[v7r3] login with tokens (first part of the #5045)

dirac.cfg

@@ -57,6 +57,9 @@ Registry
       # Real VOMS VO name, if this VO is associated with VOMS VO
       VOMSName = lhcb
 
+      # Registered identity provider associated with VO
+      IdP = CheckIn
+
       # Section to describe all the VOMS servers that can be used with the given VOMS VO
       VOMSServers
       {
@@ -99,6 +102,9 @@ Registry
 
       # Role of the users in the VO
       VOMSRole = /lhcb
+
+      # Scope associated with a role of the user in the VO
+      IdPRole = some_special_scope
 
       # Virtual organization associated with the group
       VOMSVO = lhcb
@@ -418,6 +424,20 @@ Systems
 }
 Resources
 {
+  IdProviders
+  {
+    CheckIn
+    {
+      # What supported type of provider does it belong to
+      ProviderType = OAuth2
+      # Description of the client parameters registered on the identity provider side.
+      # Look here for information about client parameters description https://tools.ietf.org/html/rfc8414#section-2
+      issuer = https://aai-dev.egi.eu/oidc
+      client_id = type_client_id_here_receved_after_client_registration
+      client_secret = type_client_secret_here_receved_after_client_registration
+      scope = openid, profile, offline_access, eduperson_entitlement, cert_entitlement
+    }
+  }
 
   # Section for proxy providers, subsections is the names of the proxy providers
   # https://dirac.readthedocs.org/en/latest/AdministratorGuide/Resources/proxyprovider.html

docs/source/AdministratorGuide/CommandReference/index.rst

@@ -155,6 +155,9 @@ Other commands:
 .. toctree::
     :maxdepth: 2
 
+    dirac-login
+    dirac-logout
+
     dirac-admin-accounting-cli
 
     dirac-admin-sysadmin-cli

docs/source/AdministratorGuide/ServerInstallations/environment_variable_configuration.rst

@@ -65,3 +65,12 @@ DIRAC_X509_HOST_KEY
 
 X509_VOMSES
   Must be set to point to a folder containing VOMSES information. See :ref:`multi_vo_dirac`
+
+BEARER_TOKEN
+  If the environment variable is set, then the value is taken to be the token contents (https://doi.org/10.5281/zenodo.3937438).
+
+BEARER_TOKEN_FILE
+  If the environment variable is set, then its value is interpreted as a filename. The content of the specified file is used as token string (https://doi.org/10.5281/zenodo.3937438).
+
+DIRAC_USE_ACCESS_TOKEN
+  If this environment is set to ``true`` or ``yes``, the concurrent.futures.ThreadPoolExecutor will be used (default=false)

environment-py3.yml

@@ -89,6 +89,10 @@ dependencies:
   - typing >=3.6.6
   - pyyaml
   - pip:
+    # Prerelease of the required package for integration of OAuth2
+    - Authlib>=1.0.0.a2
+    - dominate
+    - pyjwt
     # This is a fork of tornado with a patch to allow for configurable iostream
     # It should eventually be part of DIRACGrid
     - git+https://github.com/DIRACGrid/tornado.git@iostreamConfigurable

environment.yml

@@ -74,6 +74,10 @@ dependencies:
   - selectors2
   - pip:
     - diraccfg
+    # OAuth2
+    - dominate
+    - authlib
+    - pyjwt
     # This is a fork of tornado with a patch to allow for configurable iostream
     - git+https://github.com/DIRACGrid/tornado.git@iostreamConfigurable
     # This is an extension of Tornado to use M2Crypto

setup.cfg

@@ -55,6 +55,9 @@ install_requires =
     six
     sqlalchemy
     subprocess32
+    Authlib >=1.0.0.a2
+    pyjwt
+    dominate
 zip_safe = False
 include_package_data = True
 
@@ -92,6 +95,7 @@ testing =
     parameterized
     pytest
     pytest-cov
+    pytest-mock
     pycodestyle
 
 [options.entry_points]
@@ -158,6 +162,8 @@ console_scripts =
     dirac-dms-user-lfns = DIRAC.DataManagementSystem.scripts.dirac_dms_user_lfns:main
     dirac-dms-user-quota = DIRAC.DataManagementSystem.scripts.dirac_dms_user_quota:main
     # FrameworkSystem
+    dirac-login = DIRAC.FrameworkSystem.scripts.dirac_login:main
+    dirac-logout = DIRAC.FrameworkSystem.scripts.dirac_logout:main
     dirac-admin-get-CAs = DIRAC.FrameworkSystem.scripts.dirac_admin_get_CAs:main [server]
     dirac-admin-get-proxy = DIRAC.FrameworkSystem.scripts.dirac_admin_get_proxy:main [admin]
     dirac-admin-proxy-upload = DIRAC.FrameworkSystem.scripts.dirac_admin_proxy_upload:main [admin]

src/DIRAC/ConfigurationSystem/Client/Helpers/Registry.py

@@ -13,6 +13,8 @@
 
 __RCSID__ = "$Id$"
 
+ID_DN_PREFIX = "/O=DIRAC/CN="
+
 # pylint: disable=missing-docstring
 
 gBaseRegistrySection = "/Registry"
@@ -428,6 +430,16 @@ def getVOForGroup(group):
   return getVO() or gConfig.getValue("%s/Groups/%s/VO" % (gBaseRegistrySection, group), "")
 
