Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Magpie: ensure that the MAGPIE_ADMIN_USERNAME variable is respected #418

Merged
merged 4 commits into from
Jan 25, 2024
Merged

Magpie: ensure that the MAGPIE_ADMIN_USERNAME variable is respected #418

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c92e6a0
jupyterhub: ensure username variables are respected everywhere
mishaschwartz Jan 16, 2024
4fd9d01
ensure change is backwards compatible
mishaschwartz Jan 22, 2024
7390245
unittest
mishaschwartz Jan 22, 2024
1c8b615
Merge branch 'fix-node-details' into security-defaults
mishaschwartz Jan 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,9 @@
* Replace the LICENSE URL of the server node pointing
at [Ouranosinc/pavics-sdi](https://github.com/Ouranosinc/pavics-sdi) instead
of intended [bird-house/birdhouse-deploy](https://github.com/bird-house/birdhouse-deploy).
- Magpie: ensure that the `MAGPIE_ADMIN_USERNAME` variable is respected
* When determining the `JUPYTERHUB_ADMIN_USERS` variable
* Double check that it is being respected everywhere else

[2.0.2](https://github.com/bird-house/birdhouse-deploy/tree/2.0.2) (2023-12-15)
------------------------------------------------------------------------------------------------------------------
Expand Down
2 changes: 1 addition & 1 deletion birdhouse/README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ instructions below.
Manual instructions:

* Go to
``https://<PAVICS_FQDN>/magpie/ui/login`` and login with the ``admin`` user. The password should be in ``env.local``.
``https://<PAVICS_FQDN>/magpie/ui/login`` and login with the ``MAGPIE_ADMIN_USERNAME`` user. The password should be in ``env.local``.

* Then go to ``https://<PAVICS_FQDN>/magpie/ui/users/add``.

Expand Down
2 changes: 1 addition & 1 deletion birdhouse/components/README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,7 +304,7 @@ birdhouse-deploy software stack and the machine that it is running on. It is hig
make these routes available to anyone who does not have proper access permissions.

Add existing users to the ``monitoring`` group to allow them access to the various monitoring WebUI.
This way, we do not need to share the ``admin`` user account and do not have to add them to the
This way, we do not need to share the ``MAGPIE_ADMIN_USERNAME`` user account and do not have to add them to the
``administrators`` group, which would give them too much permissions.


Expand Down
4 changes: 4 additions & 0 deletions birdhouse/components/jupyterhub/default.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,9 +68,13 @@ export JUPYTERHUB_CRYPT_KEY=
# JUPYTERHUB_CRYPT_KEY is set.
export JUPYTERHUB_AUTHENTICATOR_REFRESH_AGE=60

# Usernames that should be given admin access in jupyterhub
export JUPYTERHUB_ADMIN_USERS='{"${MAGPIE_ADMIN_USERNAME}"}' # python set syntax

export DELAYED_EVAL="
$DELAYED_EVAL
JUPYTERHUB_USER_DATA_DIR
JUPYTERHUB_ADMIN_USERS
"

# add any new variables not already in 'VARS' or 'OPTIONAL_VARS' that must be replaced in templates here
Expand Down
5 changes: 0 additions & 5 deletions birdhouse/default.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,19 +84,14 @@ export SERVER_LICENSE_URL='${__DEFAULT__SERVER_LICENSE_URL}'
# Those will not be set explicitly as defaults to ensure they are overridden explicitly by the instance.
# These values would be detected only if the instance was configured using a copy of 'env.local.example'.
export __DEFAULT__MAGPIE_SECRET=itzaseekrit
#export __DEFAULT__MAGPIE_ADMIN_USERNAME=admin
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this one remain to warn about it not being modified?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I was debating whether to keep them or remove them....

I guess I was thinking that it's OK if the username stays as "admin" as long as we recommend they change the password.

But in the end, we're just warning the user that we recommend that it should be changed from the default. If they want to keep it, they can.

I guess I can put them back in

export __DEFAULT__MAGPIE_ADMIN_PASSWORD=qwertyqwerty!
#export __DEFAULT__POSTGRES_PAVICS_USERNAME=postgres-pavics
export __DEFAULT__POSTGRES_PAVICS_PASSWORD=postgres-qwerty
#export __DEFAULT__POSTGRES_MAGPIE_USERNAME=postgres-magpie
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These might be relevant to warn as well. They should be used everywhere in the configs.
Since this is for database endpoint connection rather than Magpie user profile, it should not be involved in other scripts than direct interactions between Magpie/Twitcher and Postgres.

export __DEFAULT__POSTGRES_MAGPIE_PASSWORD=postgres-qwerty
#export __DEFAULT__GEOSERVER_ADMIN_USER=admingeo
export __DEFAULT__GEOSERVER_ADMIN_PASSWORD=geoserverpass
#############################################################################
# Deprecated vars (for components in the ./deprecated-components directory)
#############################################################################
export __DEFAULT__TOMCAT_NCWMS_PASSWORD=ncwmspass
#export __DEFAULT__CATALOG_USERNAME=admin-catalog
export __DEFAULT__CATALOG_PASSWORD=qwerty
export __DEFAULT__PHOENIX_PASSWORD=phoenix_pass
export __DEFAULT__PHOENIX_PASSWORD_HASH=sha256:123456789012:1234567890123456789012345678901234567890123456789012345678901234
Expand Down
7 changes: 6 additions & 1 deletion birdhouse/env.local.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@ export MAGPIE_ADMIN_PASSWORD=qwertyqwerty!
export TWITCHER_PROTECTED_PATH=/twitcher/ows/proxy
export [email protected]
export CMIP5_THREDDS_ROOT=birdhouse/CMIP5/CCCMA
export JUPYTERHUB_ADMIN_USERS="{'admin'}" # python set syntax
export POSTGRES_PAVICS_USERNAME=postgres-pavics
export POSTGRES_PAVICS_PASSWORD=postgres-qwerty
export POSTGRES_MAGPIE_USERNAME=postgres-magpie
Expand Down Expand Up @@ -426,6 +425,12 @@ export GEOSERVER_ADMIN_PASSWORD=geoserverpass
#c.Spawner.pre_spawn_hook = custom_create_dir_hook
#"

# Usernames that should be given admin access in jupyterhub
# By default, only the MAGPIE_ADMIN_USERNAME user is given admin access. Update this variable only if you wish
# to give additional users admin access by default.
# Note that you can also give users admin access through the jupyterhub UI.
#export JUPYTERHUB_ADMIN_USERS='{"${MAGPIE_ADMIN_USERNAME}", "othername"}' # python set syntax

# Extra PyWPS config for **all** WPS services (currently only Flyingpigeon, Finch and Raven supported).
# export EXTRA_PYWPS_CONFIG="
# [logging]
Expand Down
Loading