Index: third_party/gsutil/plugins/sso_auth.py |
diff --git a/third_party/gsutil/plugins/sso_auth.py b/third_party/gsutil/plugins/sso_auth.py |
deleted file mode 100644 |
index 6f23ca43b6513f4b6aa03e86bb42451fd8fc8791..0000000000000000000000000000000000000000 |
--- a/third_party/gsutil/plugins/sso_auth.py |
+++ /dev/null |
@@ -1,105 +0,0 @@ |
-# Copyright 2013 The Chromium Authors. All rights reserved. |
-# Use of this source code is governed by a BSD-style license that can be |
-# found in the LICENSE file. |
- |
-"""AuthHandler plugin for gsutil's boto to support LOAS based auth.""" |
- |
-import getpass |
-import json |
-import os |
-import re |
-import subprocess |
-import time |
-import urllib2 |
- |
-from boto.auth_handler import AuthHandler |
-from boto.auth_handler import NotReadyToAuthenticate |
- |
-CMD = ['stubby', '--proto2', 'call', 'blade:sso', 'CorpLogin.Exchange'] |
- |
-STUBBY_CMD = """target: { |
- scope: GAIA_USER |
- name: "%s" |
-} |
-target_credential: { |
- type: OAUTH2_TOKEN |
- oauth2_attributes: { |
- scope: 'https://www.googleapis.com/auth/devstorage.read_write' |
- } |
-}""" |
- |
-COOKIE_LOCATION = os.path.expanduser('~/.devstore_token') |
- |
-TOKEN_EXPIRY = 300 |
- |
- |
-class SSOAuthError(Exception): |
- pass |
- |
- |
-class SSOAuth(AuthHandler): |
- """SSO based auth handler.""" |
- |
- capability = ['google-oauth2', 's3'] |
- |
- def __init__(self, path, config, provider): |
- if provider.name == 'google' and self.has_prodaccess(): |
- # If we don't have a loas token, then bypass this auth handler. |
- if subprocess.call(['loas_check', '-loas_check_retry_attempts=0'], |
- stdout=subprocess.PIPE, |
- stderr=subprocess.PIPE): |
- raise NotReadyToAuthenticate() |
- else: |
- raise NotReadyToAuthenticate() |
- self.token = None |
- self.expire = 0 |
- |
- def GetAccessToken(self): |
- """Returns a valid devstore access token. |
- |
- This will return from an in-memory cache if the token is there already, |
- then try a filesystem cache, and then runs a stubby call if none of the |
- caches have a valid token. |
- """ |
- if self.token and self.expire > time.time(): |
- return self.token |
- |
- # Try to retrieve token from filesystem cache. |
- if os.path.exists(COOKIE_LOCATION): |
- last_modified = os.path.getmtime(COOKIE_LOCATION) |
- if time.time() - last_modified < TOKEN_EXPIRY: |
- with open(COOKIE_LOCATION, 'rb') as f: |
- self.token = f.read() |
- self.expire = last_modified + TOKEN_EXPIRY |
- return self.token |
- |
- # If the token is not in either caches, or has expired, then fetch token. |
- username = '%s@google.com' % getpass.getuser() |
- proc = subprocess.Popen(CMD, stdin=subprocess.PIPE, stdout=subprocess.PIPE) |
- out, err = proc.communicate(STUBBY_CMD % username) |
- if proc.returncode: |
- raise SSOAuthError('Stubby returned %d\n%s' % (proc.returncode, err)) |
- token_match = re.search(r'oauth2_token: "(.*)"$', out) |
- |
- if not token_match: |
- raise SSOAuthError('Oauth2 token not found in %s' % out) |
- |
- token = token_match.group(1) |
- self.token = token |
- self.expire = time.time() + TOKEN_EXPIRY |
- with os.fdopen(os.open(COOKIE_LOCATION, |
- os.O_WRONLY | os.O_CREAT, |
- 0600), 'wb') as f: |
- f.write(token) |
- return token |
- |
- def add_auth(self, http_request): |
- http_request.headers['Authorization'] = 'OAuth %s' % self.GetAccessToken() |
- |
- @staticmethod |
- def has_prodaccess(): |
- for path in os.environ['PATH'].split(os.pathsep): |
- exe_file = os.path.join(path, 'prodaccess') |
- if os.path.exists(exe_file) and os.access(exe_file, os.X_OK): |
- return True |
- return False |