r5376 - trunk/cumin/resources
by croberts@fedoraproject.org
Author: croberts
Date: 2012-05-15 18:29:45 +0000 (Tue, 15 May 2012)
New Revision: 5376
Modified:
trunk/cumin/resources/app.js
Log:
Adding pre/post draw hooks and zoom/resetzoom hooks for cumin charts.
Modified: trunk/cumin/resources/app.js
===================================================================
--- trunk/cumin/resources/app.js 2012-05-14 23:15:47 UTC (rev 5375)
+++ trunk/cumin/resources/app.js 2012-05-15 18:29:45 UTC (rev 5376)
@@ -719,11 +719,36 @@
}
}
} else {
- allCharts[divName] = $j.jqplot(holder, dataContainer['y_coordinate_values'],chartOptionsObject);
+ $j.jqplot.preDrawHooks.push(cuminChartPreDraw);
+ $j.jqplot.postDrawHooks.push(cuminChartPostDraw);
+ allCharts[divName] = $j.jqplot(holder, dataContainer['y_coordinate_values'],chartOptionsObject);
+ allCharts[divName].target.bind('jqplotResetZoom', cuminChartResetZoom);
+ allCharts[divName].target.bind('jqplotZoom', cuminChartZoom);
startChartMonitor(divName);
}
-} // end function drawChart
+
+} // end function drawChart
+// called on the jqplotZoom event
+cuminChartZoom = function(gridpos, datapos, plot, cursor) {
+// console.log("cuminZoom");
+}
+
+//called on the jqplotResetZoom event
+cuminChartResetZoom = function(gridpos, datapos, plot, cursor) {
+// console.log("cuminResetZoom");
+}
+
+// called immediately after the chart is drawn
+cuminChartPostDraw = function() {
+// console.log("customPostDraw");
+}
+
+// called right before a chart is drawn
+cuminChartPreDraw = function() {
+// console.log("customPreDraw");
+}
+
// used to let us tweak the contents of the tooltip according to our whim, gets called from highlighter plugin showTooltip function
customTooltip = function(str, seriesIndex, pointIndex, plot) {
value = plot.series[seriesIndex]._plotData[pointIndex][1];
@@ -737,7 +762,7 @@
}
// used in axis:tickOptions:formatter to override the default axis label formatting
-x_axis_Formatter = function (format, val) {
+function x_axis_Formatter(format, val) {
if (typeof val == 'number') {
if (!format) {
format = $j.jqplot.config.defaultTickFormatString;
11 years, 11 months
r5375 - in trunk/cumin: bin etc python/cumin
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-05-14 23:15:47 +0000 (Mon, 14 May 2012)
New Revision: 5375
Modified:
trunk/cumin/bin/cumin
trunk/cumin/bin/cumin-admin
trunk/cumin/bin/cumin-data
trunk/cumin/bin/cumin-report
trunk/cumin/bin/cumin-web
trunk/cumin/etc/sysvinit-cumin
trunk/cumin/python/cumin/config.py
trunk/cumin/python/cumin/util.py
Log:
Comprehensive changes to the shutdown mechanism using stdin inside of signals.
* Master communicates with children over stdin (redirected to a pipe).
* If a child sees input on stdin matching the --es option value, it will exit.
* Children launch shutdown routines in a daemon thread and call join() from the main thread
* with a timeout of --tm. This guarantees exit after --tm seconds.
* The master sets the --tm option for children based on its own --timeout option.
* The master will exit after --timeout seconds, even if children have not exited
* since they are guaranteed to do so. This allows initd to to track the pid of
* the master script with confidence.
* Initd script uses the killproc form that sends a SIGTERM and checks the pid
* with a delay before issuing SIGKILL. The delay is the same value that is
* passed as the --timeout option to the master.
* Artificial 3 second delay between stop and start on restart has been removed.
BZ800065
Modified: trunk/cumin/bin/cumin
===================================================================
--- trunk/cumin/bin/cumin 2012-05-14 13:32:02 UTC (rev 5374)
+++ trunk/cumin/bin/cumin 2012-05-14 23:15:47 UTC (rev 5375)
@@ -18,6 +18,9 @@
from parsley.loggingex import *
log = logging.getLogger("cumin.master")
+# Termination string to children
+exit_s = "exit"
+
def call_sys_exit(sig,frame):
sys.exit()
@@ -32,8 +35,8 @@
return 1
return 0
-def get_args(app, section, init_only, console, extra_options=""):
- args = [app, "--section="+section.strip()]
+def get_args(app, section, init_only, console, es, timeout, extra_options):
+ args = [app, "--section="+section.strip(), "--es="+es.strip(), "--tm="+str(timeout)]
if init_only:
args.append("--init-only")
if not console:
@@ -87,6 +90,12 @@
parser.add_option("--console", dest="console", action="store_true", default=False,
help="Log to stderr rather than master.log, no IO redirection for children.")
+ parser.add_option("--timeout", dest="timeout", default="5", type=int,
+ help="Time that the master will wait for child "\
+ "processes to exit before exiting itself. Also "\
+ "the time child processes will allow themselves "\
+ "to shutdown before calling sys.exit")
+
parser.add_option("--web-options", dest="web_options", default="", type=str,
help="Additional options string to pass to web instances."\
"\nEnclose in quotes, options must be --option form, splits on spaces."\
@@ -142,17 +151,26 @@
apps = []
if len(options.webs) > 0:
for instance in options.webs.split(','):
- args, prog_string = get_args("cumin-web", instance, options.init_only, console, options.web_options)
+ args, prog_string = get_args("cumin-web", instance,
+ options.init_only, console,
+ exit_s, options.timeout,
+ options.web_options)
apps.append([None, args, prog_string])
if len(options.datas) > 0:
for instance in options.datas.split(','):
- args, prog_string = get_args("cumin-data", instance, options.init_only, console, options.data_options)
+ args, prog_string = get_args("cumin-data", instance,
+ options.init_only, console,
+ exit_s, options.timeout,
+ options.data_options)
apps.append([None, args, prog_string])
if len(options.reports) > 0:
for instance in options.reports.split(','):
- args, prog_string = get_args("cumin-report", instance, options.init_only, console, options.report_options)
+ args, prog_string = get_args("cumin-report", instance,
+ options.init_only, console,
+ exit_s, options.timeout,
+ options.report_options)
apps.append([None, args, prog_string])
# Launch and babysit, do not restart if options.init_only is set
@@ -162,7 +180,7 @@
slow_down = 40 # slow down polling after initial period
try:
def start(app, verb):
