[8.0] feat (VOMS2IAM): add options to sync from IAM #7612
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DIRACGridBot
added
the
alsoTargeting:integration
chaen
force-pushed
the
v8.0_feat_voms2Iam
branch
2 times, most recently
from
741d4d5
to
bba8478
Compare
chrisburr
requested changes
Jun 5, 2024
| def compare_entry(self, iam_entry, voms_entry, is_robot): | ||
| """Compare a VOMS and IAM entry""" | ||
|
|
||
| if not iam_entry.get("mail") == voms_entry.get("mail"): |
There was a problem hiding this comment.
Suggested change
| if not iam_entry.get("mail") == voms_entry.get("mail"): | |
| if iam_entry.get("mail") != voms_entry.get("mail"): |
| if not iam_entry.get(field) == voms_entry.get(field): | ||
| self.log.info(f"{iam_entry['nickname']} - {field} : {iam_entry.get(field)} vs {voms_entry.get(field)}") | ||
|
|
||
| if not sorted(iam_entry["Roles"]) == sorted(voms_entry["Roles"]): |
There was a problem hiding this comment.
Suggested change
| if not sorted(iam_entry["Roles"]) == sorted(voms_entry["Roles"]): | |
| if sorted(iam_entry["Roles"]) != sorted(voms_entry["Roles"]): |
| """Compare a VOMS and IAM entry""" | ||
|
|
||
| if not iam_entry.get("mail") == voms_entry.get("mail"): | ||
| self.log.info(f"{iam_entry['nickname']} - mail : {iam_entry.get('mail')} vs {voms_entry.get('mail')}") |
There was a problem hiding this comment.
Maybe make this logs (message, varmsg)?
| self.log.info("No extra entry entries in IAM, GOOD !") | ||
|
|
||
| # We are waiting for IAM to synchronize also suspended people | ||
| # https://github.com/indigo-iam/voms-importer/pull/22 |
There was a problem hiding this comment.
This seems to be in a release?
| iam_list_url = f"{self.iam_url}/scim/Users" | ||
| iam_users = [] | ||
| startIndex = 1 | ||
| totalResults = 1000 # total number of users |
| errors = 0 | ||
| for user in self.iam_users_raw: | ||
| try: | ||
| users.update(self.convert_iam_to_voms(user)) |
There was a problem hiding this comment.
So IAM returns a list of dictionaries where each dictionary has one key (the username)?
Might be nice to put some example responses in docstrings to make it easier to follow.
chrisburr
approved these changes
Jun 5, 2024
DIRACGridBot
added
sweep:done
|
Sweep summary Sweep ran in https://github.com/DIRACGrid/DIRAC/actions/runs/9382608769 Failed:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Addresses part of #7416
This does not yet work, because there are still too many bugs in the
voms-importerhttps://github.com/indigo-iam/voms-importer/Wht this PR does is to add 2 options to the VOMS2CSAgent`:
CompareWithIAM: when set to true, we will dump the users from IAM, and print a comparison with what VOMS seesUseIAM: not query voms-admin anymore, but the IAM endpointBEGINRELEASENOTES
NEW: VOMS2CSAgent can query IAM
ENDRELEASENOTES