Warn about missing/short secrets. Delete Rails session key.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@tomclegg.ca>

diff --git a/doc/admin/upgrading.html.textile.liquid b/doc/admin/upgrading.html.textile.liquid
index d0a29f598be9bdd2e5187b715b16fe2305241351..da5433630e74f2b979df93e010ef8f0046ade31f 100644 (file)
--- a/doc/admin/upgrading.html.textile.liquid
+++ b/doc/admin/upgrading.html.textile.liquid
@@ -35,6 +35,16 @@ TODO: extract this information based on git commit messages and generate changel
 <div class="releasenotes">
 </notextile>
 
+h2(#main). v2.1.2 (as of 2021-02-22)
+
+"Upgrading from 2.1.0":#v2_1_0
+
+h3. System token requirements
+
+System services now log a warning at startup if any of the system tokens (@ManagementToken@, @SystemRootToken@, and @Collections.BlobSigningKey@) are less than 32 characters, or contain characters other than a-z, A-Z, and 0-9. After upgrading, run @arvados-server config-check@ and update your configuration file if needed to resolve any warnings.
+
+The @API.RailsSessionSecretToken@ configuration key has been removed. Delete this entry from your configuration file after upgrading.
+
 h2(#v2_1_0). v2.1.0 (2020-10-13)
 
 "Upgrading from 2.0.0":#v2_0_0

diff --git a/doc/install/install-api-server.html.textile.liquid b/doc/install/install-api-server.html.textile.liquid
index b8442eb0603dfd5279572c3ec1bc28e7b5bc4e47..2893111e3517402af06366978585b8be082b6436 100644 (file)
--- a/doc/install/install-api-server.html.textile.liquid
+++ b/doc/install/install-api-server.html.textile.liquid
@@ -48,8 +48,6 @@ h3. Tokens
 <notextile>
 <pre><code>    SystemRootToken: <span class="userinput">"$system_root_token"</span>
     ManagementToken: <span class="userinput">"$management_token"</span>
-    API:
-      RailsSessionSecretToken: <span class="userinput">"$rails_secret_token"</span>
     Collections:
       BlobSigningKey: <span class="userinput">"blob_signing_key"</span>
 </code></pre>
@@ -59,8 +57,6 @@ h3. Tokens
 
 @ManagementToken@ is used to authenticate access to system metrics.
 
-@API.RailsSessionSecretToken@ is required by the API server.
-
 @Collections.BlobSigningKey@ is used to control access to Keep blocks.
 
 You can generate a random token for each of these items at the command line like this:

diff --git a/lib/boot/supervisor.go b/lib/boot/supervisor.go
index 3484a1444e786cc5f026f0d0a68ada822b79ffb1..ef95d565943392762a999e96a7fd147f2489dfb7 100644 (file)
--- a/lib/boot/supervisor.go
+++ b/lib/boot/supervisor.go
@@ -611,9 +611,6 @@ func (super *Supervisor) autofillConfig(cfg *arvados.Config) error {
        if cluster.ManagementToken == "" {
                cluster.ManagementToken = randomHexString(64)
        }
-       if cluster.API.RailsSessionSecretToken == "" {
-               cluster.API.RailsSessionSecretToken = randomHexString(64)
-       }
        if cluster.Collections.BlobSigningKey == "" {
                cluster.Collections.BlobSigningKey = randomHexString(64)
        }

diff --git a/lib/config/cmd_test.go b/lib/config/cmd_test.go
index 74c3cc96947a88b4617f1e8f1fc8acece159fd79..bb8d7dca10236d6d80523a576e0a377040b95c27 100644 (file)
--- a/lib/config/cmd_test.go
+++ b/lib/config/cmd_test.go
@@ -49,10 +49,12 @@ func (s *CommandSuite) TestCheck_NoWarnings(c *check.C) {
        in := `
 Clusters:
  z1234:
-  ManagementToken: xyzzy
-  SystemRootToken: xyzzy
+  ManagementToken: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+  SystemRootToken: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
   API:
     MaxItemsPerResponse: 1234
+  Collections:
+    BlobSigningKey: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
   PostgreSQL:
     Connection:
       sslmode: require

diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml
index 7242489797cb69f59cb78219543a4f4751e0b009..2812fd2bb0e092c65fbe431925ffdc62ef4e1228 100644 (file)
--- a/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@ -212,11 +212,6 @@ Clusters:
       # serving a single incoming multi-cluster (federated) request.
       MaxRequestAmplification: 4
 
