Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VM username should be the users username from access token, rather than a random one. #1148

Open
Tracked by #18
marrobi opened this issue Jan 20, 2022 · 9 comments · May be fixed by #3770
Open
Tracked by #18

VM username should be the users username from access token, rather than a random one. #1148

marrobi opened this issue Jan 20, 2022 · 9 comments · May be fixed by #3770
Assignees

Comments

@marrobi
Copy link
Member

marrobi commented Jan 20, 2022

No description provided.

@tamirkamara
Copy link
Collaborator

I might be mistaken but this isn't something easy to do -
Currently the API is the place where the user identity is known but we don't pass that along to porter. In order to do this we'll need to add the requestor identity as a property in all messages to the resource processor as we don't know which bundle will require it.
@marrobi Have I missed anything? Is this something we'd like to do?

@marrobi
Copy link
Member Author

marrobi commented Jun 24, 2022

I think we need to pass the requester user object ID (not sure if we can deduce email or that would be needed too) through to porter. For some services, such as AML compute instances we also need to provide the AAD user object ID (manually at present).

@tamirkamara
Copy link
Collaborator

tamirkamara commented Jun 26, 2022

I think we need to pass the requester user object ID (not sure if we can deduce email or that would be needed too) through to porter. For some services, such as AML compute instances we also need to provide the AAD user object ID (manually at present).

I guess this is now a different requirement / usecase as the object id isn't much different than a random vm user name as for the person they both are meaningless.
Maybe a better way to phrase this would be: we want the API to extract details from the token and be able to inject them into the action request. username for create vm, aad id for aml compute...
wydt?

@martinpeck martinpeck modified the milestones: Release 0.3, Release 0.4 Jun 30, 2022
@marrobi
Copy link
Member Author

marrobi commented Jul 27, 2022

The email is part of the User object once logged in. Where we call:

        user_resource, resource_template = user_resource_repo.create_user_resource_item(user_resource_create, workspace.id, workspace_service.id, workspace_service.templateName, user.id)

we could pass the complete user, and then include the email as part of the parameters.

@marrobi marrobi modified the milestones: Release 0.5, Release 0.6 Oct 26, 2022
@marrobi marrobi removed this from the Release 0.6 milestone Jun 27, 2023
@jlabhard-sg
Copy link

Bringing this old issue up as this would be something we need.

We would like for the user information to automatically be sent to porter instead of having to specify it manually. Our use case is enabling SSH access using Azure AD for VMs in an unrestricted workspace.

Is it something that is planned to be implemented, or is there a way to somehow pre-fill the template with this information? I have looked into it but couldn't find a working approach.

@marrobi
Copy link
Member Author

marrobi commented Oct 27, 2023

Not planned, don't think it would be too hard.

The user id, and maybe username could be passed in the service bus message from the API to the resource processor, then it would be available in porter.

If passed the user into get_resource_request_message_payload here -

content = json.dumps(resource_to_send.get_resource_request_message_payload(operation_id=operation.id, step_id=first_step.id, action=first_step.resourceAction))

So bits want will need adding as a property to the payload here -

def get_resource_request_message_payload(self, operation_id: str, step_id: str, action: RequestAction) -> dict:

"user" : {
"id": user.id
"name": user.name
"email": user.email
}

Or similar - probably want username... which isn't any of these.

The resource processor should then pick it up here -

# 3. msg body root (e.g. id of the resource)
- so no change needed, just use the new property name, say user in the bundle, and then access the properties in terraform.

Think you could do a PR? Happy to help iterate with you.

@jlabhard-sg
Copy link

I will unfortunately not have time to work on a PR for the next two weeks. It is not an urgency on our side however, so I can have a look after that.

@marrobi
Copy link
Member Author

marrobi commented Oct 27, 2023

@jlabhard-sg I had 30 mins or so free at the end of the day:

image

Created a draft PR - #3770 Welcome your input - is this what you need?

@jlabhard-sg
Copy link

Hi @marrobi,
This seems perfect. The username doesn't necessarily need to be set to the base VM user, as long as they can be added in a custom template, which seems to be the case here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants