@@ -132,68 +132,64 @@ required when they are placed in the environment file.
132132Creating PAM or Native Credentials File (.irodsA)
133133-------------------------------------------------
134134
135- Two free functions exist which allow the user to create encoded authentication files
136- for use in the client's iRODS login environment:
137- ```
138- irods.client_init.write_native_irodsA_file
139- irods.client_init.write_pam_irodsA_file
140- ```
135+ Use of following free functions will allow the creation of encoded authentication files for use in
136+ the client's iRODS login environment:
137+ - ` irods.client_init.write_native_irodsA_file `
138+ - ` irods.client_init.write_pam_irodsA_file `
141139
142140These functions can roughly be described as duplicating the function of iinit (from iCommands),
143- once a valid irods_environment.json has already been created.
141+ provided that a valid irods_environment.json has already been created.
144142
145143Each takes a cleartext password and writes an appropriately processed version of it
146- into an .irodsA "password" or "secrets" in the appropriate location.
144+ into an .irodsA "password" (also known as "credentials" or "secrets") file in the appropriate
145+ location. That location is ` ~/.irods/.irodsA ` unless IRODS_AUTHENTICATION_FILE has been set
146+ in the command shell to dictate an alternative file path.
147147
148- That location is ~ /.irods/.irodsA) unless IRODS_AUTHENTICATION_FILE has
149- been set with an alternate file path in the OS environment.
150-
151- As an example, for the ` native ` authentication scheme, it is simple to create the
152- .irodsA file directly:
148+ As an example, here we write a native .irodsA file using the first of the two functions. We
149+ pass in only the required argument, with its value determined by the input terminal via the
150+ Python ` getpass ` facility:
153151
154152``` bash
155153$ echo ' { "irods_user_name":"rods", ... }' > ~ /.irods/irods_environment.json
156154$ python -c " import irods.client_init, getpass
157155irods.client_init.write_native_irodsA_file(getpass.getpass('Enter iRODS password -> '))"
158156```
159157
160- If an .irodsA file already exists, it will be overwritten by default; however, if these functions'
158+ By default, if an .irodsA file already exists, it will be overwritten. If, however, these functions'
161159overwrite parameter is set to ` False ` , an exception of type ` irods.client_init.irodsA_already_exists `
162- will be raised to warn of an older .irodsA file that might otherwise be overwritten.
160+ is raised to warn of any older .irodsA file that might otherwise have been overwritten.
163161
164- Equivalently, we can issue the following command.
162+ Equivalently to the above , we can issue the following command.
165163
166164``` bash
167165$ prc_write_irodsA.py native <<< " ${MY_CURRENT_IRODS_PASSWORD}"
168166```
169167
170- The redirect may be left off, in which case the user is prompted for the iRODS password
171- and echo of the keyboard input will be suppressed. (Regardless which technique is used,
172- no password will be visible on the terminal during or after input.)
168+ Or the redirect may be left off, in which case the user is prompted for the iRODS password
169+ and echo of the keyboard input will be suppressed, in the style of iinit. Regardless
170+ which technique is used, no password will be visible on the terminal during or after input.
173171
174172For the ` pam_password ` scheme, typically SSL/TLS must first be enabled to avoid sending data related
175173to the password - or even sending the raw password itself - over a network connection in the clear.
176174
177175Thus, for ` pam_password ` authentication to work well, we should first ensure when setting up the
178176client environment that the ` irods_environment.json ` file includes the appropriate
179- SSL/TLS connection parameters. If present, ` iinit ` can be used to verify this condition is fulfilled,
180- as of course its invocation would create a valid .irodsA from merely prompting the user for their
181- PAM password
177+ SSL/TLS connection parameters. If present, ` iinit ` can be used to verify this prerequisite is
178+ fulfilled, as in that case its invocation would create a valid .irodsA from merely prompting the user
179+ for their PAM password.
182180
183- But if we wish to use the Python client for this purpose instead, we can run :
181+ Again, this can also be done either using the free function directly :
184182
185183``` python
186184irods.client_init.write_pam_irodsA_file(getpass.getpass(' Enter current PAM password -> ' ))
187185```
188186
189- Or from the Bash command shell, we simply run :
187+ or from the Bash command shell:
190188
191189``` bash
192190$ prc_write_irodsA.py pam_password <<< " ${MY_CURRENT_PAM_PASSWORD}"
193191```
194192
195- again leaving out the redirection if password prompting is preferable.
196-
197193As a final note, in the "pam_password" scheme the default SSL requirement can be disabled (for purposes
198194of testing only):
199195
@@ -209,7 +205,7 @@ home = session.collections.get('/tempZone/home/alice')
209205```
210206
211207Note however that in future releases of iRODS it is possible that extra SSL checking could be
212- implemented server-side, at which point, the above code could not be guaranteed to work.
208+ implemented server-side, at which point the above code could not be guaranteed to work.
213209
214210Legacy (iRODS 4.2-compatible) PAM authentication
215211------------------------------------------------
0 commit comments