-      # RailsSessionSecretToken is a string of alphanumeric characters
-      # used by Rails to sign session tokens. IMPORTANT: This is a
-      # site secret. It should be at least 50 characters.
-      RailsSessionSecretToken: ""
-
       # Maximum wall clock time to spend handling an incoming request.
       RequestTimeout: 5m
 

diff --git a/lib/config/deprecated_test.go b/lib/config/deprecated_test.go
index ca376ba0bb233f56f6606adb8404d1e39bffa4aa..0dd03583d7a178d779e759b163ee4d706bc97150 100644 (file)
--- a/lib/config/deprecated_test.go
+++ b/lib/config/deprecated_test.go
@@ -150,7 +150,7 @@ func (s *LoadSuite) TestLegacyKeepWebConfig(c *check.C) {
 }
 `)
        cluster, err := testLoadLegacyConfig(content, "-legacy-keepweb-config", c)
-       c.Check(err, check.IsNil)
+       c.Assert(err, check.IsNil)
 
        c.Check(cluster.Services.Controller.ExternalURL, check.Equals, arvados.URL{Scheme: "https", Host: "example.com", Path: "/"})
        c.Check(cluster.SystemRootToken, check.Equals, "abcdefg")
@@ -183,7 +183,7 @@ func (s *LoadSuite) TestLegacyKeepWebConfigDoesntDisableMissingItems(c *check.C)
 }
 `)
        cluster, err := testLoadLegacyConfig(content, "-legacy-keepweb-config", c)
-       c.Check(err, check.IsNil)
+       c.Assert(err, check.IsNil)
        // The resulting ManagementToken should be the one set up on the test server.
        c.Check(cluster.ManagementToken, check.Equals, TestServerManagementToken)
 }
@@ -193,8 +193,8 @@ func (s *LoadSuite) TestLegacyKeepproxyConfig(c *check.C) {
        content := []byte(fmtKeepproxyConfig("", true))
        cluster, err := testLoadLegacyConfig(content, f, c)
 
-       c.Check(err, check.IsNil)
-       c.Check(cluster, check.NotNil)
+       c.Assert(err, check.IsNil)
+       c.Assert(cluster, check.NotNil)
        c.Check(cluster.Services.Controller.ExternalURL, check.Equals, arvados.URL{Scheme: "https", Host: "example.com", Path: "/"})
        c.Check(cluster.SystemRootToken, check.Equals, "abcdefg")
        c.Check(cluster.ManagementToken, check.Equals, "xyzzy")
@@ -262,8 +262,8 @@ func (s *LoadSuite) TestLegacyArvGitHttpdConfig(c *check.C) {
        f := "-legacy-git-httpd-config"
        cluster, err := testLoadLegacyConfig(content, f, c)
 
-       c.Check(err, check.IsNil)
-       c.Check(cluster, check.NotNil)
+       c.Assert(err, check.IsNil)
+       c.Assert(cluster, check.NotNil)
        c.Check(cluster.Services.Controller.ExternalURL, check.Equals, arvados.URL{Scheme: "https", Host: "example.com", Path: "/"})
        c.Check(cluster.SystemRootToken, check.Equals, "abcdefg")
        c.Check(cluster.ManagementToken, check.Equals, "xyzzy")
@@ -285,7 +285,7 @@ func (s *LoadSuite) TestLegacyArvGitHttpdConfigDoesntDisableMissingItems(c *chec
 }
 `)
        cluster, err := testLoadLegacyConfig(content, "-legacy-git-httpd-config", c)
-       c.Check(err, check.IsNil)
+       c.Assert(err, check.IsNil)
        // The resulting ManagementToken should be the one set up on the test server.
        c.Check(cluster.ManagementToken, check.Equals, TestServerManagementToken)
 }
@@ -295,8 +295,8 @@ func (s *LoadSuite) TestLegacyKeepBalanceConfig(c *check.C) {
        content := []byte(fmtKeepBalanceConfig(""))
        cluster, err := testLoadLegacyConfig(content, f, c)
 
-       c.Check(err, check.IsNil)
-       c.Check(cluster, check.NotNil)
+       c.Assert(err, check.IsNil)
+       c.Assert(cluster, check.NotNil)
        c.Check(cluster.ManagementToken, check.Equals, "xyzzy")
        c.Check(cluster.Services.Keepbalance.InternalURLs[arvados.URL{Host: ":80"}], check.Equals, arvados.ServiceInstance{})
        c.Check(cluster.Collections.BalanceCollectionBuffers, check.Equals, 1000)

diff --git a/lib/config/export.go b/lib/config/export.go
index fb56268384e141d2b31af9ed610250d8a260ff67..e4917032ffe06ca72d5a016fe7cd747a4cc12e02 100644 (file)
--- a/lib/config/export.go
+++ b/lib/config/export.go
@@ -59,211 +59,208 @@ func ExportJSON(w io.Writer, cluster *arvados.Cluster) error {
 // exists.
 var whitelist = map[string]bool{
        // | sort -t'"' -k2,2
-       "API":                                                 true,
-       "API.AsyncPermissionsUpdateInterval":                  false,
-       "API.DisabledAPIs":                                    false,
-       "API.KeepServiceRequestTimeout":                       false,
-       "API.MaxConcurrentRequests":                           false,
-       "API.MaxIndexDatabaseRead":                            false,
-       "API.MaxItemsPerResponse":                             true,
-       "API.MaxKeepBlobBuffers":                              false,
-       "API.MaxRequestAmplification":                         false,
-       "API.MaxRequestSize":                                  true,
-       "API.RailsSessionSecretToken":                         false,
-       "API.RequestTimeout":                                  true,
-       "API.SendTimeout":                                     true,
-       "API.WebsocketClientEventQueue":                       false,
-       "API.WebsocketServerEventQueue":                       false,
-       "AuditLogs":                                           false,
-       "AuditLogs.MaxAge":                                    false,
-       "AuditLogs.MaxDeleteBatch":                            false,
-       "AuditLogs.UnloggedAttributes":                        false,
-       "ClusterID":                                           true,
-       "Collections":                                         true,
-       "Collections.BalanceCollectionBatch":                  false,
-       "Collections.BalanceCollectionBuffers":                false,
-       "Collections.BalancePeriod":                           false,
-       "Collections.BalanceTimeout":                          false,
-       "Collections.BlobDeleteConcurrency":                   false,
-       "Collections.BlobMissingReport":                       false,
-       "Collections.BlobReplicateConcurrency":                false,
-       "Collections.BlobSigning":                             true,
-       "Collections.BlobSigningKey":                          false,
-       "Collections.BlobSigningTTL":                          true,
-       "Collections.BlobTrash":                               false,
-       "Collections.BlobTrashCheckInterval":                  false,
-       "Collections.BlobTrashConcurrency":                    false,
-       "Collections.BlobTrashLifetime":                       false,
-       "Collections.CollectionVersioning":                    false,
-       "Collections.DefaultReplication":                      true,
-       "Collections.DefaultTrashLifetime":                    true,
-       "Collections.ForwardSlashNameSubstitution":            true,
-       "Collections.ManagedProperties":                       true,
-       "Collections.ManagedProperties.*":                     true,
-       "Collections.ManagedProperties.*.*":                   true,
-       "Collections.PreserveVersionIfIdle":                   true,
-       "Collections.S3FolderObjects":                         true,
-       "Collections.TrashSweepInterval":                      false,
-       "Collections.TrustAllContent":                         false,
-       "Collections.WebDAVCache":                             false,
-       "Containers":                                          true,
-       "Containers.CloudVMs":                                 false,
-       "Containers.CrunchRunArgumentsList":                   false,
-       "Containers.CrunchRunCommand":                         false,
-       "Containers.DefaultKeepCacheRAM":                      true,
-       "Containers.DispatchPrivateKey":                       false,
-       "Containers.JobsAPI":                                  true,
-       "Containers.JobsAPI.Enable":                           true,
-       "Containers.JobsAPI.GitInternalDir":                   false,
-       "Containers.Logging":                                  false,
-       "Containers.LogReuseDecisions":                        false,
-       "Containers.MaxComputeVMs":                            false,
-       "Containers.MaxDispatchAttempts":                      false,
-       "Containers.MaxRetryAttempts":                         true,
-       "Containers.MinRetryPeriod":                           true,
-       "Containers.ReserveExtraRAM":                          true,
-       "Containers.SLURM":                                    false,
-       "Containers.StaleLockTimeout":                         false,
-       "Containers.SupportedDockerImageFormats":              true,
-       "Containers.SupportedDockerImageFormats.*":            true,
-       "Containers.UsePreemptibleInstances":                  true,
-       "ForceLegacyAPI14":                                    false,
-       "Git":                                                 false,
-       "InstanceTypes":                                       true,
-       "InstanceTypes.*":                                     true,
-       "InstanceTypes.*.*":                                   true,
-       "Login":                                               true,
-       "Login.Google":                                        true,
-       "Login.Google.AuthenticationRequestParameters":        false,
-       "Login.Google.AlternateEmailAddresses":                false,
-       "Login.Google.ClientID":                               false,
-       "Login.Google.ClientSecret":                           false,
-       "Login.Google.Enable":                                 true,
-       "Login.LDAP":                                          true,
-       "Login.LDAP.AppendDomain":                             false,
-       "Login.LDAP.EmailAttribute":                           false,
-       "Login.LDAP.Enable":                                   true,
-       "Login.LDAP.InsecureTLS":                              false,
-       "Login.LDAP.SearchAttribute":                          false,
-       "Login.LDAP.SearchBase":                               false,
-       "Login.LDAP.SearchBindPassword":                       false,
-       "Login.LDAP.SearchBindUser":                           false,
-       "Login.LDAP.SearchFilters":                            false,
-       "Login.LDAP.StartTLS":                                 false,
-       "Login.LDAP.StripDomain":                              false,
