Merge pull request #2165 from jmchilton/single_user

Implement ``single_user = <email>`` config option.

config/galaxy.ini.sample

@@ -881,6 +881,13 @@ use_interactive = True
 # to True to force these to lower case.
 #normalize_remote_user_email = False
 
+# If an e-mail address is specified here, it will hijack remote user mechanics
+# (``use_remote_user``) and have the webapp inject a single fixed user. This
+# has the effect of turning Galaxy into a single user application with no
+# login or external proxy required. Such applications should not be exposed to
+# the world.
+#single_user =
+
 # Administrative users - set this to a comma-separated list of valid Galaxy
 # users (email addresses).  These users will have access to the Admin section
 # of the server, and will have access to create users, groups, roles,

lib/galaxy/config.py

@@ -151,7 +151,8 @@ class Configuration( object ):
         self.id_secret = kwargs.get( "id_secret", "USING THE DEFAULT IS NOT SECURE!" )
         self.retry_metadata_internally = string_as_bool( kwargs.get( "retry_metadata_internally", "True" ) )
         self.max_metadata_value_size = int( kwargs.get( "max_metadata_value_size", 5242880 ) )
-        self.use_remote_user = string_as_bool( kwargs.get( "use_remote_user", "False" ) )
+        self.single_user = kwargs.get( "single_user", None )
+        self.use_remote_user = string_as_bool( kwargs.get( "use_remote_user", "False" ) ) or self.single_user
         self.normalize_remote_user_email = string_as_bool( kwargs.get( "normalize_remote_user_email", "False" ) )
         self.remote_user_maildomain = kwargs.get( "remote_user_maildomain", None )
         self.remote_user_header = kwargs.get( "remote_user_header", 'HTTP_REMOTE_USER' )

lib/galaxy/web/framework/middleware/remoteuser.py

@@ -40,12 +40,16 @@ errorpage = """
 
 
 class RemoteUser( object ):
-    def __init__( self, app, maildomain=None, display_servers=None, admin_users=None, remote_user_header=None, remote_user_secret_header=None ):
+    def __init__(
+        self, app, maildomain=None, display_servers=None, admin_users=None,
+        single_user=None, remote_user_header=None, remote_user_secret_header=None,
+    ):
         self.app = app
         self.maildomain = maildomain
         self.display_servers = display_servers or []
         self.admin_users = admin_users or []
         self.remote_user_header = remote_user_header or 'HTTP_REMOTE_USER'
+        self.single_user = single_user
         self.config_secret_header = remote_user_secret_header
 
     def __call__( self, environ, start_response ):
@@ -59,6 +63,11 @@ class RemoteUser( object ):
             if host in self.display_servers:
                 environ[ self.remote_user_header ] = 'remote_display_server@%s' % ( self.maildomain or 'example.org' )
                 return self.app( environ, start_response )
+
+        if self.single_user:
+            assert self.remote_user_header not in environ
+            environ[ self.remote_user_header ] = self.single_user
+
         # Apache sets REMOTE_USER to the string '(null)' when using the
         # Rewrite* method for passing REMOTE_USER and a user is
         # un-authenticated.  Any other possible values need to go here as well.

lib/galaxy/webapps/galaxy/buildapp.py

@@ -716,10 +716,13 @@ def wrap_in_middleware( app, global_conf, **local_conf ):
     # If we're using remote_user authentication, add middleware that
     # protects Galaxy from improperly configured authentication in the
     # upstream server
-    if asbool(conf.get( 'use_remote_user', False )):
+    single_user = conf.get( 'single_user', None )
+    use_remote_user = asbool(conf.get( 'use_remote_user', False )) or single_user
+    if use_remote_user:
         from galaxy.web.framework.middleware.remoteuser import RemoteUser
         app = RemoteUser( app, maildomain=conf.get( 'remote_user_maildomain', None ),
                           display_servers=util.listify( conf.get( 'display_servers', '' ) ),
+                          single_user=single_user,
                           admin_users=conf.get( 'admin_users', '' ).split( ',' ),
                           remote_user_header=conf.get( 'remote_user_header', 'HTTP_REMOTE_USER' ),
                           remote_user_secret_header=conf.get('remote_user_secret', None) )