- app[PROCESS] = subprocess.Popen(app[ARGS])
+ app[PROCESS] = subprocess.Popen(app[ARGS], stdin=subprocess.PIPE)
if app[PROCESS]:
log.info(verb+"ed subprocess (pid %s): %s" %\
(app[PROCESS].pid, app[PROG_STRING]))
@@ -212,15 +230,23 @@
else:
start(app, "Restart")
finally:
- # Try a ctrl-C first
- log.info("Send SIGTERM to all children")
+ log.info("Write termination string to all children")
complete = 0
for app in apps:
if app[PROCESS]:
complete += 1
- os.kill(app[PROCESS].pid, signal.SIGTERM)
+ try:
+ app[PROCESS].stdin.write(exit_s+"\n")
+ except:
+ log.debug("Writing termination failed for subprocess (%s)" \
+ % app[PROCESS].pid)
- # Give children 10 seconds to exit, then bail
+ # Wait for children to exit so we can record the result and so that
+ # the initd script can track the pid correctly. Exit regardless after
+ # timeout+0.5 seconds, even if the children are still running. Each child
+ # will have a hard exit after timeout seconds from its own main thread,
+ # even if its shutdown activities have not completed, so in most
+ # cases the children *should* exit within timeout+0.5 seconds
then = datetime.now()
while complete != 0:
for app in apps:
@@ -235,13 +261,12 @@
break
sleep(0.25)
- if datetime.now() - then > timedelta(seconds=5):
- log.warn("Timed out waiting for children, send SIGKILL")
+ if datetime.now() - then > timedelta(seconds=options.timeout+0.5):
+ log.warn("Timed out waiting for children, exiting")
for app in apps: # just to be paranoid
if app[PROCESS]:
- log.warn("Send SIGKILL to subprocess (%s)"\
+ log.warn("Subprocess (%s) failed to stop"\
% app[PROCESS].pid)
- os.kill(app[PROCESS].pid, signal.SIGKILL)
break
return return_code
Modified: trunk/cumin/bin/cumin-admin
===================================================================
--- trunk/cumin/bin/cumin-admin 2012-05-14 13:32:02 UTC (rev 5374)
+++ trunk/cumin/bin/cumin-admin 2012-05-14 23:15:47 UTC (rev 5375)
@@ -41,6 +41,7 @@
# Get options
parser = CuminOptionParser()
+ parser.remove_option("--es")
parser.set_usage(generate_usage())
opts, args = parser.parse_args()
Modified: trunk/cumin/bin/cumin-data
===================================================================
--- trunk/cumin/bin/cumin-data 2012-05-14 13:32:02 UTC (rev 5374)
+++ trunk/cumin/bin/cumin-data 2012-05-14 23:15:47 UTC (rev 5375)
@@ -216,6 +216,8 @@
stats = mint.update_thread.stats
count = 0
+ exit_msg = "Exiting on termination string from master"
+
if opts.print_stats:
print "[Starred columns are the number of events per second]"
@@ -226,11 +228,20 @@
count += 1
stats.print_values()
-
- sleep(5)
+ if opts.es:
+ if poll_stdin(5, value=opts.es):
+ log.debug(exit_msg)
+ break
+ else:
+ sleep(5)
else:
while True:
- sleep(86400)
+ if opts.es:
+ if poll_stdin(86400, value=opts.es):
+ log.debug(exit_msg)
+ break
+ else:
+ sleep(86400)
except KeyboardInterrupt:
log.info("Received shutdown signal")
@@ -260,15 +271,29 @@
print_exc()
return_code = CuminErrors.UNHANDLED_ERROR
- if mint:
- mint.stop()
- if pipeThread:
- pipeThread.stop()
- log.info("about to call logging shutdown")
- logging.shutdown()
+ def shutdown():
+ if mint:
+ mint.stop()
+ if pipeThread:
+ pipeThread.stop()
+ log.info("about to call logging shutdown")
+ logging.shutdown()
+
+ # Run shutdown with a timeout in the main thread.
+ # This guarantees exit.
+ t = ShutdownThread(shutdown)
+ t.start()
+
+ # If we get some error before options are parsed opts.tm won't be set
+ try:
+ tm = opts.tm
+ except:
+ tm = 5
+ t.join(tm)
return adjust_return(passed_init, return_code)
def make_ctrl_c(sig, frame):
+ log.debug("Signal received, raising KeyboardInterrupt")
raise KeyboardInterrupt
if __name__ == "__main__":
Modified: trunk/cumin/bin/cumin-report
===================================================================
--- trunk/cumin/bin/cumin-report 2012-05-14 13:32:02 UTC (rev 5374)
+++ trunk/cumin/bin/cumin-report 2012-05-14 23:15:47 UTC (rev 5375)
@@ -193,6 +193,8 @@
stats = mint.update_thread.stats
count = 0
+ exit_msg = "Exiting on termination string from master"
+
if opts.print_stats:
print "[Starred columns are the number of events per second]"
@@ -203,11 +205,20 @@
count += 1
stats.print_values()
-
- sleep(5)
+ if opts.es:
+ if poll_stdin(5, value=opts.es):
+ log.debug(exit_msg)
+ break
+ else:
+ sleep(5)
else:
while True:
- sleep(86400)
+ if opts.es:
+ if poll_stdin(86400, value=opts.es):
+ log.debug(exit_msg)
+ break
+ else:
+ sleep(86400)
except KeyboardInterrupt:
log.info("Received shutdown signal")
@@ -237,12 +248,26 @@
print_exc()
return_code = CuminErrors.UNHANDLED_ERROR
- if mint:
- mint.stop()
- if pipeThread:
- pipeThread.stop()
- log.info("about to call logging shutdown")
- logging.shutdown()
+ def shutdown():
+ if mint:
+ mint.stop()
+ if pipeThread:
+ pipeThread.stop()
+ log.info("about to call logging shutdown")
+ logging.shutdown()
+
+ # Run shutdown with a timeout in the main thread.
+ # This guarantees exit.
+ t = ShutdownThread(shutdown)
+ t.start()
+
+ # If we get some error before options are parsed opts.tm won't be set
+ try:
+ tm = opts.tm
+ except:
+ tm = 5
+ t.join(tm)
+
return adjust_return(passed_init, return_code)
def make_ctrl_c(sig, frame):
Modified: trunk/cumin/bin/cumin-web
===================================================================
--- trunk/cumin/bin/cumin-web 2012-05-14 13:32:02 UTC (rev 5374)
+++ trunk/cumin/bin/cumin-web 2012-05-14 23:15:47 UTC (rev 5375)
@@ -233,7 +233,13 @@
cumin.start()
while True:
# print_threads()
- sleep(1)
+ if opts.es:
+ if poll_stdin(1, value=opts.es):
+ log.debug("Exiting on termination string from master")
+ break
+ else:
+ sleep(1)
+
if not cumin.server_alive():
print "web server has stopped, exiting..."
log.error("Web server process has stopped")
@@ -274,12 +280,25 @@
traceback.print_exc()
return_code = CuminErrors.UNHANDLED_ERROR
- if cumin:
- cumin.stop()
- if pipeThread:
- pipeThread.stop()
- log.info("about to call logging shutdown")
- logging.shutdown()
+ def shutdown():
+ if cumin:
+ cumin.stop()
+ if pipeThread:
+ pipeThread.stop()
+ log.info("about to call logging shutdown")
+ logging.shutdown()
+
+ # Run shutdown with a timeout in the main thread.
+ # This guarantees exit.
+ t = ShutdownThread(shutdown)
+ t.start()
+
+ # If we get some error before options are parsed opts.tm won't be set
+ try:
+ tm = opts.tm
+ except:
+ tm = 5
+ t.join(tm)
return adjust_return(passed_init, return_code)
def make_ctrl_c(sig, frame):
Modified: trunk/cumin/etc/sysvinit-cumin
===================================================================
--- trunk/cumin/etc/sysvinit-cumin 2012-05-14 13:32:02 UTC (rev 5374)
+++ trunk/cumin/etc/sysvinit-cumin 2012-05-14 23:15:47 UTC (rev 5375)
@@ -18,6 +18,7 @@
servicename=cumin
RETVAL=0
+DELAY=5
start() {
@@ -86,14 +87,14 @@
# Launch for real now...Since we already did an init check assume success
# Squelch all IO, let cumin redirect.
- daemon --user cumin --check $servicename $processname $CUMIN_OPTIONS < /dev/null &> /dev/null \&
+ daemon --user cumin --check $servicename $processname "--timeout="$DELAY $CUMIN_OPTIONS < /dev/null &> /dev/null \&
echo_success && touch /var/lock/subsys/$servicename && echo
}
stop() {
echo -n $"Stopping cumin: "
- killproc $servicename -TERM
+ killproc -d $(($DELAY-1)) $servicename
RETVAL=$?
echo
if [ $RETVAL -eq 0 ]; then
@@ -120,7 +121,6 @@
;;
restart)
stop
- sleep 3
start
;;
condrestart)
Modified: trunk/cumin/python/cumin/config.py
===================================================================
--- trunk/cumin/python/cumin/config.py 2012-05-14 13:32:02 UTC (rev 5374)
+++ trunk/cumin/python/cumin/config.py 2012-05-14 23:15:47 UTC (rev 5375)
@@ -271,7 +271,11 @@
OptionParser.__init__(self)
self.add_option("--init-only", action="store_true", default=False)
+ self.add_option("--es", default="")
+ self.add_option("--tm", default="5", type=int)
+
+
# Defaults for these come later from the config
# section named in --section, via apply_defaults()
self.add_option("--debug", action="store_true")
Modified: trunk/cumin/python/cumin/util.py
===================================================================
--- trunk/cumin/python/cumin/util.py 2012-05-14 13:32:02 UTC (rev 5374)
+++ trunk/cumin/python/cumin/util.py 2012-05-14 23:15:47 UTC (rev 5375)
@@ -2,6 +2,7 @@
import os
import logging
import string
+import select
from crypt import crypt
from datetime import datetime, timedelta
@@ -156,8 +157,10 @@
return dvalue
class JobStatusInfo(object):
- stat_strings = ["Unexpanded", "Idle", "Running", "Removed", "Completed", "Held", "Transferring", "Suspended", "Submission error"]
- stat_colors = ["red", "clear", "green", "black", "blue", "yellow", "green", "yellow", "red"]
+ stat_strings = ["Unexpanded", "Idle", "Running", "Removed", "Completed",
+ "Held", "Transferring", "Suspended", "Submission error"]
+ stat_colors = ["red", "clear", "green", "black", "blue",
+ "yellow", "green", "yellow", "red"]
@classmethod
def get_status_string(cls, stat):
# Allow strings to be passed in for flexibility.
@@ -253,3 +256,30 @@
if indicator:
retval = retval + "..."
return retval
+
+def poll_stdin(timeout=5, value=""):
+ '''
+ Use select() to poll for input on sys.stdin. Return
+ True if there is input and it matches value.
+
+ timeout - seconds, how long to block for input
+ value - compare the input string to this value.
+ If value is "", all strings match.
+ '''
+ r, w, e = select.select([sys.stdin], [], [], timeout)
+ if r:
+ if value != "":
+ a = raw_input()
+ return a == value
+ return True
+ return False
+
+class ShutdownThread(Thread):
+ def __init__(self, routine):
+ super(ShutdownThread, self).__init__()
+
+ self.routine = routine
+ self.daemon = True
+
+ def run(self):
+ self.routine()
11 years, 11 months
r5374 - trunk/cumin/python/cumin
by croberts@fedoraproject.org
Author: croberts
Date: 2012-05-14 13:32:02 +0000 (Mon, 14 May 2012)
New Revision: 5374
Modified:
trunk/cumin/python/cumin/stat.strings
Log:
Adding a bit of width to the reporting chart's duration to prevent wrapping in chrome.
Modified: trunk/cumin/python/cumin/stat.strings
===================================================================
--- trunk/cumin/python/cumin/stat.strings 2012-05-11 16:13:30 UTC (rev 5373)
+++ trunk/cumin/python/cumin/stat.strings 2012-05-14 13:32:02 UTC (rev 5374)
@@ -116,7 +116,7 @@
div.ReportingStatValueChart div.duration {
margin: 1em 0 0.5em 1em;
- width:400px;
+ width:410px;
}
div.ReportingStatValueChart ul.radiotabs {
11 years, 11 months
r5373 - trunk/cumin/python/cumin
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-05-11 16:13:30 +0000 (Fri, 11 May 2012)
New Revision: 5373
Modified:
trunk/cumin/python/cumin/authenticator.py
Log:
If an exception on ldap search returns "" on str(), use e.__repr__()
Modified: trunk/cumin/python/cumin/authenticator.py
===================================================================
--- trunk/cumin/python/cumin/authenticator.py 2012-05-10 20:44:07 UTC (rev 5372)
+++ trunk/cumin/python/cumin/authenticator.py 2012-05-11 16:13:30 UTC (rev 5373)
@@ -145,8 +145,11 @@
try:
res = conn.search_s(self.url.dn, self.url.scope, filter)
except Exception, e:
+ msg = str(e)
+ if not msg:
+ msg = e.__repr__()
log.error("Authenticator: find_user, "\
- "query returned exception %s", e)
+ "query returned exception %s" % msg)
return conn, res
def find_user(self, user):
11 years, 11 months
r5372 - in trunk: cumin/bin cumin/etc cumin/python/cumin wooly/python/wooly wooly/python/wooly/wsgiserver
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-05-10 20:44:07 +0000 (Thu, 10 May 2012)
New Revision: 5372
Modified:
trunk/cumin/bin/cumin-web
trunk/cumin/etc/cumin.conf
trunk/cumin/python/cumin/config.py
trunk/cumin/python/cumin/errors.py
trunk/cumin/python/cumin/main.py
trunk/cumin/python/cumin/server.py
trunk/wooly/python/wooly/server.py
trunk/wooly/python/wooly/wsgiserver/ssl_builtin.py
trunk/wooly/python/wooly/wsgiserver/ssl_pyopenssl.py
Log:
Modifications to use the ssl support provided by cherrypy
BZ820681
Modified: trunk/cumin/bin/cumin-web
===================================================================
--- trunk/cumin/bin/cumin-web 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/cumin/bin/cumin-web 2012-05-10 20:44:07 UTC (rev 5372)
@@ -67,6 +67,30 @@
cumin.ldap_tls_cacertdir = values.ldap_tls_cacertdir
cumin.ldap_tls_cacertfile = values.ldap_tls_cacertfile
+def check_cert_files(opts):
+ # If a certificate or key file has been specified,
+ # check to make sure that both exist and that the
+ # app has permission to read them.
