Python CSC Electronic Office
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

122 lines
4.3 KiB

2 years ago
# pyceo
2 years ago
[![Build Status](](
2 years ago
CEO (**C**SC **E**lectronic **O**ffice) is the tool used by CSC to manage
club accounts and memberships. See []( for an
overview of its architecture.
2 years ago
## Development
First, make sure that you have installed the
[syscom dev environment](
This will setup all of the services needed for ceo to work. You should clone
this repo in the phosphoric-acid container under ctdalek's home directory; you
will then be able to access it from any container thanks to NFS.
2 years ago
### Environment setup
Once you have the dev environment setup, there are a few more steps you'll
need to do for ceo.
#### Kerberos principals
First, you'll need `ceod/<hostname>` principals for each of phosphoric-acid,
coffee and mail. (coffee is taking over the role of caffeine for the DB
endpoints). For example, in the phosphoric-acid container:
kadmin -p sysadmin/admin
<password is krb5>
addprinc -randkey ceod/phosphoric-acid.csclub.internal
ktadd ceod/phosphoric-acid.csclub.internal
Do this for coffee and mail as well. You need to actually be in the
appropriate container when running these commands, since the credentials
are being added to the local keytab.
On phosphoric-acid, you will additionally need to create a principal
called `ceod/admin` (remember to addprinc **and** ktadd).
#### Database
TODO - Andrew
#### Dependencies
2 years ago
Next, install and activate a virtualenv:
sudo apt install libkrb5-dev libsasl2-dev python3-dev
2 years ago
python3 -m venv venv
. venv/bin/activate
pip install -r requirements.txt
pip install -r dev-requirements.txt
#### C bindings
Due to the lack of a decent Python library for Kerberos we ended up
writing our own C bindings using [cffi](
Make sure you compile the bindings:
cd ceo_common/krb5
This should create a file named ''.
This will be imported by other modules in ceo.
## Running the application
ceod is a distributed application, with instances on different hosts offering
different services.
2 years ago
Therefore, you will need to run ceod on multiple hosts. Currently, those are
phosphoric-acid, mail and caffeine (in the dev environment, caffeine is
replaced by coffee).
To run ceod on a single host (as root, since the app needs to read the keytab):
2 years ago
export FLASK_APP=ceod.api
export FLASK_ENV=development
flask run -h -p 9987
Sometimes changes you make in the source code don't show up while Flask
is running. Stop the flask app (Ctrl-C), run ``, then
restart the app.
## Interacting with the application
2 years ago
The client part of ceo hasn't been written yet, so we'll use curl to
interact with ceod for now.
ceod uses [SPNEGO]( for authentication,
and TLS for confidentiality and integrity. In development mode, TLS can be
2 years ago
First, make sure that your version of curl has been compiled with SPNEGO
curl -V
Your should see 'SPNEGO' in the 'Features' section.
The API also uses unconstrained Kerberos delegation when interacting with
the LDAP database. This means that the client obtains a forwarded TGT, then
sends that to ceod, which then uses it to interact with LDAP on the client's
behalf. There is a script called `` which can generate this
ticket for you.
Here's an example of making a request to an endpoint which writes to LDAP:
2 years ago
# Get a Kerberos TGT first
# Obtain a forwarded TGT
./ phosphoric-acid
# Make the request
curl --negotiate -u : --service-name ceod \
-H "X-KRB5-CRED: $(cat cred)" \
-d '{"uid":"test_1","cn":"Test One","program":"Math","terms":["s2021"]}' \
-X POST http://phosphoric-acid:9987/api/members
2 years ago
## Miscellaneous
### Mailman
You may wish to add more mailing lists to Mailman; by default, only the
csc-general list exists (from the dev environment playbooks). Just
attach to the mail container and run the following:
/opt/mailman3/bin/mailman create new_list_name@csclub.internal
for instructions on how to access the Mailman UI from your browser.