Add sendgrid username/password authentication - #1297
Merged
Conversation
This change fixes an issue where the Azure PaaS deployments were unable to send mail via Sendgrid. The issue was caused by the fact that the Sendgrid API assumes authentication via an API key, but in the ARM template we only have access to the Sendgrid account admin username and password. Due to the limitations of the ARM template format, it's difficult to automatically generate the API key outside of the OKpy application during the deployment: we'd have to spin up an Azure Container Instances deployment, generate the key in the container, upload it to a storage like Key Vault and then access the key from the OKpy application. Reading configuration from a storage like Key Vault instead of environment variables would be a non-trivial change to OKpy so this commit implements a more pragmatic work-around: generate a new API key on the fly at runtime given the Sendgrid admin credentials. The key is cached for the lifetime of the server so this shouldn't add overhead past the first email sent. Note that the Sendgrid API has a limit on 100 API keys so we always ensure to auto-create at most one API key for OKpy and delete any old copies of the key before creating a new one (this would happen when the OKpy server is restarted since any auto-created API key only is persisted in the server memory). Another nice property of this change is that it's now possible to authenticate to Sendgrid in OKpy in the same way as we do in AutoPY.
Contributor
Author
|
CC @marrobi since this affects the ARM templates. |
colinschoen
approved these changes
Jun 27, 2018
| if not response.ok: | ||
| raise ValueError('unable to list sendgrid api keys') | ||
|
|
||
| existing_key = next((key['api_key_id'] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change fixes an issue where the Azure PaaS deployments were unable
to send mail via Sendgrid.
The issue was caused by the fact that the Sendgrid API assumes
authentication via an API key, but in the ARM template we only have
access to the Sendgrid account admin username and password. Due to the
limitations of the ARM template format, it's difficult to automatically
generate the API key outside of the OKpy application during the
deployment: we'd have to spin up an Azure Container Instances
deployment, generate the key in the container, upload it to a storage
like Key Vault and then access the key from the OKpy application.
Reading configuration from a storage like Key Vault instead of
environment variables would be a non-trivial change to OKpy so this
commit implements a more pragmatic work-around: generate a new API key
on the fly at runtime given the Sendgrid admin credentials. The key is
cached for the lifetime of the server so this shouldn't add overhead
past the first email sent.
Note that the Sendgrid API has a limit on 100 API keys so we always
ensure to auto-create at most one API key for OKpy and delete any old
copies of the key before creating a new one (this would happen when the
OKpy server is restarted since any auto-created API key only is
persisted in the server memory).
Another nice property of this change is that it's now possible to
authenticate to Sendgrid in OKpy in the same way as we do in AutoPY.