Repository: rucio/rucio

Issue:
Unhelpful error message for certificates with incorrect permissions
Motivation
----------
Using auth_type=x509, authentication fails when the personal certificate and private key have not the permission 400. Mines had 600. And I got the following error message.

```
$ rucio whoami
Internal error: Request for authentication token returned no result!
2020-10-13 08:58:00,389    ERROR    Cannot authenticate.
Details: x509 authentication failed for account=pchanial with identity={'client_cert': '/opt/rucio/etc/client.crt', 'client_key': '/opt/rucio/etc/client.key'}

```

Modification
------------
Certificate permissions should be checked and the user should be told what to do to fix it if they are not 400, to prevent wasting time on checking the validity of his/her certificates.




Discussion:

Resolving patch:
diff --git a/lib/rucio/client/baseclient.py b/lib/rucio/client/baseclient.py
--- a/lib/rucio/client/baseclient.py
+++ b/lib/rucio/client/baseclient.py
@@ -1,4 +1,5 @@
-# Copyright 2012-2020 CERN for the benefit of the ATLAS collaboration.
+# -*- coding: utf-8 -*-
+# Copyright 2012-2020 CERN
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -19,23 +20,21 @@
 # - Mario Lassnig <mario.lassnig@cern.ch>, 2013-2020
 # - Cedric Serfon <cedric.serfon@cern.ch>, 2014-2020
 # - Ralph Vigne <ralph.vigne@cern.ch>, 2015
-# - Joaquin Bogado <jbogado@linti.unlp.edu.ar>, 2015-2018
-# - Martin Barisits <martin.barisits@cern.ch>, 2016-2019
+# - Joaquín Bogado <jbogado@linti.unlp.edu.ar>, 2015-2018
+# - Martin Barisits <martin.barisits@cern.ch>, 2016-2020
 # - Tobias Wegner <twegner@cern.ch>, 2017
 # - Brian Bockelman <bbockelm@cse.unl.edu>, 2017-2018
 # - Robert Illingworth <illingwo@fnal.gov>, 2018
 # - Hannes Hansen <hannes.jakob.hansen@cern.ch>, 2018
-# - Tomas Javurek <tomas.javurek@cern.ch>, 2019
+# - Tomas Javurek <tomas.javurek@cern.ch>, 2019-2020
 # - Brandon White <bjwhite@fnal.gov>, 2019
 # - Ruturaj Gujar <ruturaj.gujar23@gmail.com>, 2019
-# - Eric Vaandering <ericvaandering@gmail.com>, 2019
+# - Eric Vaandering <ewv@fnal.gov>, 2019
 # - Jaroslav Guenther <jaroslav.guenther@cern.ch>, 2019-2020
 # - Andrew Lister <andrew.lister@stfc.ac.uk>, 2019
 # - Eli Chadwick <eli.chadwick@stfc.ac.uk>, 2020
 # - Patrick Austin <patrick.austin@stfc.ac.uk>, 2020
 # - Benedikt Ziemons <benedikt.ziemons@cern.ch>, 2020
-#
-# PY3K COMPATIBLE
 
 '''
  Client class for callers of the Rucio system
@@ -216,7 +215,15 @@ def __init__(self, rucio_host=None, auth_host=None, account=None, ca_cert=None,
                     self.creds['password'] = config_get('client', 'password')
                 elif self.auth_type == 'x509':
                     self.creds['client_cert'] = path.abspath(path.expanduser(path.expandvars(config_get('client', 'client_cert'))))
+                    if not path.exists(self.creds['client_cert']):
+                        raise MissingClientParameter('X.509 client certificate not found: %s' % self.creds['client_cert'])
                     self.creds['client_key'] = path.abspath(path.expanduser(path.expandvars(config_get('client', 'client_key'))))
+                    if not path.exists(self.creds['client_key']):
+                        raise MissingClientParameter('X.509 client key not found: %s' % self.creds['client_key'])
+                    else:
+                        perms = oct(os.stat(self.creds['client_key']).st_mode)[-3:]
+                        if int(perms[-2]) > 0 or int(perms[-1]) > 0:
+                            raise CannotAuthenticate('X.509 authentication selected, but private key (%s) permissions are liberal (minimum expected: 0400, found %s)' % (self.creds['client_key'], perms))
                 elif self.auth_type == 'x509_proxy':
                     try:
                         self.creds['client_proxy'] = path.abspath(path.expanduser(path.expandvars(config_get('client', 'client_x509_proxy'))))


Test patch:
diff --git a/etc/docker/test/centos7.Dockerfile b/etc/docker/test/centos7.Dockerfile
--- a/etc/docker/test/centos7.Dockerfile
+++ b/etc/docker/test/centos7.Dockerfile
@@ -84,7 +84,8 @@ RUN cp etc/certs/hostcert_rucio.pem /etc/grid-security/hostcert.pem && \
     rm /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/autoindex.conf /etc/httpd/conf.d/userdir.conf /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/zgridsite.conf && \
     cp etc/certs/rucio_ca.pem etc/rucio_ca.pem && \
     cp etc/certs/ruciouser.pem etc/ruciouser.pem && \
-    cp etc/certs/ruciouser.key.pem etc/ruciouser.key.pem
+    cp etc/certs/ruciouser.key.pem etc/ruciouser.key.pem && \
+    chmod 0400 etc/ruciouser.key.pem
 
 RUN rpm -i etc/docker/test/extra/oic.rpm; \
     echo "/usr/lib/oracle/12.2/client64/lib" >/etc/ld.so.conf.d/oracle.conf; \