Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python-irodsclient needs different irods_authentication_scheme than iCommands in iRODS 4.3.0. #430

Closed
jefscheepers opened this issue Feb 10, 2023 · 6 comments

Comments

@jefscheepers
Copy link

Since iRODS 4.3.0., iCommands require the irods_authentication_scheme to be 'pam_password' instead of 'PAM' in the irods_environment.json if you are using PAM.

However, the Python-irodsclient still seems to require 'PAM', even if the server is 4.3.0.
This means that on a 4.3.0., users cannot use the same irods_environment.json for iCommands and the Python client.

This is inconvenient for two reasons:

  • A lot of users use iCommands next to the python-irodsclient to quickly be able to check the effect of their scripts etc.
  • Authenticating with iinit is for Linux the easiest way to authenticate for the Python-irodsclient

Could some changes be made so that the Python-irodsclient also accepts 'pam_password'?

Slightly related to:
irods/irods#3164
irods/irods#6785
#370

@alanking
Copy link
Contributor

We are hoping to integrate the authentication plugin framework for PRC and other clients in the near future which would allow for using the new authentication scheme.

@d-w-moore - What do you think about adding a shim for the pam_password authentication scheme from the client environment until we are able to port the authentication plugin framework to python?

@korydraughn
Copy link
Contributor

When you say shim, are you saying to have the PRC accept pam_password as an alias for PAM?

@alanking
Copy link
Contributor

Right, until we get the framework ported over. It could possibly trip up users and admins depending on how it's implemented, so it might be better to just prioritize porting the authentication framework.

@korydraughn
Copy link
Contributor

I think prioritizing the porting of the auth framework is the right way to go. I sense that making the PRC treat pam_password like PAM will lead to confusion for users.

With that said, let's aim at starting the port next week.

@d-w-moore
Copy link
Collaborator

I'd have agreed to a shim as well, maybe , but I guess a port is cleaner? Yes, let's look into it next week.

d-w-moore added a commit to d-w-moore/python-irodsclient that referenced this issue Jan 11, 2024
@alanking
Copy link
Contributor

@d-w-moore - I think that the workaround to use the legacy auth plugins is working as of #461. The client-driven authentication flow will be implemented in #499. If agreed, please close when ready.

d-w-moore added a commit to d-w-moore/python-irodsclient that referenced this issue Jan 18, 2024
@trel trel added this to the 2.0.0 milestone Feb 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

5 participants