Skip to content

MTLS support for the Python client #508

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ZPascal opened this issue Oct 4, 2022 · 6 comments · Fixed by #509
Closed

MTLS support for the Python client #508

ZPascal opened this issue Oct 4, 2022 · 6 comments · Fixed by #509
Labels
enhancement New feature or request
Milestone

Comments

@ZPascal
Copy link
Contributor

ZPascal commented Oct 4, 2022

Proposal:
We should also support mutual TLS for the InfluxDB client. The implementation could be handled as a quick win and I can prepare the corresponding functionality inside a PR. The client uses urllib3 as a library to establish a connection to the InfluxDB and the MTLS support is already implemented inside it. Currently, there are two possible ways to implement the MTLS support inside the client:

  1. Forward the custom Python SSL context to the urllib3 via the **kwags functionality (Personal favorited implementation, more adaptable)
  2. Use the same functionality as the normal TLS implementation and forward the certificates to the urllib3

Current behavior:
Currently, it's possible to define e.g. a Python SSL context as **kwags but this context is not forwarded to all calls at the end.

Desired behavior:
I would expect that MTLS is also supported by the library.

Use case:
The use case is the possibility to establish an MTLS connection to the InfluxDB.

@bednar
Copy link
Contributor

bednar commented Oct 4, 2022

Hi @ZPascal,

thanks for using our client and your proposal.

The implementation could be handled as a quick win and I can prepare the corresponding functionality inside a PR.

I will be happy to review your PR... btw every PR is welcome.

  1. Forward the custom Python SSL context to the urllib3 via the **kwags functionality (Personal favorited implementation, more adaptable)

How will it works together with ssl_ca_cert option?

Regards

@bednar bednar added the enhancement New feature or request label Oct 4, 2022
@ZPascal
Copy link
Contributor Author

ZPascal commented Oct 4, 2022

Hi @bednar, I would expect that the variable is None (if you did not specify a certificate) and at the end not really used inside the connection pool manager.

I can also maybe implement inside the PR the full MTLS support delivered by classical shipped certs via the configuration. The framework is already there and used but not mapped to the configuration option/ initialization. :)

So in the end, the user got the option to use one of both possibilities.

@bednar
Copy link
Contributor

bednar commented Oct 4, 2022

@ZPascal it sounds good 👍

I will be happy to review and merge your PR ;)

@ZPascal
Copy link
Contributor Author

ZPascal commented Oct 17, 2022

Hi @bednar, thank you for merging the PR. Could you please share with me the timeline to publish the new release version?

@bednar
Copy link
Contributor

bednar commented Oct 17, 2022

@ZPascal you can use current dev version by: pip install git+https://github.com/influxdata/influxdb-client-python.git@master. The production version will be released at the end of the month.

@ZPascal
Copy link
Contributor Author

ZPascal commented Oct 17, 2022

@bednar Thank you for the info. I've got already a wheel file on my side to consume the change. I just wanted to know when I can replace it :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants