Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for password functions (useful for RDS IAM auth) #554

Closed
wants to merge 4 commits into from

Conversation

HLFrye
Copy link

@HLFrye HLFrye commented Apr 7, 2020

Resolves this issue: #553

@@ -601,6 +601,11 @@ def connection_lost(self, exc):
raise asyncio.TimeoutError

connected = _create_future(loop)

params_input = params
if callable(params.password):
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please also add support for coroutines (via inspect.iscoroutinefunction()) to support async callbacks.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point, updated the branch with support for async password callbacks and an additional test for that case as well.

await self._try_connect(
user='password_user',
password=get_wrongpassword)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like flake8 is unhappy about the extra newline here

await self._try_connect(
user='password_user',
password=get_wrongpassword)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

... and here

Copy link
Member

@elprans elprans left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Please add a note about this to the connect() docstring. Thanks!

@elprans elprans closed this in 1d9457f Apr 23, 2020
@Rigdon
Copy link

Rigdon commented Jul 29, 2020

@HLFrye Thanks so much for this change. I have a question though regarding RDS IAM before I open a new issue. I haven't been able to get this to connect to our RDS instance despite our callable generating valid tokens. I actually can't figure out how to get asyncpg to connect using a generated auth token at all, either by passing our callable or by generating the token and passing it directly into the password kwarg for asyncpg.connect(). I'm consistently getting an auth error:

InvalidAuthorizationSpecificationError: pg_hba.conf rejects connection for host ...

I've confirmed that I can use our same connection code to connect to a different postgres database using a standard password, and also that all of the values used and the token generated are valid and can be used to connect via psycopg2 and psql.

The code is about as simple as possible:

    db_kwargs = dict(
        min_size=5,
        max_size=25,
        host=config["hostname"],
        port=config["port"],
        user=config["username"],
        database=config["dbname"],
        password=config["password"],
        timeout=config["connect_timeout"],
    )
    database = databases.Database(
        url="postgres://",
        **db_kwargs
    )
    await database.connect()

where config["password"] is a callable that call an aiobotocore session's generate_db_auth_token

Any help would be greatly appreciated!

@HLFrye
Copy link
Author

HLFrye commented Jul 30, 2020

@Rigdon I've seen this error message occur when trying to connect without SSL enabled. The answers in this issue (#238) shows the process to set that up.

@Rigdon
Copy link

Rigdon commented Jul 30, 2020

@HLFrye That solved it! I went with the route described here. Thank you so much!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants