Roles documentation about sregistry

[vsoch]

How's this?

https://singularityhub.github.io/sregistry/setup.html#roles

[victorsndvg]

Yes perfect! 👏

mmm only 2 more questions:

Can a superuser change the image ownership (programatically)?
Can a superuser change the image privacy (programatically)?

thanks!

[vsoch]

yes a superuser can do anything (akin to root) although it must be from the back end (the shell into the Docker image). A superuser thus could programmatically do either of those things.

[victorsndvg]

Ok, nice!

Where can I read about how to do that?

[vsoch]

Take a look here: https://docs.djangoproject.com/en/1.11/topics/db/queries/

shell into the image:

$ python manage.py shell

and then you can interactively test querying the models. For example:

$ from shub.apps.main.models import *
Container.objects.count()
container = Container.objects.last()

$ from shub.apps.users.models import User
user = User.objects.filter(username="vsoch")
collection = Collection.objects.filter(owner=user)

etc. How about give that a try, write down what you do, and post any trouble you have here. There are also scripts that you can write called management commands, under an application folder (eg, apps/main/management/commands) that then are run directly as scripts, eg:

python manage.py my_script

so if you have a common function that you want to do many times, that's the easiest way to do it. If it's something others would want I'd be happy to add to the global application (eg, this is like the script you used to create superusers and administrations) see here --> https://docs.djangoproject.com/en/1.11/howto/custom-management-commands/

ok I'm going back to sleep :)

[victorsndvg]

Thanks for the quick response as always!

Closing ...

[victorsndvg]

Sorry, a new one to be answered after sleep ...

Is possible to programatically get a user token?

[vsoch]

Yes, you would use the same lines in the function that generates the view, and then save it to file or print to screen from the management. What use case did you have in mind for this? Either way, the user would have to get something from you (in json) and save to his or her home folder, so it seems like extra work for you to do it (versus just giving them a link in the browser).

[victorsndvg]

Yeah ... I answer myself:

user = User.objects.get(username=options['username'])
user.token()

[vsoch]

woohoo! Yes I added a function to the user model, here --> https://github.com/singularityhub/sregistry/blob/master/shub/apps/users/models.py#L61 that points to this function --> https://github.com/singularityhub/sregistry/blob/master/shub/apps/users/utils.py#L34 that does a get or create sort of deal.

[vsoch]

It's a nice trick in django that functions associated with model objects can easily be added to the model class, and then available from the model without needing to add extra context variables to any view :)

[victorsndvg]

The use case is not completely clear, is why i'm trying different scenarios.
Some assumptions are:

• We have to provide public/private images
• Users will not interact with the Web UI
  • Maybe only the admin interact and performs all actions
  • Maybe the users can interact, but without being aware of the sregistry (orchestrater)

[victorsndvg]

Awake again? 😅

Great, thanks for clarifying! ... this is why it was so easy to find the solution. Thanks for your effort!

[vsoch]

Haha you keep re-opening the issue! I would first consider how you are doing authentication if the user isn't given access to the web UI. Perhaps try out the LDAP authentication that was just added? What you would want to do is have user accounts generated programmatically, then a script that generates the token files for the users for one or more accounts. Then you can add to their homes for them, or send in another way.

[victorsndvg]

Yes, one option is to interact from users account at the HPC ... (sure for pulling ... but not for pushing),
But other option is to push to SRegistry from an intermediate cloud layer without the need to now anything more than the user name (and maybe ssh keys - to think)

I will play with LDAP too, but first I think I'm going to reopen another issue 🤣