-       "Login.LDAP.URL":                                      false,
-       "Login.LDAP.UsernameAttribute":                        false,
-       "Login.LoginCluster":                                  true,
-       "Login.OpenIDConnect":                                 true,
-       "Login.OpenIDConnect.AuthenticationRequestParameters": false,
-       "Login.OpenIDConnect.ClientID":                        false,
-       "Login.OpenIDConnect.ClientSecret":                    false,
-       "Login.OpenIDConnect.EmailClaim":                      false,
-       "Login.OpenIDConnect.EmailVerifiedClaim":              false,
-       "Login.OpenIDConnect.Enable":                          true,
-       "Login.OpenIDConnect.Issuer":                          false,
-       "Login.OpenIDConnect.UsernameClaim":                   false,
-       "Login.PAM":                                           true,
-       "Login.PAM.DefaultEmailDomain":                        false,
-       "Login.PAM.Enable":                                    true,
-       "Login.PAM.Service":                                   false,
-       "Login.RemoteTokenRefresh":                            true,
-       "Login.SSO":                                           true,
-       "Login.SSO.Enable":                                    true,
-       "Login.SSO.ProviderAppID":                             false,
-       "Login.SSO.ProviderAppSecret":                         false,
-       "Login.Test":                                          true,
-       "Login.Test.Enable":                                   true,
-       "Login.Test.Users":                                    false,
-       "Login.TokenLifetime":                                 false,
-       "Login.TrustedClients":                                false,
-       "Mail":                                                true,
-       "Mail.EmailFrom":                                      false,
-       "Mail.IssueReporterEmailFrom":                         false,
-       "Mail.IssueReporterEmailTo":                           false,
-       "Mail.MailchimpAPIKey":                                false,
-       "Mail.MailchimpListID":                                false,
-       "Mail.SendUserSetupNotificationEmail":                 false,
-       "Mail.SupportEmailAddress":                            true,
-       "ManagementToken":                                     false,
-       "PostgreSQL":                                          false,
-       "RemoteClusters":                                      true,
-       "RemoteClusters.*":                                    true,
-       "RemoteClusters.*.ActivateUsers":                      true,
-       "RemoteClusters.*.Host":                               true,
-       "RemoteClusters.*.Insecure":                           true,
-       "RemoteClusters.*.Proxy":                              true,
-       "RemoteClusters.*.Scheme":                             true,
-       "Services":                                            true,
-       "Services.*":                                          true,
-       "Services.*.ExternalURL":                              true,
-       "Services.*.InternalURLs":                             false,
-       "SystemLogs":                                          false,
-       "SystemRootToken":                                     false,
-       "TLS":                                                 false,
-       "Users":                                               true,
-       "Users.AdminNotifierEmailFrom":                        false,
-       "Users.AnonymousUserToken":                            true,
-       "Users.AutoAdminFirstUser":                            false,
-       "Users.AutoAdminUserWithEmail":                        false,
-       "Users.AutoSetupNewUsers":                             false,
-       "Users.AutoSetupNewUsersWithRepository":               false,
-       "Users.AutoSetupNewUsersWithVmUUID":                   false,
-       "Users.AutoSetupUsernameBlacklist":                    false,
-       "Users.EmailSubjectPrefix":                            false,
-       "Users.NewInactiveUserNotificationRecipients":         false,
-       "Users.NewUserNotificationRecipients":                 false,
-       "Users.NewUsersAreActive":                             false,
-       "Users.PreferDomainForUsername":                       false,
-       "Users.UserNotifierEmailFrom":                         false,
-       "Users.UserProfileNotificationAddress":                false,
-       "Users.UserSetupMailText":                             false,
-       "Volumes":                                             true,
-       "Volumes.*":                                           true,
-       "Volumes.*.*":                                         false,
-       "Volumes.*.AccessViaHosts":                            true,
-       "Volumes.*.AccessViaHosts.*":                          true,
-       "Volumes.*.AccessViaHosts.*.ReadOnly":                 true,
-       "Volumes.*.ReadOnly":                                  true,
-       "Volumes.*.Replication":                               true,
-       "Volumes.*.StorageClasses":                            true,
-       "Volumes.*.StorageClasses.*":                          false,
-       "Workbench":                                           true,
-       "Workbench.ActivationContactLink":                     false,
-       "Workbench.APIClientConnectTimeout":                   true,
-       "Workbench.APIClientReceiveTimeout":                   true,
-       "Workbench.APIResponseCompression":                    true,
-       "Workbench.ApplicationMimetypesWithViewIcon":          true,
-       "Workbench.ApplicationMimetypesWithViewIcon.*":        true,
-       "Workbench.ArvadosDocsite":                            true,
-       "Workbench.ArvadosPublicDataDocURL":                   true,
-       "Workbench.DefaultOpenIdPrefix":                       false,
-       "Workbench.EnableGettingStartedPopup":                 true,
-       "Workbench.EnablePublicProjectsPage":                  true,
-       "Workbench.FileViewersConfigURL":                      true,
-       "Workbench.IdleTimeout":                               true,
-       "Workbench.InactivePageHTML":                          true,
-       "Workbench.LogViewerMaxBytes":                         true,
-       "Workbench.MultiSiteSearch":                           true,
-       "Workbench.ProfilingEnabled":                          true,
-       "Workbench.Repositories":                              false,
-       "Workbench.RepositoryCache":                           false,
-       "Workbench.RunningJobLogRecordsToFetch":               true,
-       "Workbench.SecretKeyBase":                             false,
