17224: Provide alternate credentials to use for creating user tokens

[arvados.git] / services / login-sync / bin / arvados-login-sync

diff --git a/services/login-sync/bin/arvados-login-sync b/services/login-sync/bin/arvados-login-sync
index 9152b29336b7ed44225c0a2a43a56ae1ac93d705..a9bff05464740d804ed3b1f5827c757740c97187 100755 (executable)
--- a/services/login-sync/bin/arvados-login-sync
+++ b/services/login-sync/bin/arvados-login-sync
@@ -31,6 +31,9 @@ keys = ''
 
 begin
   arv = Arvados.new({ :suppress_ssl_warnings => false })
+  logincluster_arv = Arvados.new({ :api_host => (ENV['LOGINCLUSTER_ARVADOS_API_HOST'] || ENV['ARVADOS_API_HOST']),
+                                   :api_token => (ENV['LOGINCLUSTER_ARVADOS_API_TOKEN'] || ENV['ARVADOS_API_TOKEN']),
+                      :suppress_ssl_warnings => false })
 
   vm_uuid = ENV['ARVADOS_VIRTUAL_MACHINE_UUID']
 
@@ -181,8 +184,6 @@ begin
     userdotconfig = File.join(homedir, ".config")
     if !File.exist?(userdotconfig)
       Dir.mkdir(userdotconfig)
-      FileUtils.chown_R(l[:username], nil, userdotconfig)
-      File.chmod(0700, userdotconfig)
     end
 
     configarvados = File.join(userdotconfig, "arvados")
@@ -192,23 +193,26 @@ begin
 
     begin
       if !File.exist?(tokenfile)
-        user_token = arv.api_client_authorization.create(api_client_authorization: {owner_uuid: l[:user_uuid], api_client_id: 0})
+        user_token = logincluster_arv.api_client_authorization.create(api_client_authorization: {owner_uuid: l[:user_uuid], api_client_id: 0})
         f = File.new(tokenfile, 'w')
         f.write("ARVADOS_API_HOST=#{ENV['ARVADOS_API_HOST']}\n")
         f.write("ARVADOS_API_TOKEN=v2/#{user_token[:uuid]}/#{user_token[:api_token]}\n")
         f.close()
-        File.chmod(0600, tokenfile)
       end
     rescue => e
       STDERR.puts "Error setting token for #{l[:username]}: #{e}"
     end
 
     FileUtils.chown_R(l[:username], nil, userdotssh)
-    FileUtils.chown_R(l[:username], nil, configarvados)
+    FileUtils.chown_R(l[:username], nil, userdotconfig)
     File.chmod(0700, userdotssh)
+    File.chmod(0700, userdotconfig)
+    File.chmod(0700, configarvados)
     File.chmod(0750, homedir)
     File.chmod(0600, keysfile)
-    File.chmod(0700, configarvados)
+    if File.exist?(tokenfile)
+      File.chmod(0600, tokenfile)
+    end
   end
 
 rescue Exception => bang