+ if opts.server_cert or opts.server_key:
+ for attr in ("server_cert", "server_key"):
+ attr_name = attr.replace("_", "-")
+ f = getattr(opts, attr)
+ if f == "":
+ log.error("parameter %s must have a value" % \
+ attr_name)
+ return False
+
+ if not os.path.isfile(f):
+ log.error("%s is not a file." % f)
+ return False
+
+ try:
+ open(f, "r")
+ except Exception, e:
+ log.error("Exception reading %s, %s" % (attr_name, e))
+ return False
+ return True
+
def adjust_return(passed_init, ret):
# Shift non-zer0 return codes left 1 bit
# and OR in whether or not init passed
@@ -114,6 +138,9 @@
class ArgError(Exception):
pass
+ class CertificateError(Exception):
+ pass
+
try:
cumin = None
@@ -124,6 +151,8 @@
# Add additional parameters for web
parser.add_option("--host")
parser.add_option("--port", type=int)
+ parser.add_option("--server-cert")
+ parser.add_option("--server-key")
parser.add_option("--section", default="web")
parser.add_option("--daemon", action="store_true", default=False)
@@ -145,6 +174,9 @@
values.log_max_mb,
values.log_max_archives)
+ if not check_cert_files(opts):
+ raise CertificateError
+
if len(args) != 0:
log.error("Extra arguments:" + "".join([" "+arg for arg in args]))
raise ArgError
@@ -152,7 +184,9 @@
broker_uris = [x.strip() for x in opts.brokers.split(",")]
authmech = [x.strip() for x in values.auth.split(";")]
cumin = Cumin(config.get_home(), broker_uris, opts.database,
- opts.host, opts.port, values.persona, authmech)
+ opts.host, opts.port,
+ opts.server_cert, opts.server_key,
+ values.persona, authmech)
# If the mech_list was set explicitly, honor it.
# Otherwise Cumin will default based on whether or not
@@ -231,6 +265,11 @@
log.info("Run 'cumin-admin upgrade-schema' as root")
return_code = CuminErrors.SCHEMA_VER_ERROR
+ except CertificateError:
+ log.error("Server certificate or key file is not a valid file "\
+ "or is unreadable")
+ return_code = CuminErrors.CERTIFICATE_ERROR
+
except:
traceback.print_exc()
return_code = CuminErrors.UNHANDLED_ERROR
Modified: trunk/cumin/etc/cumin.conf
===================================================================
--- trunk/cumin/etc/cumin.conf 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/cumin/etc/cumin.conf 2012-05-10 20:44:07 UTC (rev 5372)
@@ -105,6 +105,8 @@
# log-file: $CUMIN_HOME/log/web.log
# host: localhost ('0.0.0.0' binds to all local interfaces)
# port: 45672
+# server-cert:
+# server-key:
# operator-email: [none]
# update-interval: 10
# max-qmf-table-sort: 1000
@@ -280,6 +282,18 @@
## [web]
+## server-cert:
+## This is a server certificate file in PEM format.
+## If server-cert and server-key are both set and valid,
+## Cumin will use ssl. The scheme in the Cumin URL will
+## be "https://" instead of "http://".
+
+## server-key:
+## This is a key file in PEM format that corresponds to
+## the server-cert. If server-cert and server-key are both
+## set and valid, Cumin will use ssl. The scheme in the
+## Cumin URL will be "https://" instead of "http://".
+
## persona: grid
## Controls content of the top level page.
## Valid values are "default", "grid", and "messaging".
Modified: trunk/cumin/python/cumin/config.py
===================================================================
--- trunk/cumin/python/cumin/config.py 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/cumin/python/cumin/config.py 2012-05-10 20:44:07 UTC (rev 5372)
@@ -182,6 +182,12 @@
param = ConfigParameter(self, "aviary-query-servers", str)
param.default = "http://localhost:9091"
+ param = ConfigParameter(self, "server-cert", str)
+ param.default = ""
+
+ param = ConfigParameter(self, "server-key", str)
+ param.default = ""
+
param = ConfigParameter(self, "aviary-locator", str)
param.default = ""
Modified: trunk/cumin/python/cumin/errors.py
===================================================================
--- trunk/cumin/python/cumin/errors.py 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/cumin/python/cumin/errors.py 2012-05-10 20:44:07 UTC (rev 5372)
@@ -8,6 +8,7 @@
SCHEMA_ERROR = 4
SCHEMA_VER_ERROR = 5
WEB_SERVER_ERROR = 6
+ CERTIFICATE_ERROR = 7
errors = \
{NO_ERROR: ("no error", "normal operation"),
@@ -28,7 +29,10 @@
"run 'cumin-admin upgrade-schema' as root"),
WEB_SERVER_ERROR: \
("web server error",
- "web server process has exited")
+ "web server process has exited"),
+ CERTIFICATE_ERROR: \
+ ("certificate error",
+ "certificate or key file is not a valid file or is unreadable")
}
@classmethod
Modified: trunk/cumin/python/cumin/main.py
===================================================================
--- trunk/cumin/python/cumin/main.py 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/cumin/python/cumin/main.py 2012-05-10 20:44:07 UTC (rev 5372)
@@ -33,7 +33,9 @@
class Cumin(Application):
def __init__(self, home, broker_uris, database_dsn,
- host="localhost", port=45672, persona="default",
+ host="localhost", port=45672,
+ server_cert="", server_key="",
+ persona="default",
authmech=["internal"]):
super(Cumin, self).__init__()
@@ -51,7 +53,7 @@
self.session = CuminSession(self, broker_uris)
self.database = CuminDatabase(self, database_dsn)
- self.server = CuminServer(self, host, port)
+ self.server = CuminServer(self, host, port, server_cert, server_key)
self.admin = CuminAdmin(self)
self.add_resource_dir(os.path.join(self.home, "resources-wooly"))
Modified: trunk/cumin/python/cumin/server.py
===================================================================
--- trunk/cumin/python/cumin/server.py 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/cumin/python/cumin/server.py 2012-05-10 20:44:07 UTC (rev 5372)
@@ -3,5 +3,12 @@
from wooly.server import WebServer
class CuminServer(WebServer):
+ def __init__(self, app, host, port, server_cert="", server_key=""):
+
+ # Elements of WebServer will look for the cert/key fields
+ self.server_cert = server_cert
+ self.server_key = server_key
+ super(CuminServer, self).__init__(app, host, port)
+
def authorized(self, session):
return True
Modified: trunk/wooly/python/wooly/server.py
===================================================================
--- trunk/wooly/python/wooly/server.py 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/wooly/python/wooly/server.py 2012-05-10 20:44:07 UTC (rev 5372)
@@ -223,7 +223,34 @@
request_queue_size=32,
numthreads=32,
max=32)
+
+ if self.server.server_cert and self.server.server_key:
+ ssl_adapter = None
+ # Try the Python ssl module solution first
+ try:
+ from wsgiserver.ssl_builtin import BuiltinSSLAdapter
+ ssl_adapter = BuiltinSSLAdapter(self.server.server_cert,
+ self.server.server_key)
+ log.info("Webserver: ssl enabled via the Python ssl module.")
+ except:
+ pass
+
+ if ssl_adapter is None:
+ try:
+ from wsgiserver.ssl_pyopenssl import pyOpenSSLAdapter
+ ssl_adapter = pyOpenSSLAdapter(self.server.server_cert,
+ self.server.server_key)
+ log.info("Webserver: ssl enabled via the pyOpenSSL module.")
+ except:
+ pass
+
+ if ssl_adapter is None:
+ log.warn("Webserver: SSL was requested, but imports failed "
+ "for SSL implementations. Running with http only.")
+ else:
+ self.wsgi_server.ssl_adapter = ssl_adapter
+
self.wsgi_server.environ["wsgi.version"] = (1, 1)
def run(self):
Modified: trunk/wooly/python/wooly/wsgiserver/ssl_builtin.py
===================================================================
--- trunk/wooly/python/wooly/wsgiserver/ssl_builtin.py 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/wooly/python/wooly/wsgiserver/ssl_builtin.py 2012-05-10 20:44:07 UTC (rev 5372)
@@ -14,7 +14,7 @@
except ImportError:
ssl = None
-from cherrypy import wsgiserver
+from wooly import wsgiserver
class BuiltinSSLAdapter(wsgiserver.SSLAdapter):
Modified: trunk/wooly/python/wooly/wsgiserver/ssl_pyopenssl.py
===================================================================
--- trunk/wooly/python/wooly/wsgiserver/ssl_pyopenssl.py 2012-05-10 15:14:01 UTC (rev 5371)
+++ trunk/wooly/python/wooly/wsgiserver/ssl_pyopenssl.py 2012-05-10 20:44:07 UTC (rev 5372)
@@ -34,7 +34,7 @@
import threading
import time
-from cherrypy import wsgiserver
+from wooly import wsgiserver
try:
from OpenSSL import SSL
11 years, 11 months
r5371 - in trunk/cumin: python/cumin resources
by croberts@fedoraproject.org
Author: croberts
Date: 2012-05-10 15:14:01 +0000 (Thu, 10 May 2012)
New Revision: 5371
Modified:
trunk/cumin/python/cumin/stat.strings
trunk/cumin/resources/app.js
Log:
Fixing issue where zooming-out causes the axes to be set incorrectly. The root of the problem was that when we do a duration switch, we wind-up changing the axes on the display, but the jqplot library remembers what the "original" axes were. The original axes are recalled when the cursor plugin processes the resetZoom event. The fix is for us to just force a destroy/new plot when we change durations. No noticible difference for the end user (except for the fact that zooming/unzooming is now working).
Modified: trunk/cumin/python/cumin/stat.strings
===================================================================
--- trunk/cumin/python/cumin/stat.strings 2012-05-09 20:56:24 UTC (rev 5370)
+++ trunk/cumin/python/cumin/stat.strings 2012-05-10 15:14:01 UTC (rev 5371)
@@ -261,7 +261,7 @@
}
newurl = get_chart_url(id, $(chart).getParent().getElements('a')[chart_href].get('href'), state);
$(chart).getParent().getElements('a')[chart_href].set('href', newurl);
- drawSingleChart(chart);
+ drawSingleChart(chart, true);
}
return false;
}
Modified: trunk/cumin/resources/app.js
===================================================================
--- trunk/cumin/resources/app.js 2012-05-09 20:56:24 UTC (rev 5370)
+++ trunk/cumin/resources/app.js 2012-05-10 15:14:01 UTC (rev 5371)
@@ -319,7 +319,7 @@
oIcon.setProperty("title", "Full Page");
setFullpageParam(false, oFullPage);
$(oFullPage).getElement(".jqplotgraph").setProperty("style", "width:400px;height:150px;");
- drawSingleChart($(oFullPage).getElement(".jqplotgraph"));
+ drawSingleChart($(oFullPage).getElement(".jqplotgraph"), false);
var onrestore = oFullPage.onrestore;
if (onrestore) onrestore();
window.scrollTo(oFullPage.origScroll.x, oFullPage.origScroll.y);
@@ -344,7 +344,7 @@
if (onfullpage)
onfullpage(coords.width, height);
$(oFullPage).getElement(".jqplotgraph").setProperty("style", "width:100%");
- drawSingleChart($(oFullPage).getElement(".jqplotgraph"));
+ drawSingleChart($(oFullPage).getElement(".jqplotgraph"), false);
var curScroll = window.getScroll();
oFullPage.origScroll = curScroll;
window.scrollTo(0,0);
@@ -456,7 +456,7 @@
*/
drawAllCharts = function() {
$$('.jqplotgraph').each(function(thisdiv) {
- drawSingleChart(thisdiv);
+ drawSingleChart(thisdiv, false);
});
}
@@ -465,9 +465,12 @@
It then uses the wooly.setIntervalUpdate to fetch the data via AJAX and will call the stathandler
function after that data is fetched
*/
-drawSingleChart = function(id) {
+drawSingleChart = function(id, doForceRedraw) {
var jsonurl = $(id).getParent().getElements('a')[chart_href].get('href');
var passback = "";
+ if(allCharts[id.id]) {
+ allCharts[id.id].forceRedraw = doForceRedraw;
+ }
allCharts['chartNowTime'] = new Date();
wooly.setIntervalUpdate(jsonurl, stathandler, 0, passback, true);
}
@@ -484,7 +487,7 @@
chartParams = wooly.session.branch(jsonurl);
// for long-duration charts, updating is not particularly useful
if(chartParams.duration <= MAX_UPDATE_CHART_DURATION) {
- drawSingleChart(id);
+ drawSingleChart(id, false);
}
}
}
@@ -604,7 +607,7 @@
/*
This function will render a jqplot chart for the given div (holder), dataContainer (lists of data) and options on that data (dataopts)
*/
-drawChart = function(holder, dataContainer, dataopts) {
+drawChart = function(holder, dataContainer, dataopts, forceRedraw) {
$j.jqplot.config.enablePlugins = true; // needed when using pie and non-pie charts since pie charts explicitly turn off enablePlugins
// The chartOptionsObject is where the action is. Pretty much every characteristic of the chart is defined here.
@@ -701,14 +704,19 @@
// if the chart already exists, perform a "replot()" on the chart, otherwise, draw the chart from scratch
if(allCharts[divName] != undefined) {
- for(i=0; i < allCharts[divName].series.length; i++) {
- allCharts[divName].series[i].data = dataContainer['y_coordinate_values'][i];
- }
- try {
- allCharts[divName].replot({resetAxes:(!allCharts[divName].plugins.cursor._zoom.isZoomed), axes:{y2axis:{autoscale:true,min:0,pad:1.2,numberTicks:4,tickOptions:{formatString:'%.0f',formatter: y_axis_Formatter,}}, xaxis:{min:dataopts['xmin'] / dataContainer['x_axis_normalizer'], max:dataopts['xmax'] / dataContainer['x_axis_normalizer'],tickOptions:{formatString:'%.0f ' + dataContainer['x_axis_unit_label'], formatter: x_axis_Formatter,}}}})
- } catch (err) {
- // this is needed in the event of the first draw for a fullpage chart
- allCharts[divName] = $j.jqplot(holder, dataContainer['y_coordinate_values'],chartOptionsObject);
+ if(allCharts[divName]["forceRedraw"] == true) {
+ allCharts[divName].destroy();
+ allCharts[divName] = $j.jqplot(holder, dataContainer['y_coordinate_values'],chartOptionsObject);
+ } else {
+ for(i=0; i < allCharts[divName].series.length; i++) {
+ allCharts[divName].series[i].data = dataContainer['y_coordinate_values'][i];
+ }
+ try {
+ allCharts[divName].replot({resetAxes:(!allCharts[divName].plugins.cursor._zoom.isZoomed), axes:{y2axis:{autoscale:true,min:0,pad:1.2,numberTicks:4,tickOptions:{formatString:'%.0f',formatter: y_axis_Formatter,}}, xaxis:{min:dataopts['xmin'] / dataContainer['x_axis_normalizer'], max:dataopts['xmax'] / dataContainer['x_axis_normalizer'],tickOptions:{formatString:'%.0f ' + dataContainer['x_axis_unit_label'], formatter: x_axis_Formatter,}}}})
+ } catch (err) {
+ // this is needed in the event of the first draw for a fullpage chart
+ allCharts[divName] = $j.jqplot(holder, dataContainer['y_coordinate_values'],chartOptionsObject);
+ }
}
} else {
allCharts[divName] = $j.jqplot(holder, dataContainer['y_coordinate_values'],chartOptionsObject);
11 years, 11 months
r5370 - trunk/cumin/resources
by croberts@fedoraproject.org
Author: croberts
Date: 2012-05-09 20:56:24 +0000 (Wed, 09 May 2012)
New Revision: 5370
Modified:
trunk/cumin/resources/app.js
Log:
Moving the tooltip to position 'n' to avoid having it slip off the screen when near the left edge.
Modified: trunk/cumin/resources/app.js
===================================================================
--- trunk/cumin/resources/app.js 2012-05-09 17:49:15 UTC (rev 5369)
+++ trunk/cumin/resources/app.js 2012-05-09 20:56:24 UTC (rev 5370)
@@ -672,6 +672,7 @@
tooltipOffset: 2,
tooltipSeparator: ",",
tooltipaxes:'xy',
+ tooltipLocation: 'n',
useAxesFormatters:true,
show: true,
formatString:'<table class="jqplot-highlighter"><tr><td>Time: %s</td></tr>#allSeries#</table>',
@@ -684,7 +685,8 @@
showTooltip:false, // this is for the tooltip that gives the location of the cursor whether on a point or not
looseZoom:true,
showCursorLegend:false,
- constrainZoomTo: 'x'
+ constrainZoomTo: 'x',
+ showVerticalLine:false,
},
}; // end of chartOptionsObject
11 years, 11 months
r5369 - trunk/cumin/resources
by croberts@fedoraproject.org
Author: croberts
Date: 2012-05-09 17:49:15 +0000 (Wed, 09 May 2012)
New Revision: 5369
Modified:
trunk/cumin/resources/app.js
Log:
Adding a bit of padding to the line charts at the top.
Modified: trunk/cumin/resources/app.js
===================================================================
--- trunk/cumin/resources/app.js 2012-05-09 17:06:39 UTC (rev 5368)
+++ trunk/cumin/resources/app.js 2012-05-09 17:49:15 UTC (rev 5369)
@@ -634,7 +634,7 @@
autoscale:true,
min:0,
tickOptions:{formatString:'%.0f',formatter: y_axis_Formatter,},
- pad:1.01,
+ pad:1.2,
numberTicks:4,
},
xaxis: {
@@ -703,7 +703,7 @@
allCharts[divName].series[i].data = dataContainer['y_coordinate_values'][i];
}
try {
- allCharts[divName].replot({resetAxes:(!allCharts[divName].plugins.cursor._zoom.isZoomed), axes:{y2axis:{autoscale:true,min:0,pad:1.01,numberTicks:4,tickOptions:{formatString:'%.0f',formatter: y_axis_Formatter,}}, xaxis:{min:dataopts['xmin'] / dataContainer['x_axis_normalizer'], max:dataopts['xmax'] / dataContainer['x_axis_normalizer'],tickOptions:{formatString:'%.0f ' + dataContainer['x_axis_unit_label'], formatter: x_axis_Formatter,}}}})
+ allCharts[divName].replot({resetAxes:(!allCharts[divName].plugins.cursor._zoom.isZoomed), axes:{y2axis:{autoscale:true,min:0,pad:1.2,numberTicks:4,tickOptions:{formatString:'%.0f',formatter: y_axis_Formatter,}}, xaxis:{min:dataopts['xmin'] / dataContainer['x_axis_normalizer'], max:dataopts['xmax'] / dataContainer['x_axis_normalizer'],tickOptions:{formatString:'%.0f ' + dataContainer['x_axis_unit_label'], formatter: x_axis_Formatter,}}}})
} catch (err) {
// this is needed in the event of the first draw for a fullpage chart
allCharts[divName] = $j.jqplot(holder, dataContainer['y_coordinate_values'],chartOptionsObject);
11 years, 11 months
r5368 - in trunk/cumin: bin etc python/cumin
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-05-09 17:06:39 +0000 (Wed, 09 May 2012)
New Revision: 5368
Modified:
trunk/cumin/bin/cumin-web
trunk/cumin/etc/cumin.conf
trunk/cumin/python/cumin/authenticator.py
trunk/cumin/python/cumin/config.py
trunk/cumin/python/cumin/main.py
Log:
Added SSL for communication with LDAP. If the certificate authority config
params are set for Cumin, then Cumin will communicate using SSL with
servers that have a scheme of "ldaps://" and will use the StartTLS mechanism
for servers that have a schme of "ldap://" when doing binds.
BZ737979 (mod)
Modified: trunk/cumin/bin/cumin-web
===================================================================
--- trunk/cumin/bin/cumin-web 2012-05-09 15:12:54 UTC (rev 5367)
+++ trunk/cumin/bin/cumin-web 2012-05-09 17:06:39 UTC (rev 5368)
@@ -50,6 +50,7 @@
# Default will be off.
cumin.do_authorize = values.authorize
+ # This is the path to the xml file defining authorization.
# Allow this to be disabled via "None"
if values.auth_path == "None":
cumin.access_path = None
@@ -61,6 +62,11 @@
else:
cumin.access_path = values.auth_path
+def set_ldap_configs(cumin, values):
+ cumin.ldap_timeout = values.ldap_timeout
+ cumin.ldap_tls_cacertdir = values.ldap_tls_cacertdir
+ cumin.ldap_tls_cacertfile = values.ldap_tls_cacertfile
+
def adjust_return(passed_init, ret):
# Shift non-zer0 return codes left 1 bit
# and OR in whether or not init passed
@@ -156,6 +162,7 @@
set_aviary_configs(cumin, values)
set_wallaby_configs(cumin, values, broker_uris)
+ set_ldap_configs(cumin, values)
# Not used right now
#cumin.auth_create_ondemand = values.auth_create_ondemand
Modified: trunk/cumin/etc/cumin.conf
===================================================================
--- trunk/cumin/etc/cumin.conf 2012-05-09 15:12:54 UTC (rev 5367)
+++ trunk/cumin/etc/cumin.conf 2012-05-09 17:06:39 UTC (rev 5368)
@@ -110,6 +110,10 @@
# max-qmf-table-sort: 1000
# persona: grid
# authorize: False
+# auth: internal
+# ldap_tls_cacertfile:
+# ldap_tls_cacertdir:
+# ldap_timeout: 30
#notification-timeout: 180
# Number of seconds that a message in the yellow notification banner
@@ -289,6 +293,41 @@
## role will not see the 'Administrator' tab.
## The default role for a new user is 'user'.
+## auth: internal
+## Allows specification of LDAP servers for external authentication of
+## users during login. A server must support simple bind for authentication.
+## This is a semicolon separated list of URLs of the following form:
+##
+## ldap://host:port/dn??scope?filter
+##
+## Scope defaults to 'sub', filter defaults to 'uid=usnername'.
+## If a filter is specified Cumin will replace occurrences of %%s
+## with username. Example:
+## ldap://alpha.exmple.com/ou=users,dc=example,dc=com;
+## ldap://beta.example.com/ou=people,dc=example,dc=com??one?mail=%%s
+
+## ldap_tls_cacertfile:
+## Setting this option turns on SSL communication to all LDAP servers.
+## Specifies a file containing certificates for all the Certificate
+## Authorities that Cumin will recognize. An LDAP server certificate
+## must be issued by a recognized Certificate Authority or Cumin will
+## refuse to communicate with the server.
+## If this option is set, Cumin will look at the specified file before
+## looking in the directory specified by ldap_tls_cacertdir.
+
+## ldap_tls_cacertdir:
+## Setting this option turns on SSL communication to all LDAP servers.
+## Specifies a directory containing certificates for all the Certificate
+## Authorities that Cumin will recognize. Certificates may be in individual
+## files or in a certificate database created with certutil.
+## An LDAP server certificate must be issued by a recognized Certificate
+## Authority or Cumin will refuse to communicate with the server.
+## If ldap_tls_cacertfile is set, Cumin will look in that file before
+## looking in this directory.
+
+## ldap_timeout: 30
+## Timeout in seconds for connections to an LDAP server
+
## [data]
## expire-enabled: True
Modified: trunk/cumin/python/cumin/authenticator.py
===================================================================
--- trunk/cumin/python/cumin/authenticator.py 2012-05-09 15:12:54 UTC (rev 5367)
+++ trunk/cumin/python/cumin/authenticator.py 2012-05-09 17:06:39 UTC (rev 5368)
@@ -26,29 +26,104 @@
syslog.syslog(msg)
class CuminAuthenticatorLDAP(object):
- def __init__(self, url):
+ def __init__(self, url, app):
self.valid = False
log.info("Initializing %s", self)
- myurl = url.split("=",1)[1]
- try:
- self.url = ldapurl.LDAPUrl(myurl,
- scope=ldapurl.LDAP_SCOPE_SUBTREE,
- filterstr="uid=%s")
- log.info("Authenticator: parsed LDAP url successfully.")
- self.valid = True
- except Exception,e:
- log.error("Authenticator: cannot parse LDAP url %s", e)
-
+ scheme, myurl = url.split("=",1)
+ err_msg = ""
+
+ self.tls_cacertdir = app.ldap_tls_cacertdir
+ self.tls_cacertfile = app.ldap_tls_cacertfile
+ self.ldap_timeout = app.ldap_timeout
+ has_cert = self.tls_cacertdir or self.tls_cacertfile
+
+ if has_cert and not ldap.TLS_AVAIL:
+ err_msg = "Authenticator: SSL is not supported by this python-ldap module."
+
+ elif not has_cert and scheme == "ldaps":
+ err_msg = "Authenticator: scheme is ldaps but no tls_cacertdir set."
+
+ else:
+ if self.tls_cacertdir:
+ if not os.path.isdir(self.tls_cacertdir):
+ err_msg = "Authenticator: '%s' is not a valid directory." \
+ % self.tls_cacertdir
+ else:
+ try:
+ os.listdir(self.tls_cacertdir)
+ except Exception, e:
+ err_msg = "Authenticator, exception reading " \
+ "tls_cacertdir, %s" % e
+
+ if not err_msg and self.tls_cacertfile:
+ if not os.path.isfile(self.tls_cacertfile):
+ err_msg = "Authenticator: '%s' is not a valid file." \
+ % self.tls_cacertfile
+ else:
+ try:
+ open(self.tls_cacertfile, "r")
+ except Exception, e:
+ err_msg = "Authenticator, exception reading " \
+ "tls_cacertfile, %s" % e
+ if not err_msg:
+ # If the scheme is just "ldap" but cert dir is set then we will use
+ # the StartTLS mechanism for password binds
+ self.start_tls = has_cert and scheme == "ldap"
+ if scheme == "ldap":
+ log.info("Authenticator: using StartTLS for ldap: %s" % \
+ self.start_tls)
+ try:
+ self.url = ldapurl.LDAPUrl(myurl,
+ scope=ldapurl.LDAP_SCOPE_SUBTREE,
+ filterstr="uid=%s")
+ log.info("Authenticator: parsed LDAP url successfully, " \
+ "scheme is %s" % scheme)
+ self.valid = True
+ except Exception,e:
+ err_msg = "Authenticator: cannot parse LDAP url %s" % e
+
+ if err_msg:
+ log.error(err_msg)
+
+ def _set_ldap_options(self):
+ if self.tls_cacertdir:
+ ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, self.tls_cacertdir)
+
+ if self.tls_cacertfile:
+ ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, self.tls_cacertfile)
+
+ if self.tls_cacertfile or self.tls_cacertdir:
+ # Always demand a certificate if the cacert is set
+ ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_DEMAND)
+
+ if self.ldap_timeout is not None:
+ ldap.set_option(ldap.OPT_TIMEOUT, self.ldap_timeout)
+
+ def _start_tls(self, conn):
+ if self.start_tls and not conn.start_tls_called:
+ conn.start_tls_called = True
+ log.debug("Authenticator: calling conn.start_tls_s() on ldap connection")
+ try:
+ conn.start_tls_s()
+ except Exception, e:
+ log.error("Authenticator: StartTLS failed, %s" % e)
+ return False
+ return True
+
def __prep_con(self):
try:
+ self._set_ldap_options()
conn = ldap.initialize(self.url.urlscheme + "://" +self.url.hostport)
+ conn.start_tls_called = False
except Exception,e:
log.error("Authenticator: cannot contact ldap server %s",e)
return False
if self.url.who and self.url.cred:
+ if not self._start_tls(conn):
+ return False
try:
- conn.simple_bind_s(self.url.who,self.url.cred)
+ conn.simple_bind_s(self.url.who, self.url.cred)
except:
log.error("Authenticator: cannot authenticate as service %s",
self.url.who)
@@ -84,13 +159,15 @@
log.info("Authenticator: update password, "\
"query returned no results in %s", self.__class__.__name__)
else:
- dn,ent = res[0]
- conn.simple_bind_s(dn,oldpass)
- conn.passwd_s(dn,oldpass,newpass)
- log.info("Authenticator: update password succeeded in %s",
- self.__class__.__name__)
- _syslog.log("cumin: updated password via LDAP for user %s" % dn)
- res = True
+ res = False
+ if self._start_tls(conn):
+ dn,ent = res[0]
+ conn.simple_bind_s(dn,oldpass)
+ conn.passwd_s(dn,oldpass,newpass)
+ log.info("Authenticator: update password succeeded in %s",
+ self.__class__.__name__)
+ _syslog.log("cumin: updated password via LDAP for user %s" % dn)
+ res = True
return res
def batch_import(self):
@@ -137,18 +214,19 @@
"ldap users")
return False
- for dn,ent in res:
- try:
- conn.simple_bind_s(dn,password)
- _syslog.log("cumin: authenticated user %s via LDAP" % dn)
- return True
- except Exception, e:
- log.info("Authenticator: LDAP authentication "\
- "returned exception %s" % e)
+ if self._start_tls(conn):
+ for dn,ent in res:
+ try:
+ conn.simple_bind_s(dn,password)
+ _syslog.log("cumin: authenticated user %s via LDAP" % dn)
+ return True
+ except Exception, e:
+ log.info("Authenticator: LDAP authentication "\
+ "returned exception %s" % e)
return False
class CuminAuthenticatorScript(object):
- def __init__(self, commandline):
+ def __init__(self, commandline, *args):
self.valid = False
self.params = {}
self.cap = []
@@ -299,6 +377,7 @@
if have_ldap:
authen_map = {'ldap': CuminAuthenticatorLDAP,
+ 'ldaps': CuminAuthenticatorLDAP,
'script': CuminAuthenticatorScript}
else:
authen_map = {'script': CuminAuthenticatorScript}
@@ -319,6 +398,9 @@
if authmech.startswith("ldap://"):
mechname = "ldap"
authmech = "ldap=" + authmech
+ elif authmech.startswith("ldaps://"):
+ mechname = "ldaps"
+ authmech = "ldaps=" + authmech
else:
mechname = authmech.split('=',1)[0]
classname = authen_map[mechname]
@@ -327,10 +409,11 @@
mechname)
continue
- c = classname(authmech)
+ c = classname(authmech, self.app)
if c.valid:
- log.info("Authenticator: adding auth mechanism %s", mechname)
self.authenticators.append(c)
+ log.info("Authenticator: adding auth mechanism %s %s" \
+ % (mechname, c.valid and "succeeded" or "failed"))
def batch_import(self, backend, output_on=False):
numusers = 0
Modified: trunk/cumin/python/cumin/config.py
===================================================================
--- trunk/cumin/python/cumin/config.py 2012-05-09 15:12:54 UTC (rev 5367)
+++ trunk/cumin/python/cumin/config.py 2012-05-09 17:06:39 UTC (rev 5368)
@@ -115,6 +115,15 @@
param = ConfigParameter(self, "auth", str)
param.default = 'internal'
+ param = ConfigParameter(self, "ldap_tls_cacertfile", str)
+ param.default = ""
+
+ param = ConfigParameter(self, "ldap_tls_cacertdir", str)
+ param.default = ""
+
+ param = ConfigParameter(self, "ldap_timeout", int)
+ param.default = 30
+
self.log_file = ConfigParameter(self, "log-file", str)
param = ConfigParameter(self, "log-level", str)
Modified: trunk/cumin/python/cumin/main.py
===================================================================
--- trunk/cumin/python/cumin/main.py 2012-05-09 15:12:54 UTC (rev 5367)
+++ trunk/cumin/python/cumin/main.py 2012-05-09 17:06:39 UTC (rev 5368)
@@ -40,6 +40,11 @@
self.home = home
self.authmech = authmech
+ # Settings for LDAP authentication
+ self.ldap_timeout = None
+ self.ldap_tls_cacertdir = ""
+ self.ldap_tls_cacertfile = ""
+
model_dir = [os.path.join(self.home, x) for x in ("model/admin", "model", "model/plumage")]
self.model = CuminModel(self, model_dir)
@@ -48,7 +53,6 @@
self.database = CuminDatabase(self, database_dsn)
self.server = CuminServer(self, host, port)
self.admin = CuminAdmin(self)
- self.authenticator = CuminAuthenticator(self)
self.add_resource_dir(os.path.join(self.home, "resources-wooly"))
self.add_resource_dir(os.path.join(self.home, "resources"))
@@ -162,16 +166,12 @@
self.model.init()
self.database.init(schema_version_check)
- def db_init(self, schema_version_check=True):
- self.model.init()
- self.database.init(schema_version_check)
-
def init(self, schema_version_check=True):
log.info("Initializing %s", self)
# Do this initialization as late as possible so that
- # the application can set a value for self.access_path.
- # Alternatively, it can be an argument to the constructor.
+ # the application can set config values.
+ self.authenticator = CuminAuthenticator(self)
self.authorizator = CuminAuthorizator(self, self.access_path, self.do_authorize)
try:
self.authorizator.set_persona(self.persona)
11 years, 11 months
r5367 - trunk/cumin/resources
by croberts@fedoraproject.org
Author: croberts
Date: 2012-05-09 15:12:54 +0000 (Wed, 09 May 2012)
New Revision: 5367
Modified:
trunk/cumin/resources/app.js
Log:
use "tooltip" formatting for callers 'g' or 'showTooltip'.
Modified: trunk/cumin/resources/app.js
===================================================================
--- trunk/cumin/resources/app.js 2012-05-09 13:39:39 UTC (rev 5366)
+++ trunk/cumin/resources/app.js 2012-05-09 15:12:54 UTC (rev 5367)
@@ -734,7 +734,8 @@
}
// when called to render a popup tooltip, the caller is named "showTooltip
// if we don't use the ContentEditor mechanism, the name is 'g'...not sure why. Whattup, g?
- if(arguments.callee.caller.getName() == 'showTooltip') {
+ callerName = arguments.callee.caller.getName();
+ if(callerName == 'showTooltip' || callerName == 'g') {
var tempTime = allCharts['chartNowTime'].clone();
timeFormat = "%b %e, %T";
if(format.search(/min/) > -1) {
11 years, 11 months