-       "Workbench.ShowRecentCollectionsOnDashboard":          true,
-       "Workbench.ShowUserAgreementInline":                   true,
-       "Workbench.ShowUserNotifications":                     true,
-       "Workbench.SiteName":                                  true,
-       "Workbench.SSHHelpHostSuffix":                         true,
-       "Workbench.SSHHelpPageHTML":                           true,
-       "Workbench.Theme":                                     true,
-       "Workbench.UserProfileFormFields":                     true,
-       "Workbench.UserProfileFormFields.*":                   true,
-       "Workbench.UserProfileFormFields.*.*":                 true,
-       "Workbench.UserProfileFormFields.*.*.*":               true,
-       "Workbench.UserProfileFormMessage":                    true,
-       "Workbench.VocabularyURL":                             true,
-       "Workbench.WelcomePageHTML":                           true,
+       "API":                                          true,
+       "API.AsyncPermissionsUpdateInterval":           false,
+       "API.DisabledAPIs":                             false,
+       "API.KeepServiceRequestTimeout":                false,
+       "API.MaxConcurrentRequests":                    false,
+       "API.MaxIndexDatabaseRead":                     false,
+       "API.MaxItemsPerResponse":                      true,
+       "API.MaxKeepBlobBuffers":                       false,
+       "API.MaxRequestAmplification":                  false,
+       "API.MaxRequestSize":                           true,
+       "API.RequestTimeout":                           true,
+       "API.SendTimeout":                              true,
+       "API.WebsocketClientEventQueue":                false,
+       "API.WebsocketServerEventQueue":                false,
+       "AuditLogs":                                    false,
+       "AuditLogs.MaxAge":                             false,
+       "AuditLogs.MaxDeleteBatch":                     false,
+       "AuditLogs.UnloggedAttributes":                 false,
+       "ClusterID":                                    true,
+       "Collections":                                  true,
+       "Collections.BalanceCollectionBatch":           false,
+       "Collections.BalanceCollectionBuffers":         false,
+       "Collections.BalancePeriod":                    false,
+       "Collections.BalanceTimeout":                   false,
+       "Collections.BlobDeleteConcurrency":            false,
+       "Collections.BlobMissingReport":                false,
+       "Collections.BlobReplicateConcurrency":         false,
+       "Collections.BlobSigning":                      true,
+       "Collections.BlobSigningKey":                   false,
+       "Collections.BlobSigningTTL":                   true,
+       "Collections.BlobTrash":                        false,
+       "Collections.BlobTrashCheckInterval":           false,
+       "Collections.BlobTrashConcurrency":             false,
+       "Collections.BlobTrashLifetime":                false,
+       "Collections.CollectionVersioning":             false,
+       "Collections.DefaultReplication":               true,
+       "Collections.DefaultTrashLifetime":             true,
+       "Collections.ForwardSlashNameSubstitution":     true,
+       "Collections.ManagedProperties":                true,
+       "Collections.ManagedProperties.*":              true,
+       "Collections.ManagedProperties.*.*":            true,
+       "Collections.PreserveVersionIfIdle":            true,
+       "Collections.S3FolderObjects":                  true,
+       "Collections.TrashSweepInterval":               false,
+       "Collections.TrustAllContent":                  false,
+       "Collections.WebDAVCache":                      false,
+       "Containers":                                   true,
+       "Containers.CloudVMs":                          false,
+       "Containers.CrunchRunArgumentsList":            false,
+       "Containers.CrunchRunCommand":                  false,
+       "Containers.DefaultKeepCacheRAM":               true,
+       "Containers.DispatchPrivateKey":                false,
+       "Containers.JobsAPI":                           true,
+       "Containers.JobsAPI.Enable":                    true,
+       "Containers.JobsAPI.GitInternalDir":            false,
+       "Containers.Logging":                           false,
+       "Containers.LogReuseDecisions":                 false,
+       "Containers.MaxComputeVMs":                     false,
+       "Containers.MaxDispatchAttempts":               false,
+       "Containers.MaxRetryAttempts":                  true,
+       "Containers.MinRetryPeriod":                    true,
+       "Containers.ReserveExtraRAM":                   true,
+       "Containers.SLURM":                             false,
+       "Containers.StaleLockTimeout":                  false,
+       "Containers.SupportedDockerImageFormats":       true,
+       "Containers.SupportedDockerImageFormats.*":     true,
+       "Containers.UsePreemptibleInstances":           true,
+       "ForceLegacyAPI14":                             false,
+       "Git":                                          false,
+       "InstanceTypes":                                true,
+       "InstanceTypes.*":                              true,
+       "InstanceTypes.*.*":                            true,
+       "Login":                                        true,
+       "Login.Google":                                 true,
+       "Login.Google.AlternateEmailAddresses":         false,
+       "Login.Google.ClientID":                        false,
+       "Login.Google.ClientSecret":                    false,
+       "Login.Google.Enable":                          true,
+       "Login.LDAP":                                   true,
+       "Login.LDAP.AppendDomain":                      false,
+       "Login.LDAP.EmailAttribute":                    false,
+       "Login.LDAP.Enable":                            true,
+       "Login.LDAP.InsecureTLS":                       false,
+       "Login.LDAP.SearchAttribute":                   false,
+       "Login.LDAP.SearchBase":                        false,
+       "Login.LDAP.SearchBindPassword":                false,
+       "Login.LDAP.SearchBindUser":                    false,
+       "Login.LDAP.SearchFilters":                     false,
+       "Login.LDAP.StartTLS":                          false,
+       "Login.LDAP.StripDomain":                       false,
+       "Login.LDAP.URL":                               false,
+       "Login.LDAP.UsernameAttribute":                 false,
+       "Login.LoginCluster":                           true,
