add whoami command #535

abbra · 2017-03-02T17:12:54Z

ipa whoami command allows to query details about currently
authenticated identity. The command returns following information:

object class name
function to call to get actual details about the object
arguments to pass to the function
options to pass to the function

There are five types of objects that could bind to IPA using their
credentials. ipa whoami call expects one of the following:

users
staged users
hosts
Kerberos services
ID user override from the default trust view

The latter category of objects is automatically mapped by SASL GSSAPI
mapping rule in 389-ds for users from trusted Active Directory forests.

The command is expected to be used by Web UI to define proper view for
the authenticated identity.

Below is an example of how communication looks like for an Active
Directory user which has ID override in 'Default Trust View'.

$ ipa -vv whoami
ipa: INFO: trying https://ipa.example.com/ipa/session/json
ipa: INFO: Forwarding 'whoami/1' to json server 'https://ipa.example.com/ipa/session/json'
ipa: INFO: Request: {
    "id": 0,
    "method": "whoami/1",
    "params": [
        [],
        {
            "version": "2.220"
        }
    ]
}
ipa: INFO: Response: {
    "error": null,
    "id": 0,
    "principal": "Administrator@AD.DOMAIN",
    "result": {
        "arguments": [
            "default trust view",
            "administrator@ad.domain"
        ],
        "details": "idoverrideuser_show/1",
        "object": "idoverrideuser",
        "options": []
    },
    "version": "<IPA VERSION>"
}

Fixes https://pagure.io/freeipa/issue/6643

abbra · 2017-03-02T17:13:06Z

Design page: http://www.freeipa.org/page/V4/Who_Am_I_Command

stlaz · 2017-03-08T14:57:08Z

I believe that in CLI ipa whoami should actually output the output of the command it found with the arguments and options it found since in WebUI this is eventually done as well.
I can go ahead and try to implement it if we can agree on such behavior.

abbra · 2017-03-08T14:59:53Z

Uhm, no, I don't want that. It makes the command behaving differently depending on a context and that would be broken. For client-side plugin that would also be an abuse of interface, I'd say.

stlaz · 2017-03-08T15:32:01Z

Ok. It just doesn't seem right to have a command which shows something that's not immediately useful to the user. I am not sure whether we should have it enabled for CLI.

abbra · 2017-03-08T16:11:11Z

We can disable it for CLI, that's not a problem.

stlaz · 2017-03-09T08:17:23Z

ipaserver/plugins/whoami.py

+__doc__ = _("""
+Return a description of currently authenticated identity
+
+Who am I command returns information on who to get


Major nitpick: I believe you meant "...returns information on how to get..."

stlaz · 2017-03-09T08:18:17Z

ipaserver/plugins/whoami.py

+
+    output_params = (
+        Str('object', label=_('Object class name')),
+        Str('details', label= _('Function to get details')),


Please call the param "command" instead of "details", it's much more descriptive. "details" does not mean anything.

stlaz · 2017-03-09T08:21:05Z

ipaserver/plugins/whoami.py

+        object that handles the container where this DN belongs to. Then report
+        details about this object.
+        """
+        exceptions = dict(


For the future: dict() should generally be avoided for CPython and {} should be used instead to init dictionaries.

stlaz · 2017-03-09T08:23:45Z

ipaserver/plugins/whoami.py

+        o_func = None
+        o_args = []
+        o_opts = []
+        for o in api.Object():


I think you don't need to init api.Object() here but that does not matter much so feel free to leave it there.

There is no need to init it because api is fully initialized already at the point when any plugin command is run. api.Object() returns an iterator, it is not a class constructor.

stlaz · 2017-03-09T09:10:21Z

ipaserver/plugins/whoami.py

+                # We found exact container this DN belongs to
+                o_name = unicode(o.name)
+                o_args = [unicode(entry.single_value.get(o.primary_key.name))]
+                o_opts = []


There is no reason to have options in the output since you never add anything there, please, remove it.

