Skip to content

Commit 97e696b

Browse files
[Network Drive] Fix DLS file permission check not properly taking credentials (#3873)
## Follow up for #3868 For some reason code that handles file permissions did not pass credentials to the `open_file` method. This caused DLS syncs to fail with an error: ``` Traceback (most recent call last): File "/app/connectors/es/sink.py", line 514, in run await self.get_docs(sanitized_generator) File "/app/connectors/es/sink.py", line 568, in get_docs async for count, doc in aenumerate(generator): File "/app/connectors/utils.py", line 861, in aenumerate async for elem in asequence: File "/app/connectors/logger.py", line 244, in __anext__ return await self.gen.__anext__() ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/connectors/es/sink.py", line 550, in _decorate_with_metrics_span async for doc in generator: File "/app/connectors/es/sink.py", line 508, in <genexpr> sanitized_generator = ( ^ File "/app/connectors/sync_job_runner.py", line 420, in prepare_docs async for doc, lazy_download, operation in self.generator(): File "/app/connectors/sync_job_runner.py", line 456, in generator async for doc, lazy_download in self.data_provider.get_docs( File "/app/connectors/sources/network_drive.py", line 919, in get_docs await self._decorate_with_access_control( File "/app/connectors/sources/network_drive.py", line 727, in _decorate_with_access_control allow_permissions, deny_permissions = await self.get_entity_permission( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/connectors/sources/network_drive.py", line 850, in get_entity_permission list_permissions = await asyncio.to_thread( ^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/asyncio/threads.py", line 25, in to_thread return await loop.run_in_executor(None, func_call) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/concurrent/futures/thread.py", line 58, in run result = self.fn(*self.args, **self.kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/connectors/sources/network_drive.py", line 697, in list_file_permission with smbclient.open_file( ^^^^^^^^^^^^^^^^^^^^ File "/app/.venv/lib/python3.11/site-packages/smbclient/_os.py", line 382, in open_file raw_fd = file_class( ^^^^^^^^^^^ File "/app/.venv/lib/python3.11/site-packages/smbclient/_io.py", line 353, in __init__ tree, fd_path = get_smb_tree(path, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/.venv/lib/python3.11/site-packages/smbclient/_pool.py", line 304, in get_smb_tree session = register_session( ^^^^^^^^^^^^^^^^^ File "/app/.venv/lib/python3.11/site-packages/smbclient/_pool.py", line 422, in register_session session.connect() File "/app/.venv/lib/python3.11/site-packages/smbprotocol/session.py", line 288, in connect raise SMBAuthenticationError("Failed to authenticate with server: %s" % str(err.message)) smbprotocol.exceptions.SMBAuthenticationError: Failed to authenticate with server: SpnegoError (1): SpnegoError (16): Operation not supported or available, Context: No username or password was specified and the credential cache did not exist or contained no credentials, Context: Unable to negotiate common mechanism ``` This PR fixes it by providing credentials needed for the call. Fun side-effect was that 2 places did not use connection cache, so when files were downloaded a different connection was created - this caused DLS bug, because original connection with credentials was in local cache, and when file permissions were downloaded a new connection was created without credentials causing the bug. ## Checklists <!--You can remove unrelated items from checklists below and/or add new items that may help during the review.--> #### Pre-Review Checklist - [x] this PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check `config.yml.example`) - [x] this PR has a meaningful title - [x] this PR links to all relevant github issues that it fixes or partially addresses - [ ] if there is no GH issue, please create it. Each PR should have a link to an issue - [x] this PR has a thorough description - [ ] Covered the changes with automated tests - [x] Tested the changes locally - [ ] Added a label for each target release version (example: `v7.13.2`, `v7.14.0`, `v8.0.0`) - [ ] For bugfixes: backport safely to all minor branches still receiving patch releases - [ ] Considered corresponding documentation changes - [ ] Contributed any configuration settings changes to the configuration reference - [ ] if you added or changed Rich Configurable Fields for a Native Connector, you made a corresponding PR in [Kibana](https://github.com/elastic/kibana/blob/main/packages/kbn-search-connectors/types/native_connectors.ts) --------- Co-authored-by: Elastic Machine <[email protected]>
1 parent b89f3a7 commit 97e696b

File tree

2 files changed

+5
-1
lines changed

2 files changed

+5
-1
lines changed

app/connectors_service/NOTICE.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1628,7 +1628,7 @@ SOFTWARE.
16281628

16291629

16301630
anyio
1631-
4.11.0
1631+
4.12.0
16321632
UNKNOWN
16331633
The MIT License (MIT)
16341634

app/connectors_service/connectors/sources/network_drive/datasource.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,7 @@ async def fetch_file_content(self, path):
384384
username=self.username,
385385
password=self.password,
386386
port=self.port,
387+
connection_cache=self._connection_cache,
387388
) as file:
388389
chunk = True
389390
while chunk:
@@ -437,7 +438,10 @@ def list_file_permission(self, file_path, file_type, mode, access):
437438
buffering=0,
438439
file_type=file_type,
439440
desired_access=access,
441+
username=self.username,
442+
password=self.password,
440443
port=self.port,
444+
connection_cache=self._connection_cache,
441445
) as file:
442446
descriptor = self.security_info.get_descriptor(
443447
file_descriptor=file.fd, info=SECURITY_INFO_DACL

0 commit comments

Comments
 (0)