906983 - Let WhoAuthenticator work better with generic auth plugins

Status: VERIFIED FIXED

(Cloud Services :: Server: Core, defect)

Description

[Ryan Kelly [:rfkelly]]

Attachment: server-core patch to play nicer with generic auth plugins

Currently the services.whoauth.WhoAuthenticator class assumes that authentication plugins will provide both a numeric "userid" and a textual "username".  Most plugins actually dont; when we wrote this, we figured we'd be using a bunch of custom plugins that do.

In support of a tokenserver-enabled sync1.1 cluster, let's make the WhoAuthenticator work a little harder to accept identity dicts from generic auth plugins.  If there stuff in the dict that can reasonably be assumed to be a userid or username, use that rather than erroring out.

So it'll play nicer with a generic token-based auth plugin like...say...this one: https://github.com/mozilla-services/repoze.who.plugins.hawkauth

Comment 1

[Toby Elliott [:telliott]]

Comment on attachment 792544 [details] [diff] [review]
server-core patch to play nicer with generic auth plugins

So, this is fine as an interim approach for dev. But it feels a little wrong as a long-term solution. If we're going to embrace an identity framework (which we clearly are), we should use it throughout the product rather than hack a translation wrapper around the framework for nothing beyond historical reasons. 

This is especially true as we move towards abandoning most of the reasons for the original structure (as we'll no longer need to maintain user accounts in the same way we used to). Or, to put it another way - if you were building 2.0 without starting at 1.0, is this the auth class structure you would use? A good opportunity to revisit.

Comment 2

[Ryan Kelly [:rfkelly]]

Committed in http://hg.mozilla.org/services/server-core/rev/a2ade9c44055

Per IRL discussion today, I completely agree that this is not the best way forward, and this is only a quick-fix to get a dev environment running.

Comment 3

[James Bonacci [:jbonacci]]

By Dev environment, are you referring to *.oldsync.dev.lcip.org here?

Comment 4

[Ryan Kelly [:rfkelly]]

:jbonacci correct

Comment 5

[James Bonacci [:jbonacci]]

Dev environment has been running for some time.
I am closing this.