On further thinking I removed it.

stlaz · 2017-03-09T09:20:46Z

Please, disable the command for CLI since by itself it does not bring any valuable information to the user, in my opinion it can only confuse them. It'll be easier to turn it on if there's a demand for it rather than turning it off if it confuses some people.
Also, please rename the details part of output to command as that's what it really is, details is confusing.
Please, also remove the options from the output since it's not currently used. I hope it's safe to assume that new output parameters can be added at any time.
You don't need to bother much with the other comments I left, there're more important things to do now than fiddling with docs and minor performance issues.

abbra · 2017-03-09T10:12:12Z

Updated.

stlaz · 2017-03-09T12:15:13Z

@abbra Thank you for the changes, the patch seems fine now. I tested the user/service/host scenarios and it worked fine. I couldn't test idviews since trusts are broken now but I assume it should work fine as well.
If you could only apply the following patch https://transfer.sh/IA7Ic/0001-improve-one-more-dict.patch which improves the last dict() behavior then I'll bless this patch :)
We may want to add some tests later so I will propose to leave the ticket open.

Whoami command allows to query details about currently authenticated identity. The command returns following information: * object class name * function to call to get actual details about the object * arguments to pass to the function There are five types of objects that could bind to IPA using their credentials. `ipa whoami` call expects one of the following: * users * staged users * hosts * Kerberos services * ID user override from the default trust view The latter category of objects is automatically mapped by SASL GSSAPI mapping rule in 389-ds for users from trusted Active Directory forests. The command is expected to be used by Web UI to define proper view for the authenticated identity. It is not visible in the command line interface is `ipa` command. Below is an example of how communication looks like for a host principal: # kinit -k # ipa console (Custom IPA interactive Python console) >>> api.Command.whoami() {u'command': u'host_show/1', u'object': u'host', u'arguments': (u'ipa.example.com',)} >>> Fixes https://pagure.io/freeipa/issue/6643

abbra · 2017-03-09T12:38:52Z

Done. I've also updated the design page to reflect the changes.

stlaz · 2017-03-09T12:59:20Z

Thank you, ACK. Please don't close the ticket, we still need tests.

MartinBasti · 2017-03-09T13:10:31Z

master:

381c1c7 add whoami command

MartinBasti · 2017-03-09T13:13:09Z

Tests: https://pagure.io/freeipa/issue/6745

stlaz self-assigned this Mar 7, 2017

stlaz requested changes Mar 9, 2017

View reviewed changes

abbra force-pushed the whoami branch 2 times, most recently from 4a8a7f8 to 8813bd2 Compare March 9, 2017 10:08

abbra force-pushed the whoami branch from 8813bd2 to f368e07 Compare March 9, 2017 12:26

stlaz approved these changes Mar 9, 2017

View reviewed changes

stlaz added the ack Pull Request approved, can be merged label Mar 9, 2017

MartinBasti added the pushed Pull Request has already been pushed label Mar 9, 2017

MartinBasti closed this Mar 9, 2017

add whoami command #535

add whoami command #535

abbra commented Mar 2, 2017 •

edited by MartinBasti

abbra commented Mar 2, 2017

stlaz commented Mar 8, 2017

abbra commented Mar 8, 2017

stlaz commented Mar 8, 2017

abbra commented Mar 8, 2017

stlaz Mar 9, 2017

abbra Mar 9, 2017

stlaz Mar 9, 2017

stlaz Mar 9, 2017

abbra Mar 9, 2017

stlaz Mar 9, 2017

abbra Mar 9, 2017

stlaz Mar 9, 2017

abbra Mar 9, 2017

stlaz commented Mar 9, 2017

abbra commented Mar 9, 2017

stlaz commented Mar 9, 2017

abbra commented Mar 9, 2017

stlaz commented Mar 9, 2017

MartinBasti commented Mar 9, 2017

MartinBasti commented Mar 9, 2017

add whoami command #535

add whoami command #535

Conversation

abbra commented Mar 2, 2017 • edited by MartinBasti

abbra commented Mar 2, 2017

stlaz commented Mar 8, 2017

abbra commented Mar 8, 2017

stlaz commented Mar 8, 2017

abbra commented Mar 8, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stlaz commented Mar 9, 2017

abbra commented Mar 9, 2017

stlaz commented Mar 9, 2017

abbra commented Mar 9, 2017

stlaz commented Mar 9, 2017

MartinBasti commented Mar 9, 2017

MartinBasti commented Mar 9, 2017

abbra commented Mar 2, 2017 •

edited by MartinBasti