From be65a0ff81e465f770e70e31ab14dee8411b54d5 Mon Sep 17 00:00:00 2001
From: Matt Jia <mjia@redhat.com>
Date: Mon, 20 Feb 2017 16:52:54 +1000
Subject: [PATCH 1/2] allow to explicitly disable client authentication

---
 conf/config.py                 | 3 +++
 module_build_service/auth.py   | 4 ++++
 module_build_service/config.py | 4 ++++
 tests/test_auth.py             | 5 +++++
 4 files changed, 16 insertions(+)

diff --git a/conf/config.py b/conf/config.py
index a4c691ef..c0c90571 100644
--- a/conf/config.py
+++ b/conf/config.py
@@ -86,6 +86,9 @@ class BaseConfiguration(object):
     AMQ_PRIVATE_KEY_FILE = '/etc/module_build_service/msg-m8y-client.key'
     AMQ_TRUSTED_CERT_FILE = '/etc/module_build_service/Root-CA.crt'
 
+    # Disable Client Authorization
+    NO_AUTH = False
+
 
 class DevConfiguration(BaseConfiguration):
     DEBUG = True
diff --git a/module_build_service/auth.py b/module_build_service/auth.py
index 2fb2ee35..5066b760 100644
--- a/module_build_service/auth.py
+++ b/module_build_service/auth.py
@@ -92,6 +92,10 @@ def get_user(request):
     Returns the client's username and groups based on the OIDC token provided.
     """
 
+    if app.config['NO_AUTH']:
+        log.debug("Authorization is disabled.")
+        return
+
     _load_secrets()
 
     if not "oidc_token" in request.cookies:
diff --git a/module_build_service/config.py b/module_build_service/config.py
index 3b906618..33bd2fc2 100644
--- a/module_build_service/config.py
+++ b/module_build_service/config.py
@@ -280,6 +280,10 @@ class Config(object):
             'type': int,
             'default': 30,
             'desc': 'Global network retry interval for read/write operations, in seconds.'},
+        'no_auth': {
+            'type': bool,
+            'default': False,
+            'desc': 'Disable client authentication.'},
     }
 
     def __init__(self, conf_section_obj):
diff --git a/tests/test_auth.py b/tests/test_auth.py
index 6869c8ce..e8652d7c 100644
--- a/tests/test_auth.py
+++ b/tests/test_auth.py
@@ -62,3 +62,8 @@ class TestAuthModule(unittest.TestCase):
         request.cookies.return_value = {"oidc_token", "1234"}
         result = module_build_service.auth.get_user(request)
         eq_(result, name)
+
+    def test_disable_authentication(self):
+        with patch.dict('module_build_service.app.config', {'NO_AUTH': True}, clear=True):
+            request = mock.MagicMock()
+            eq_(module_build_service.auth.get_user(request), None)

From 143effcd153d74d0c99ed4e51f4edbb1701e6846 Mon Sep 17 00:00:00 2001
From: Matt Jia <mjia@redhat.com>
Date: Tue, 21 Feb 2017 11:03:25 +1000
Subject: [PATCH 2/2] Error out if OIDC_CLIENT_SECRETS is not set in server
 config

---
 module_build_service/auth.py | 3 +--
 tests/test_auth.py           | 5 +++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/module_build_service/auth.py b/module_build_service/auth.py
index 5066b760..0228c7bd 100644
--- a/module_build_service/auth.py
+++ b/module_build_service/auth.py
@@ -44,8 +44,7 @@ def _load_secrets():
         return
 
     if not "OIDC_CLIENT_SECRETS" in app.config:
-        log.warn("To support authorization, OIDC_CLIENT_SECRETS has to be set.")
-        return
+        raise Unauthorized("OIDC_CLIENT_SECRETS must be set in server config.")
 
     secrets = _json_loads(open(app.config['OIDC_CLIENT_SECRETS'],
                                 'r').read())
diff --git a/tests/test_auth.py b/tests/test_auth.py
index e8652d7c..3a6258c4 100644
--- a/tests/test_auth.py
+++ b/tests/test_auth.py
@@ -67,3 +67,8 @@ class TestAuthModule(unittest.TestCase):
         with patch.dict('module_build_service.app.config', {'NO_AUTH': True}, clear=True):
             request = mock.MagicMock()
             eq_(module_build_service.auth.get_user(request), None)
+
+    @raises(module_build_service.errors.Unauthorized)
+    def test_misconfiguring_oidc_client_secrets_should_be_failed(self):
+        request = mock.MagicMock()
+        module_build_service.auth.get_user(request)