+       "Login.OpenIDConnect":                          true,
+       "Login.OpenIDConnect.ClientID":                 false,
+       "Login.OpenIDConnect.ClientSecret":             false,
+       "Login.OpenIDConnect.EmailClaim":               false,
+       "Login.OpenIDConnect.EmailVerifiedClaim":       false,
+       "Login.OpenIDConnect.Enable":                   true,
+       "Login.OpenIDConnect.Issuer":                   false,
+       "Login.OpenIDConnect.UsernameClaim":            false,
+       "Login.PAM":                                    true,
+       "Login.PAM.DefaultEmailDomain":                 false,
+       "Login.PAM.Enable":                             true,
+       "Login.PAM.Service":                            false,
+       "Login.RemoteTokenRefresh":                     true,
+       "Login.SSO":                                    true,
+       "Login.SSO.Enable":                             true,
+       "Login.SSO.ProviderAppID":                      false,
+       "Login.SSO.ProviderAppSecret":                  false,
+       "Login.Test":                                   true,
+       "Login.Test.Enable":                            true,
+       "Login.Test.Users":                             false,
+       "Login.TokenLifetime":                          false,
+       "Login.TrustedClients":                         false,
+       "Mail":                                         true,
+       "Mail.EmailFrom":                               false,
+       "Mail.IssueReporterEmailFrom":                  false,
+       "Mail.IssueReporterEmailTo":                    false,
+       "Mail.MailchimpAPIKey":                         false,
+       "Mail.MailchimpListID":                         false,
+       "Mail.SendUserSetupNotificationEmail":          false,
+       "Mail.SupportEmailAddress":                     true,
+       "ManagementToken":                              false,
+       "PostgreSQL":                                   false,
+       "RemoteClusters":                               true,
+       "RemoteClusters.*":                             true,
+       "RemoteClusters.*.ActivateUsers":               true,
+       "RemoteClusters.*.Host":                        true,
+       "RemoteClusters.*.Insecure":                    true,
+       "RemoteClusters.*.Proxy":                       true,
+       "RemoteClusters.*.Scheme":                      true,
+       "Services":                                     true,
+       "Services.*":                                   true,
+       "Services.*.ExternalURL":                       true,
+       "Services.*.InternalURLs":                      false,
+       "SystemLogs":                                   false,
+       "SystemRootToken":                              false,
+       "TLS":                                          false,
+       "Users":                                        true,
+       "Users.AdminNotifierEmailFrom":                 false,
+       "Users.AnonymousUserToken":                     true,
+       "Users.AutoAdminFirstUser":                     false,
+       "Users.AutoAdminUserWithEmail":                 false,
+       "Users.AutoSetupNewUsers":                      false,
+       "Users.AutoSetupNewUsersWithRepository":        false,
+       "Users.AutoSetupNewUsersWithVmUUID":            false,
+       "Users.AutoSetupUsernameBlacklist":             false,
+       "Users.EmailSubjectPrefix":                     false,
+       "Users.NewInactiveUserNotificationRecipients":  false,
+       "Users.NewUserNotificationRecipients":          false,
+       "Users.NewUsersAreActive":                      false,
+       "Users.PreferDomainForUsername":                false,
+       "Users.UserNotifierEmailFrom":                  false,
+       "Users.UserProfileNotificationAddress":         false,
+       "Users.UserSetupMailText":                      false,
+       "Volumes":                                      true,
+       "Volumes.*":                                    true,
+       "Volumes.*.*":                                  false,
+       "Volumes.*.AccessViaHosts":                     true,
+       "Volumes.*.AccessViaHosts.*":                   true,
+       "Volumes.*.AccessViaHosts.*.ReadOnly":          true,
+       "Volumes.*.ReadOnly":                           true,
+       "Volumes.*.Replication":                        true,
+       "Volumes.*.StorageClasses":                     true,
+       "Volumes.*.StorageClasses.*":                   false,
+       "Workbench":                                    true,
+       "Workbench.ActivationContactLink":              false,
+       "Workbench.APIClientConnectTimeout":            true,
+       "Workbench.APIClientReceiveTimeout":            true,
+       "Workbench.APIResponseCompression":             true,
+       "Workbench.ApplicationMimetypesWithViewIcon":   true,
+       "Workbench.ApplicationMimetypesWithViewIcon.*": true,
+       "Workbench.ArvadosDocsite":                     true,
+       "Workbench.ArvadosPublicDataDocURL":            true,
+       "Workbench.DefaultOpenIdPrefix":                false,
+       "Workbench.EnableGettingStartedPopup":          true,
+       "Workbench.EnablePublicProjectsPage":           true,
+       "Workbench.FileViewersConfigURL":               true,
+       "Workbench.IdleTimeout":                        true,
+       "Workbench.InactivePageHTML":                   true,
+       "Workbench.LogViewerMaxBytes":                  true,
+       "Workbench.MultiSiteSearch":                    true,
+       "Workbench.ProfilingEnabled":                   true,
+       "Workbench.Repositories":                       false,
+       "Workbench.RepositoryCache":                    false,
+       "Workbench.RunningJobLogRecordsToFetch":        true,
+       "Workbench.SecretKeyBase":                      false,
+       "Workbench.ShowRecentCollectionsOnDashboard":   true,
+       "Workbench.ShowUserAgreementInline":            true,
+       "Workbench.ShowUserNotifications":              true,
+       "Workbench.SiteName":                           true,
+       "Workbench.SSHHelpHostSuffix":                  true,
+       "Workbench.SSHHelpPageHTML":                    true,
+       "Workbench.Theme":                              true,
+       "Workbench.UserProfileFormFields":              true,
+       "Workbench.UserProfileFormFields.*":            true,
+       "Workbench.UserProfileFormFields.*.*":          true,
+       "Workbench.UserProfileFormFields.*.*.*":        true,
+       "Workbench.UserProfileFormMessage":             true,
+       "Workbench.VocabularyURL":                      true,
+       "Workbench.WelcomePageHTML":                    true,
 }
 
