<html><body><div style="font-family: Courier New; font-size: 12pt; color: #000000"><div>Hi Pierre,<br><br>I'll gladly contribute the code if you find it useful.<br>It is really raw code, it was just a simple proof of concept to verify I would be able to authenticate my developers using the domain server. Please fell free to modify/integrate it.<br>Please bear in mind that the used library (<strong>python-ldap</strong>) <em>does not support python3</em>, should this be an issue.</div><div><br>Regarding the forcescheduler, I really did not think about it, will have a look. Thanks for the tip.<br><br>Best Regards<br>Sergio<br><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Pierre Tardy" <tardyp@gmail.com><br><b>To: </b>"Sergio Borghese" <s.borghese@netresults.it><br><b>Cc: </b>users@buildbot.net, devel@buildbot.net<br><b>Sent: </b>Friday, 5 January, 2018 12:13:09<br><b>Subject: </b>Re: [devel@bb.net] Authentication method for Try Builds<br></div><div><br></div><div data-marker="__QUOTED_TEXT__"><div dir="ltr">Hi Sergio,<br><div>Your LdapAuth looks useful! would you like to contribute it? I think it hasn't been done yet because people are using oauth2 or the apache ldap plugin.</div><div>The implementation you shown uses ldap synchronous library. We try to avoid calling synchronous IO libraries from the main reactor thread. So we would have to modify your implementation lightly to call ldap from a thread with <a href="http://twistedmatrix.com/documents/current/api/twisted.internet.threads.deferToThread.html" target="_blank">http://twistedmatrix.com/documents/current/api/twisted.internet.threads.deferToThread.html</a></div><br><br><div>As per the try scheduler it will be a little bit more complicated to implement as the authentication for try scheduler is common with the authentication for worker due to implementation details with the perspective broker protocol.</div><br><div>Try scheduler is however mostly replaceable by the forcescheduler. Then you can run them from commandline using the REST api, and a more or less custom script. Did you consider this option?</div><br><div>Pierre</div><br><br></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Jan 5, 2018 at 9:46 AM Sergio Borghese <<a href="mailto:s.borghese@netresults.it" target="_blank">s.borghese@netresults.it</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-family:Courier New;font-size:12pt;color:#000000"><div>Hi All,</div><br><div>I was wondering if there is a way (a <em>workaround</em> really) to configure a try build scheduler using an external authentication class, similar to what you can do with the buildbot web view where you can configure an external authentication class that inherits from <strong>util.CustomAuth</strong></div><div>The current <strong>Try_UserPass</strong> method has the disadvantage or requesting to manage user's credentials in the buildbot configuration itself, that is a solution that does not scale very well.</div><div>On the other side: is there a reason (technical I mean) why the same CustomAuth mechanics has not been implemented in the try scheduler? Could it be possible to extend the try scheduler to support such type of authentication?</div><br><div>Just out of curiosity, here how I integrated the buildbot web view authentication with our Domain Server:</div><br><div> 95 import ldap<br> 96 class TestLdapAuth(util.CustomAuth):<br> 97 def check_credentials(self, user, password):<br> 98 conn = ldap.initialize('ldap://<my_domain_server_ip_address>')<br> 99 conn.protocol_version=3<br>100 conn.set_option(ldap.OPT_REFERRALS, 0)<br>101 try:<br>102 conn.simple_bind_s(user, password)<br>103 conn.unbind_s()<br>104 return True<br>105 except ldap.LDAPError:<br>106 print 'ldap bind failed'<br>107 return False<br>108 <br>109 # minimalistic config to activate new web UI<br>110 c['www'] = dict(port=8088,<br>111 plugins=dict(waterfall_view={}, console_view={}, grid_view={}), <br>112 auth=TestLdapAuth())<br>113 </div><br><div>now all the developers (that have their user/passwd recorded on the company domain server) can authenticate to the buildbot nine webpage without the need for a separate set of credentials.</div><br><div>Best Regards</div><div>Sergio</div><br><div>-- <br>Sergio Borghese<br>Senior Software Engineer<br>NetResults S.r.l. <br>Via Agostino Bassi 5, 56121 Ospedaletto (Pi), Italy<br>Tel.: <a href="tel:+39%20050%20316%203658" target="_blank">+39.050.316.3658</a><br>web: <a href="http://www.netresults.it" target="_blank">www.netresults.it</a></div></div></div>_______________________________________________<br>
devel mailing list<br>
<a href="mailto:devel@buildbot.net" target="_blank">devel@buildbot.net</a><br>
<a href="https://lists.buildbot.net/mailman/listinfo/devel" rel="noreferrer" target="_blank">https://lists.buildbot.net/mailman/listinfo/devel</a></blockquote></div><br></div></div></body></html>