Dataikuapi is not correctly honoring "DKU_NO_CHECK_CERTIFICATE" in requests

Open
#243 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
api, backend

Research direction

Start by reading DSSClient and _perform_http in dataikuapi/dssclient.py, then trace how sessions are created through api_client() and set_remote_dss(). Determine whether certificate verification settings can be propagated without relying on the closed-source dataiku package. Done means requests honor DKU_NO_CHECK_CERTIFICATE and the configured no_check_certificate value when using self-signed certificates.

Written by the indexing model from the issue text.

Description

In theory, Dataiku supports using self-signed certificates by setting e.g. using an environmental variable DKU_NO_CHECK_CERTIFICATE or by setting no_check_certificate=True in the set_remote function call of the non-open source dataiku package.

However, this parameter is not passed to the api_client(), which causes requests to fail which are made to Dataiku instances using self-signed certificates. It is possible to mitigate this by setting the verify value of the internal Session object to false:

client = dataiku.api_client()
client._session.verify = False

Which is not obvious and requires looking through the internals of the package.

A fix at the central call site of the dataikuapi package, _perform_http:
https://github.com/dataiku/dataiku-api-client-python/blob/fc51e29a12a1f50717771522e1b450ae91ff4d87/dataikuapi/dssclient.py#L1228-L1233
would only be possible in parts by duplicating the logic to check the "DKU_NO_CHECK_CERTIFICATE" variable or config files, but would still fail for Dataiku session set up by using the set_remote_dss function call.

The best option would be to add a "no_check_certificate" parameter to the DSSClient class that can be set when creating an instance of the class. But as the DSSClient is also used by the closed-source dataiku package, it seems to me that this can't be solved by contributing to the open source dataikuapi package.

Dominant language
Python
Stars
44
Forks
29
Avg merge
3h 34m
Merged PRs (30d)
2

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dataiku/dataiku-api-client-python

All issues in dataiku/dataiku-api-client-python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.