Galaxy: Galaxy cannot be bootstrapped with reference genomes using the master api key

[rhpvorderman]

The master API key has no admin rights because it is intended to bootstrap new instances, not to administer an existing galaxy instance.
Unfortunately, this also means that the master api key can not "see" the data manager tools, and therefore not run them. In order to install reference genomes, an administration api key has to be used.

In the automated setup of a galaxy instance this is inconvenient. It is preferable to only use the master api key when setting up a galaxy instance. Instead of having to log in to the galaxy instance, create an api key, and then continue the process using this key.

A possible solution would be to also make the master api key rights to use the data manager without giving it admin rights.
I could not find the file where the permissions are set. If someone can point me to it, I can try to make a pull request myself.

[jmchilton]

@rhpvorderman I'm sure this problem is real and I'd love for it to be addressed but the diagnoses seems a bit off. The master API key should generally have admin rights but it is inconsistently implemented and there have in fact been regressions. A good example of fixing an API that was broken to longer respect the master API key is https://github.com/galaxyproject/galaxy/pull/3228/files. It seems like you've dug into this a bit - do you have a stack trace for the failure? For some API endpoints - it isn't so much that the current user isn't an admin but that a current user is required and the master API key doesn't map to a user. The second case can generally be addressed by just relaxing that requirement as needed.

Running data managers is running tools though and that requires a history and users and such - I'd like that to work without a real user but that might be a bit too much work. In general I think the bootstrap pattern is to configure an admin user in Galaxy's config and user the master API key to actually create the user and then use its API key for subsequent operations such data manager execution.

[rhpvorderman]

Thank you for your quick reply.
While using bioblend to access the api I was not able to see the data managers in the list of tools when I used the master API key. When I used an admin API key I could see the data managers.
Ephemeris shed install was used to run the data managers. With the master API key this would result in a tool not found error, while it worked fine with an admin API key.

Running data managers is running tools though and that requires a history and users and such - I'd like that to work without a real user but that might be a bit too much work.

That's seems reasonable. A hidden user that is not accessible by password but only by api key might be a solution. This user could be enabled then by enable_master_user in galaxy.ini. Maybe something for the Galaxy Community Conference 2017 hackathon? ;-).