Skip to content

Commit 13eb7d0

Browse files
committed
style/grammatical mods to the new README section.
1 parent fa9c559 commit 13eb7d0

1 file changed

Lines changed: 23 additions & 27 deletions

File tree

README.md

Lines changed: 23 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -132,68 +132,64 @@ required when they are placed in the environment file.
132132
Creating PAM or Native Credentials File (.irodsA)
133133
-------------------------------------------------
134134

135-
Two free functions exist which allow the user to create encoded authentication files
136-
for use in the client's iRODS login environment:
137-
```
138-
irods.client_init.write_native_irodsA_file
139-
irods.client_init.write_pam_irodsA_file
140-
```
135+
Use of following free functions will allow the creation of encoded authentication files for use in
136+
the client's iRODS login environment:
137+
- `irods.client_init.write_native_irodsA_file`
138+
- `irods.client_init.write_pam_irodsA_file`
141139

142140
These functions can roughly be described as duplicating the function of iinit (from iCommands),
143-
once a valid irods_environment.json has already been created.
141+
provided that a valid irods_environment.json has already been created.
144142

145143
Each takes a cleartext password and writes an appropriately processed version of it
146-
into an .irodsA "password" or "secrets" in the appropriate location.
144+
into an .irodsA "password" (also known as "credentials" or "secrets") file in the appropriate
145+
location. That location is `~/.irods/.irodsA` unless IRODS_AUTHENTICATION_FILE has been set
146+
in the command shell to dictate an alternative file path.
147147

148-
That location is ~/.irods/.irodsA) unless IRODS_AUTHENTICATION_FILE has
149-
been set with an alternate file path in the OS environment.
150-
151-
As an example, for the `native` authentication scheme, it is simple to create the
152-
.irodsA file directly:
148+
As an example, here we write a native .irodsA file using the first of the two functions. We
149+
pass in only the required argument, with its value determined by the input terminal via the
150+
Python `getpass` facility:
153151

154152
```bash
155153
$ echo '{ "irods_user_name":"rods", ... }'> ~/.irods/irods_environment.json
156154
$ python -c "import irods.client_init, getpass
157155
irods.client_init.write_native_irodsA_file(getpass.getpass('Enter iRODS password -> '))"
158156
```
159157

160-
If an .irodsA file already exists, it will be overwritten by default; however, if these functions'
158+
By default, if an .irodsA file already exists, it will be overwritten. If, however, these functions'
161159
overwrite parameter is set to `False`, an exception of type `irods.client_init.irodsA_already_exists`
162-
will be raised to warn of an older .irodsA file that might otherwise be overwritten.
160+
is raised to warn of any older .irodsA file that might otherwise have been overwritten.
163161

164-
Equivalently, we can issue the following command.
162+
Equivalently to the above, we can issue the following command.
165163

166164
```bash
167165
$ prc_write_irodsA.py native <<<"${MY_CURRENT_IRODS_PASSWORD}"
168166
```
169167

170-
The redirect may be left off, in which case the user is prompted for the iRODS password
171-
and echo of the keyboard input will be suppressed. (Regardless which technique is used,
172-
no password will be visible on the terminal during or after input.)
168+
Or the redirect may be left off, in which case the user is prompted for the iRODS password
169+
and echo of the keyboard input will be suppressed, in the style of iinit. Regardless
170+
which technique is used, no password will be visible on the terminal during or after input.
173171

174172
For the `pam_password` scheme, typically SSL/TLS must first be enabled to avoid sending data related
175173
to the password - or even sending the raw password itself - over a network connection in the clear.
176174

177175
Thus, for `pam_password` authentication to work well, we should first ensure when setting up the
178176
client environment that the `irods_environment.json` file includes the appropriate
179-
SSL/TLS connection parameters. If present, `iinit` can be used to verify this condition is fulfilled,
180-
as of course its invocation would create a valid .irodsA from merely prompting the user for their
181-
PAM password
177+
SSL/TLS connection parameters. If present, `iinit` can be used to verify this prerequisite is
178+
fulfilled, as in that case its invocation would create a valid .irodsA from merely prompting the user
179+
for their PAM password.
182180

183-
But if we wish to use the Python client for this purpose instead, we can run:
181+
Again, this can also be done either using the free function directly:
184182

185183
```python
186184
irods.client_init.write_pam_irodsA_file(getpass.getpass('Enter current PAM password -> '))
187185
```
188186

189-
Or from the Bash command shell, we simply run:
187+
or from the Bash command shell:
190188

191189
```bash
192190
$ prc_write_irodsA.py pam_password <<<"${MY_CURRENT_PAM_PASSWORD}"
193191
```
194192

195-
again leaving out the redirection if password prompting is preferable.
196-
197193
As a final note, in the "pam_password" scheme the default SSL requirement can be disabled (for purposes
198194
of testing only):
199195

@@ -209,7 +205,7 @@ home = session.collections.get('/tempZone/home/alice')
209205
```
210206

211207
Note however that in future releases of iRODS it is possible that extra SSL checking could be
212-
implemented server-side, at which point, the above code could not be guaranteed to work.
208+
implemented server-side, at which point the above code could not be guaranteed to work.
213209

214210
Legacy (iRODS 4.2-compatible) PAM authentication
215211
------------------------------------------------

0 commit comments

Comments
 (0)