment 8832452 [details]
autoland: support both user/pass and user/api-key auth (bug 1332154)

https://reviewboard.mozilla.org/r/108730/#review111584

RB has support for plugging API authentication methods, which is what we should use if going down this path. Alternatively we already have an API key login endpoint that is used by things like the review repo, take a look at how it logs in.

Comment 3

[:glob ✱]

Comment on attachment 8832452 [details]
autoland: support both user/pass and user/api-key auth (bug 1332154)

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/108730/diff/1-2/

Comment 4

[Steven MacLeod [:smacleod]]

Comment on attachment 8832452 [details]
autoland: support both user/pass and user/api-key auth (bug 1332154)

https://reviewboard.mozilla.org/r/108730/#review115998

::: autoland/autoland/mozreview.py:56
(Diff revision 2)
> +    """Username/API-Key authentication."""
> +
> +    _cookies = {}
> +
> +    def headers(self, pingback_url):
> +        """Track cookies for each Review Board instance."""

Doesn't have to be Review Board, it'll be hitting new autoland sometime in the future.

::: autoland/autoland/mozreview.py:62
(Diff revision 2)
> +        url = urlparse.urlparse(pingback_url)
> +        host = url.netloc
> +
> +        if host not in self._cookies:
> +            # Authenticate using api-key to get session cookie. This cannot
> +            # happen with the object is created, as requests may issue

"with the object is", when?

Comment 5

[:glob ✱]

Comment on attachment 8832452 [details]
autoland: support both user/pass and user/api-key auth (bug 1332154)

https://reviewboard.mozilla.org/r/108730/#review116224

::: autoland/autoland/mozreview.py:56
(Diff revision 2)
> +    """Username/API-Key authentication."""
> +
> +    _cookies = {}
> +
> +    def headers(self, pingback_url):
> +        """Track cookies for each Review Board instance."""

the current code is review board specific, both in how auth is done and the endpoints hit.

we can update the comments to reflect the new world at the same time the code is updated.

Comment 6

[:glob ✱]

Comment on attachment 8832452 [details]
autoland: support both user/pass and user/api-key auth (bug 1332154)

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/108730/diff/2-3/

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/0f9f77b77d3b
autoland: support both user/pass and user/api-key auth r=smacleod