 func redactUnsafe(m map[string]interface{}, mPrefix, lookupPrefix string) error {

diff --git a/lib/config/generated_config.go b/lib/config/generated_config.go
index a3c457cd3011d526010e3fd8a655c07c8e82aa4d..27bc2e4e0bdca1e0456a09fe6f4e19df3076ee8d 100644 (file)
--- a/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@ -218,11 +218,6 @@ Clusters:
       # serving a single incoming multi-cluster (federated) request.
       MaxRequestAmplification: 4
 
-      # RailsSessionSecretToken is a string of alphanumeric characters
-      # used by Rails to sign session tokens. IMPORTANT: This is a
-      # site secret. It should be at least 50 characters.
-      RailsSessionSecretToken: ""
-
       # Maximum wall clock time to spend handling an incoming request.
       RequestTimeout: 5m
 

diff --git a/lib/config/load_test.go b/lib/config/load_test.go
index 0fe40a69e24b7831448e45e949c2edb736d5e579..91bd6a74392564e14b98e35bae96e872f7de8a79 100644 (file)
--- a/lib/config/load_test.go
+++ b/lib/config/load_test.go
@@ -192,6 +192,10 @@ func (s *LoadSuite) TestDeprecatedOrUnknownWarning(c *check.C) {
        _, err := testLoader(c, `
 Clusters:
   zzzzz:
+    ManagementToken: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    SystemRootToken: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    Collections:
+     BlobSigningKey: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
     postgresql: {}
     BadKey: {}
     Containers: {}
@@ -261,6 +265,10 @@ func (s *LoadSuite) TestNoUnrecognizedKeysInDefaultConfig(c *check.C) {
        err = yaml.Unmarshal(buf, &loaded)
        c.Assert(err, check.IsNil)
 
+       c.Check(logbuf.String(), check.Matches, `(?ms).*SystemRootToken: secret token is not set.*`)
+       c.Check(logbuf.String(), check.Matches, `(?ms).*ManagementToken: secret token is not set.*`)
+       c.Check(logbuf.String(), check.Matches, `(?ms).*Collections.BlobSigningKey: secret token is not set.*`)
+       logbuf.Reset()
        loader.logExtraKeys(loaded, supplied, "")
        c.Check(logbuf.String(), check.Equals, "")
 }
@@ -269,7 +277,13 @@ func (s *LoadSuite) TestNoWarningsForDumpedConfig(c *check.C) {
        var logbuf bytes.Buffer
        logger := logrus.New()
        logger.Out = &logbuf
-       cfg, err := testLoader(c, `{"Clusters":{"zzzzz":{}}}`, &logbuf).Load()
+       cfg, err := testLoader(c, `
+Clusters:
+ zzzzz:
+  ManagementToken: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+  SystemRootToken: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+  Collections:
+   BlobSigningKey: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`, &logbuf).Load()
        c.Assert(err, check.IsNil)
        yaml, err := yaml.Marshal(cfg)
        c.Assert(err, check.IsNil)
@@ -279,6 +293,31 @@ func (s *LoadSuite) TestNoWarningsForDumpedConfig(c *check.C) {
        c.Check(logbuf.String(), check.Equals, "")
 }
 