 
+def getIdPForGroup(group):
+  """ Get identity provider for group VO
+
+      :param str group: group name
+
+      :return: str
+  """
+  return getVOOption(getVOForGroup(group), 'IdP')
+
+
 def getDefaultVOMSAttribute():
   """ Get default VOMS attribute
 
@@ -697,3 +709,25 @@ def getEmailsForGroup(groupName):
     email = getUserOption(username, 'Email', [])
     emails.append(email)
   return emails
+
+
+def wrapIDAsDN(userID):
+  """ Wrap user ID as user DN
+
+      :param str userID: user ID
+
+      :return: str
+  """
+  return '/O=DIRAC/CN=' + userID
+
+
+def getIDFromDN(userDN):
+  """ Parse user ID from user DN
+
+      :param str userDN: user DN
+
+      :return: S_OK(str)/S_ERROR()
+  """
+  if not userDN.startswith(ID_DN_PREFIX):
+    return S_ERROR("%s DN does not contain user ID." % userDN)
+  return S_OK(userDN[len(ID_DN_PREFIX):])

src/DIRAC/ConfigurationSystem/Client/PathFinder.py

@@ -95,6 +95,17 @@ def getComponentSection(system, component=False, setup=False, componentCategory=
   )
 
 
+def getAPISection(system, endpointName=False, setup=False):
+  """ Get API section in a system
+
+      :param str system: system name
+      :param str endpointName: endpoint name
+
+      :return: str
+  """
+  return getComponentSection(system, component=endpointName, setup=setup, componentCategory="APIs")
+
+
 def getServiceSection(system, serviceName=False, setup=False):
   """ Get service section in a system
 

src/DIRAC/ConfigurationSystem/Client/Utilities.py

@@ -20,6 +20,7 @@
 from DIRAC.ConfigurationSystem.Client.PathFinder import getDatabaseSection
 from DIRAC.Core.Utilities.Glue2 import getGlue2CEInfo
 from DIRAC.Core.Utilities.SiteSEMapping import getSEHosts
+from DIRAC.ConfigurationSystem.Client.PathFinder import getSystemInstance
 from DIRAC.DataManagementSystem.Utilities.DMSHelpers import DMSHelpers
 
 
@@ -536,16 +537,6 @@ def getElasticDBParameters(fullname):
   return S_OK(parameters)
 
 
-def getOAuthAPI(instance='Production'):
-  """ Get OAuth API url
-
-      :param str instance: instance
-
-      :return: str
-  """
-  return gConfig.getValue("/Systems/Framework/%s/URLs/OAuthAPI" % instance)
-
-
 def getDIRACGOCDictionary():
   """
   Create a dictionary containing DIRAC site names and GOCDB site names
@@ -578,3 +569,51 @@ def getDIRACGOCDictionary():
 
   log.debug('End function.')
   return S_OK(dictionary)
+
+
+def getAuthAPI():
+  """ Get Auth REST API url
+
+      :return: str
+  """
+  return gConfig.getValue("/Systems/Framework/%s/URLs/AuthAPI" % getSystemInstance("Framework"))
+
+
+def getAuthorizationServerMetadata(issuer=None, ignoreErrors=False):
+  """ Get authorization server metadata
+
+      :param str issuer: issuer
+      :param bool ignoreErrors: igrnore configuration errors
+
+      :return: S_OK(dict)/S_ERROR()
+  """
+  data = {}
+  try:
+    result = gConfig.getOptionsDictRecursively('/DIRAC/Security/Authorization')
+    if not result['OK']:
+      return S_OK({'issuer': issuer}) if issuer else result
+    data = result['Value']
+  except Exception as e:
+    if ignoreErrors:
+      gLogger.warn(repr(e))
+    else:
+      raise e
+
+  # Search DIRAC Authorization Server issuer
+  data['issuer'] = data.get('issuer', issuer)
+  if not data['issuer']:
+    try:
+      data['issuer'] = getAuthAPI()
+    except Exception as e:
+      return S_ERROR('No issuer found in DIRAC authorization server: %s' % repr(e))
+
+  return S_OK(data) if data['issuer'] else S_ERROR('Cannot find DIRAC Authorization Server issuer.')
+
+
+def isDownloadablePersonalProxy():
+  """ Get downloadablePersonalProxy flag
+
+      :return: S_OK(bool)/S_ERROR()
+  """
+  cs_path = '/Systems/Framework/%s/APIs/Auth' % getSystemInstance("Framework")
+  return gConfig.getValue(cs_path + '/downloadablePersonalProxy', "false").lower() in ("y", "yes", "true")

src/DIRAC/ConfigurationSystem/private/TornadoRefresher.py

@@ -4,6 +4,7 @@
 
 __RCSID__ = "$Id$"
 
+from six import PY3
 import time
 
 from tornado import gen
@@ -76,9 +77,13 @@ def __refreshLoop(self):
       yield gen.sleep(gConfigurationData.getPropagationTime())
       # Publish step is blocking so we have to run it in executor
       # If we are not doing it, when master try to ping we block the IOLoop
-      yield _IOLoop.current().run_in_executor(None, self.__AutoRefresh)
 
-  @gen.coroutine
+      # When switching from python 2 to python 3, the following error occurs:
+      # RuntimeError: There is no current event loop in thread..
+      # The reason seems to be that asyncio.get_event_loop() is called in some thread other than the main thread,
+      # asyncio only generates an event loop for the main thread.
+      yield _IOLoop.current().run_in_executor(None, self.__AutoRefresh if PY3 else gen.coroutine(self.__AutoRefresh))
+
   def __AutoRefresh(self):
     """
       Auto refresh the configuration