SDP-893
Open
Add optional method to prevent SDP P4USER from logging in without -a.
When run on a p4d server with multiple network interfaces, a super user ticket
generated with 'p4 login' will break extensions and triggers, including breaking
HAS. A 'p4 login -a' ticket is required for proper behavior.
In SDP, the 'p4login' script, when used, generates the correct type of ticket
(a '-a' ticket). The SDP scripts know to use this. However, there is no way to
ensure that human admin won't run a 'p4 login' command (without the '-a'),
resulting in extensiosns and triggers failing due to a bogus ticket.
We should add something to the SDP to prevent the human admin from doing the
wrong thing, i.e. logging in the 'perforce' super user with the wrong kind of
ticket.
Some options:
* Request a p4d change to require '-a' login tickets.
* Add a pre-commmand trigger so the perforce OS user, that rejects 'p4 login' without '-a'.
* Add a broker REWRITE feature to implicitly add '-a' to 'p4 login' commands. (That won't
be of much use though, since an admin working on the server generally uses a P4PORT
value that bypasses the broker).
When run on a p4d server with multiple network interfaces, a super user ticket
generated with 'p4 login' will break extensions and triggers, including breaking
HAS. A 'p4 login -a' ticket is required for proper behavior.
In SDP, the 'p4login' script, when used, generates the correct type of ticket
(a '-a' ticket). The SDP scripts know to use this. However, there is no way to
ensure that human admin won't run a 'p4 login' command (without the '-a'),
resulting in extensiosns and triggers failing due to a bogus ticket.
We should add something to the SDP to prevent the human admin from doing the
wrong thing, i.e. logging in the 'perforce' super user with the wrong kind of
ticket.
Some options:
* Request a p4d change to require '-a' login tickets.
* Add a pre-commmand trigger so the perforce OS user, that rejects 'p4 login' without '-a'.
* Add a broker REWRITE feature to implicitly add '-a' to 'p4 login' commands. (That won't
be of much use though, since an admin working on the server generally uses a P4PORT
value that bypasses the broker).
- Status
- Open
- Project
- perforce-software-sdp
- Severity
- C
- Reported By
- C. Thomas Tyler
- Reported Date
- 2 years ago
- Modified By
- C. Thomas Tyler
- Modified Date
- 2 years ago
- Owned By
- tom_tyler
- Component
- core-unix
- Type
- Feature
Log in to comment