+func (s *LoadSuite) TestUnacceptableTokens(c *check.C) {
+       for _, trial := range []struct {
+               short      bool
+               configPath string
+               example    string
+       }{
+               {false, "SystemRootToken", "SystemRootToken: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa_b_c"},
+               {false, "ManagementToken", "ManagementToken: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa b c"},
+               {false, "ManagementToken", "ManagementToken: \"$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabc\""},
+               {false, "Collections.BlobSigningKey", "Collections: {BlobSigningKey: \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa⛵\"}"},
+               {true, "SystemRootToken", "SystemRootToken: a_b_c"},
+               {true, "ManagementToken", "ManagementToken: a b c"},
+               {true, "ManagementToken", "ManagementToken: \"$abc\""},
+               {true, "Collections.BlobSigningKey", "Collections: {BlobSigningKey: \"⛵\"}"},
+       } {
+               c.Logf("trying bogus config: %s", trial.example)
+               _, err := testLoader(c, "Clusters:\n zzzzz:\n  "+trial.example, nil).Load()
+               if trial.short {
+                       c.Check(err, check.ErrorMatches, `Clusters.zzzzz.`+trial.configPath+`: unacceptable characters in token.*`)
+               } else {
+                       c.Check(err, check.ErrorMatches, `Clusters.zzzzz.`+trial.configPath+`: unacceptable characters in token.*`)
+               }
+       }
+}
+
 func (s *LoadSuite) TestPostgreSQLKeyConflict(c *check.C) {
        _, err := testLoader(c, `
 Clusters:

diff --git a/sdk/go/arvados/config.go b/sdk/go/arvados/config.go
index 002ecf770541b5fd88bb34413a62e4fd46dfa42f..2e39985c2a7cca989866d20eb250f1643873739e 100644 (file)
--- a/sdk/go/arvados/config.go
+++ b/sdk/go/arvados/config.go
@@ -86,7 +86,6 @@ type Cluster struct {
                MaxKeepBlobBuffers             int
                MaxRequestAmplification        int
                MaxRequestSize                 int
-               RailsSessionSecretToken        string
                RequestTimeout                 Duration
                SendTimeout                    Duration
                WebsocketClientEventQueue      int

diff --git a/sdk/python/tests/run_test_server.py b/sdk/python/tests/run_test_server.py
index 0cb4151ac3b040292c0af4b5c8b5eef888b48096..4562a0654639415ad117b594d1f11ddb7ac36ff9 100644 (file)
--- a/sdk/python/tests/run_test_server.py
+++ b/sdk/python/tests/run_test_server.py
@@ -762,7 +762,6 @@ def setup_config():
                 "SystemRootToken": auth_token('system_user'),
                 "API": {
                     "RequestTimeout": "30s",
-                    "RailsSessionSecretToken": "e24205c490ac07e028fd5f8a692dcb398bcd654eff1aef5f9fe6891994b18483",
                 },
                 "Login": {
                     "SSO": {

diff --git a/services/api/config/arvados_config.rb b/services/api/config/arvados_config.rb
index 69b20420abac9c0c52ccb5aefbccbbfc3110b194..5327713f699e58771ef4060e4a71a1554ab4b87d 100644 (file)
--- a/services/api/config/arvados_config.rb
+++ b/services/api/config/arvados_config.rb
@@ -93,7 +93,6 @@ arvcfg.declare_config "API.MaxRequestSize", Integer, :max_request_size
 arvcfg.declare_config "API.MaxIndexDatabaseRead", Integer, :max_index_database_read
 arvcfg.declare_config "API.MaxItemsPerResponse", Integer, :max_items_per_response
 arvcfg.declare_config "API.AsyncPermissionsUpdateInterval", ActiveSupport::Duration, :async_permissions_update_interval
-arvcfg.declare_config "API.RailsSessionSecretToken", NonemptyString, :secret_token
 arvcfg.declare_config "Users.AutoSetupNewUsers", Boolean, :auto_setup_new_users
 arvcfg.declare_config "Users.AutoSetupNewUsersWithVmUUID", String, :auto_setup_new_users_with_vm_uuid
 arvcfg.declare_config "Users.AutoSetupNewUsersWithRepository", Boolean, :auto_setup_new_users_with_repository
@@ -297,5 +296,9 @@ Server::Application.configure do
   # Rails.configuration.API["Blah"]
   ConfigLoader.copy_into_config $arvados_config, config
   ConfigLoader.copy_into_config $remaining_config, config
-  secrets.secret_key_base = $arvados_config["API"]["RailsSessionSecretToken"]
+
+  # We don't rely on cookies for authentication, so instead of
+  # requiring a signing key in config, we assign a new random one at
+  # startup.
+  secrets.secret_key_base = rand(1<<255).to_s(36)
 end

diff --git a/tools/arvbox/lib/arvbox/docker/cluster-config.sh b/tools/arvbox/lib/arvbox/docker/cluster-config.sh
index 948eb00a559acfbb8f7ffaf48f8a79cbc9c8bfab..41771796a2524533de7954e35adabfef95b782ef 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/cluster-config.sh
+++ b/tools/arvbox/lib/arvbox/docker/cluster-config.sh
@@ -125,8 +125,6 @@ Clusters:
         password: ${database_pw}
         dbname: arvados_${database_env}
         client_encoding: utf8
-    API:
-      RailsSessionSecretToken: $secret_token
     Collections:
       BlobSigningKey: $blob_signing_key
       DefaultReplication: 1