Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for password functions (useful for RDS IAM auth) #554

Closed
wants to merge 4 commits into from

Conversation

@HLFrye
Copy link

@HLFrye HLFrye commented Apr 7, 2020

Resolves this issue: #553

@@ -601,6 +601,11 @@ def connection_lost(self, exc):
raise asyncio.TimeoutError

connected = _create_future(loop)

params_input = params
if callable(params.password):

This comment has been minimized.

@elprans

elprans Apr 7, 2020
Member

Please also add support for coroutines (via inspect.iscoroutinefunction()) to support async callbacks.

This comment has been minimized.

@HLFrye

HLFrye Apr 7, 2020
Author

Good point, updated the branch with support for async password callbacks and an additional test for that case as well.

await self._try_connect(
user='password_user',
password=get_wrongpassword)

This comment has been minimized.

@elprans

elprans Apr 7, 2020
Member

Looks like flake8 is unhappy about the extra newline here

await self._try_connect(
user='password_user',
password=get_wrongpassword)

This comment has been minimized.

@elprans

elprans Apr 7, 2020
Member

... and here

@elprans
elprans approved these changes Apr 8, 2020
Copy link
Member

@elprans elprans left a comment

LGTM. Please add a note about this to the connect() docstring. Thanks!

Harvey Frye added 2 commits Apr 8, 2020
@elprans elprans closed this in 1d9457f Apr 23, 2020
@Rigdon
Copy link

@Rigdon Rigdon commented Jul 29, 2020

@HLFrye Thanks so much for this change. I have a question though regarding RDS IAM before I open a new issue. I haven't been able to get this to connect to our RDS instance despite our callable generating valid tokens. I actually can't figure out how to get asyncpg to connect using a generated auth token at all, either by passing our callable or by generating the token and passing it directly into the password kwarg for asyncpg.connect(). I'm consistently getting an auth error:

InvalidAuthorizationSpecificationError: pg_hba.conf rejects connection for host ...

I've confirmed that I can use our same connection code to connect to a different postgres database using a standard password, and also that all of the values used and the token generated are valid and can be used to connect via psycopg2 and psql.

The code is about as simple as possible:

    db_kwargs = dict(
        min_size=5,
        max_size=25,
        host=config["hostname"],
        port=config["port"],
        user=config["username"],
        database=config["dbname"],
        password=config["password"],
        timeout=config["connect_timeout"],
    )
    database = databases.Database(
        url="postgres://",
        **db_kwargs
    )
    await database.connect()

where config["password"] is a callable that call an aiobotocore session's generate_db_auth_token

Any help would be greatly appreciated!

@HLFrye
Copy link
Author

@HLFrye HLFrye commented Jul 30, 2020

@Rigdon I've seen this error message occur when trying to connect without SSL enabled. The answers in this issue (#238) shows the process to set that up.

@Rigdon
Copy link

@Rigdon Rigdon commented Jul 30, 2020

@HLFrye That solved it! I went with the route described here. Thank you so much!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants
You can’t perform that action at this time.