Salt: local_batch client ignore external auth

[chrisLeeTW]

Description of Issue/Question

as topic, when you call from salt-api with local_batch client, api will ignore the command acl in external auth config, that you can do anything you want XD. but local & local_async client behave correctly.

Setup

1. install salt-master & salt-api with ubuntu 14.04 & saltstack ubuntu repository.
2. create local user salt with password "test" in salt master server.
3. configure salt master with the configuration as this gist url
4. start/restart salt-master & salt-api
5. add a minion into master
6. install saltstack pepper https://github.com/saltstack/pepper

Steps to Reproduce Issue

1. using salt pepper to call salt-api, like
   pepper -a pam --client local --batch='50%' --username=salt --password=test -C 'your_minion_id' cmd.run date
2. as result, it is success to be execute, not as desire 401 unauthorized

Versions Report

Salt Version:
Salt: 2016.11.0

Dependency Versions:
cffi: Not Installed
cherrypy: 3.2.2
dateutil: 2.6.0
gitdb: 0.5.4
gitpython: 0.3.2 RC1
ioflo: Not Installed
Jinja2: 2.7.2
libgit2: Not Installed
libnacl: Not Installed
M2Crypto: 0.21.1
Mako: 0.9.1
msgpack-pure: Not Installed
msgpack-python: 0.3.0
mysql-python: 1.2.3
pycparser: Not Installed
pycrypto: 2.6.1
pygit2: Not Installed
Python: 2.7.6 (default, Jun 22 2015, 17:58:13)
python-gnupg: Not Installed
PyYAML: 3.10
PyZMQ: 14.0.1
RAET: Not Installed
smmap: 0.8.2
timelib: Not Installed
Tornado: 4.2.1
ZMQ: 4.0.4

System Versions:
dist: Ubuntu 14.04 trusty
machine: x86_64
release: 3.13.0-83-generic
system: Linux
version: Ubuntu 14.04 trusty

[gtmanfred]

Thanks for reporting this, we will get it fixed.

[cachedout]

@meggiebot Do you know the PR that fixed this?

[mchugh19]

Hey all. Fully support getting this hole plugged. https://github.com/saltstack/salt/commit/3d8f3d18f6afa760c70db87cbbaaa71d877ca4d3 removed batch support. Is there a hope of getting eauth added to batch in order to re-enable local_batch support in the salt-api?

[cachedout]

@mchugh19 Pinging @whiteinge to get his thoughts on that.

[whiteinge]

I'm not too familiar with the Batch class. At quick glance it's (predictably) using LocalClient() under the hood and even looks to be trying to pass eauth credentials through. It may be as simple as passing an eauth kwarg when instantiating the class.

This isn't something I'm likely to have time to look into in the near future. @mchugh19 are you interested in slinging a little Python? If so I'd happily backstop your work.