feat: Add /DiracX/EnabledVOs to the CS for enabling DiracX

docs/source/AdministratorGuide/ServerInstallations/environment_variable_configuration.rst

@@ -21,9 +21,6 @@ DIRAC_DEPRECATED_FAIL
 DIRAC_ENABLE_DIRACX_JOB_MONITORING
   If set, calls the diracx job monitoring service. Off by default.
 
-DIRAC_ENABLE_DIRACX_LOGIN
-  If set, retrieve a DiracX token when calling dirac-proxy-init or dirac-login
-
 DIRAC_FEWER_CFG_LOCKS
   If ``true`` or ``yes`` or ``on`` or ``1`` or ``y`` or ``t``, DIRAC will reduce the number of locks used when accessing the CS for better performance (default, ``no``).
 

integration_tests.py

@@ -35,10 +35,7 @@
     "DIRAC_USE_JSON_ENCODE": None,
     "INSTALLATION_BRANCH": "",
 }
-DIRACX_OPTIONS = (
-    "DIRAC_ENABLE_DIRACX_LOGIN",
-    "DIRAC_ENABLE_DIRACX_JOB_MONITORING",
-)
+DIRACX_OPTIONS = ("DIRAC_ENABLE_DIRACX_JOB_MONITORING",)
 DEFAULT_MODULES = {"DIRAC": Path(__file__).parent.absolute()}
 
 # Static configuration

src/DIRAC/FrameworkSystem/scripts/dirac_login.py

@@ -314,7 +314,9 @@ def loginWithCertificate(self):
                     return res
 
             # Get a token for use with diracx
-            if os.getenv("DIRAC_ENABLE_DIRACX_LOGIN", "No").lower() in ("yes", "true"):
+            vo = getVOMSVOForGroup(self.group)
+            enabledVOs = gConfig.getValue("/DiracX/EnabledVOs", [])
+            if vo in enabledVOs:
                 from diracx.core.utils import write_credentials  # pylint: disable=import-error
                 from diracx.core.models import TokenResponse  # pylint: disable=import-error
 

src/DIRAC/FrameworkSystem/scripts/dirac_proxy_init.py

@@ -9,21 +9,19 @@
 import os
 import sys
 import glob
-import json
 import time
 import datetime
 
 import DIRAC
 
-from DIRAC import gLogger, S_OK, S_ERROR
+from DIRAC import gLogger, gConfig, S_OK, S_ERROR
 from DIRAC.Core.Base.Script import Script
 from DIRAC.FrameworkSystem.Client import ProxyGeneration, ProxyUpload
 from DIRAC.Core.Security import X509Chain, ProxyInfo, VOMS
 from DIRAC.Core.Security.Locations import getCAsLocation
 from DIRAC.ConfigurationSystem.Client.Helpers import Registry
 from DIRAC.FrameworkSystem.Client.BundleDeliveryClient import BundleDeliveryClient
 from DIRAC.Core.Base.Client import Client
-from pathlib import Path
 
 
 class Params(ProxyGeneration.CLIParams):
@@ -240,7 +238,9 @@ def doTheMagic(self):
                 if self.__piParams.strict:
                     return resultProxyUpload
 
-        if os.getenv("DIRAC_ENABLE_DIRACX_LOGIN", "No").lower() in ("yes", "true"):
+        vo = Registry.getVOMSVOForGroup(self.__piParams.diracGroup)
+        enabledVOs = gConfig.getValue("/DiracX/EnabledVOs", [])
+        if vo in enabledVOs:
             from diracx.core.utils import write_credentials  # pylint: disable=import-error
             from diracx.core.models import TokenResponse  # pylint: disable=import-error
             from diracx.core.preferences import DiracxPreferences  # pylint: disable=import-error

src/DIRAC/WorkloadManagementSystem/Service/SandboxStoreHandler.py

@@ -14,7 +14,8 @@
 import threading
 import time
 
-from DIRAC import S_ERROR, S_OK, gLogger
+from DIRAC import S_ERROR, S_OK, gLogger, gConfig
+from DIRAC.ConfigurationSystem.Client.Helpers import Registry
 from DIRAC.Core.DISET.RequestHandler import RequestHandler
 from DIRAC.Core.Security import Locations, Properties, X509Certificate
 from DIRAC.Core.Utilities.File import mkDir
@@ -108,8 +109,10 @@ def _getFromClient(self, fileId, token, fileSize, fileHelper=None, data=""):
         gLogger.info("Upload requested", f"for {aHash} [{extension}]")
 
         credDict = self.getRemoteCredentials()
+        vo = Registry.getVOForGroup(credDict["group"])
 
-        if self._useDiracXBackend:
+        enabledVOs = gConfig.getValue("/DiracX/EnabledVOs", [])
+        if self._useDiracXBackend and vo in enabledVOs:
             from DIRAC.FrameworkSystem.Utilities.diracx import TheImpersonator
             from diracx.client.models import SandboxInfo  # pylint: disable=import-error