Method get_tok

salt/auth/__init__.py:300–422

Return the name associated with the token, or False if the token is not valid

(self, tok)

            return tdata

    def get_tok(self, tok):
        """
        Return the name associated with the token, or False if the token is
        not valid
        """
        if self.opts["eauth_tokens.cache_driver"] == "rediscluster":
            salt.utils.versions.warn_until(
                3010,
                "The 'rediscluster' token backend has been deprecated, and will be removed "
                "in the Calcium release. Please use the 'redis_cache' cache backend instead.",
            )

            tdata = {}
            try:
                tdata = self.tokens["{}.get_token".format(self.opts["eauth_tokens"])](
                    self.opts, tok
                )
            except salt.exceptions.SaltDeserializationError as exc:
                # The on-disk / in-store token blob is corrupt and cannot
                # be parsed. Removing it is the right call -- a corrupt
                # token can never authenticate anyway, and leaving it
                # around makes every subsequent ``get_tok`` for the same
                # id keep failing. ``%r`` on the exception gives the
                # operator the class and message inline (e.g. msgpack
                # format error, truncated file) without spamming a full
                # traceback into a hot-path WARNING; the full traceback is
                # available via the companion ``log.debug`` for deeper
                # investigation.
                log.warning(
                    "Token %r could not be deserialized (%r); removing it from the store.",
                    tok,
                    exc,
                )
                log.debug("Token deserialization traceback:", exc_info=True)
                rm_tok = True
            except OSError as exc:
                # Transient backend error (Redis connection blip, NFS hang,
                # hung disk). The token itself is fine; do NOT delete it --
                # that would log every authenticated user out on every
                # backend hiccup. Return an empty dict so the caller treats
                # this request as not-authenticated; the next request will
                # retry against the backend and succeed once it recovers.
                # Same logging pattern as above -- exception class + message
                # at WARNING, full traceback at DEBUG so a flapping deploy
                # stays diagnoseable without GB/hour of stack frames.
                log.warning(
                    "Token store transient error reading %r (%r); treating as "
                    "not-authenticated for this request without removing the "
                    "token from the store.",
                    tok,
                    exc,
                )
                log.debug("Token store transient-error traceback:", exc_info=True)
                return {}
            else:
                if not tdata:
                    return {}
                rm_tok = False