| 1 | #!/usr/local/bin/python |
|---|
| 2 | |
|---|
| 3 | import emulab_access |
|---|
| 4 | import dragon_access |
|---|
| 5 | import protogeni_access |
|---|
| 6 | import deter_internal_access |
|---|
| 7 | import skeleton_access |
|---|
| 8 | |
|---|
| 9 | from experiment_control import experiment_control_local |
|---|
| 10 | from ns2topdl import ns2topdl_local |
|---|
| 11 | from util import read_simple_accessdb |
|---|
| 12 | from fedid import fedid |
|---|
| 13 | |
|---|
| 14 | from authorizer import authorizer, abac_authorizer |
|---|
| 15 | |
|---|
| 16 | class deter_impl: |
|---|
| 17 | """ |
|---|
| 18 | The implementation of access control based on mapping users to projects. |
|---|
| 19 | |
|---|
| 20 | Users can be mapped to existing projects or have projects created |
|---|
| 21 | dynamically. This implements both direct requests and proxies. |
|---|
| 22 | """ |
|---|
| 23 | # Used by the SOAP caller |
|---|
| 24 | soap_namespaces = ('http://www.isi.edu/fedd.wsdl', |
|---|
| 25 | 'http://www.isi.edu/fedd_internal.wsdl') |
|---|
| 26 | |
|---|
| 27 | def __init__(self, config=None): |
|---|
| 28 | """ |
|---|
| 29 | Initializer. Uses the parsed configuration to create appropriate |
|---|
| 30 | components. |
|---|
| 31 | """ |
|---|
| 32 | self.soap_services = { } |
|---|
| 33 | self.xmlrpc_services = { } |
|---|
| 34 | self.auth = None |
|---|
| 35 | |
|---|
| 36 | if config: |
|---|
| 37 | self.cert_file = config.get("globals", "cert_file"); |
|---|
| 38 | self.cert_pwd = config.get("globals", "cert_pwd"); |
|---|
| 39 | self.trusted_certs = config.get("globals", "trusted_certs"); |
|---|
| 40 | self.access_type = config.get("globals", "access_type", "emulab") |
|---|
| 41 | self.auth_type = config.get("globals", "auth_type", "legacy") |
|---|
| 42 | |
|---|
| 43 | if self.auth_type == 'legacy': |
|---|
| 44 | self.auth = authorizer() |
|---|
| 45 | elif self.auth_type == 'abac': |
|---|
| 46 | auth_url = config.get('globals', 'auth_url') |
|---|
| 47 | if not auth_url: |
|---|
| 48 | raise RuntimeError("auth_url required for ABAC " + \ |
|---|
| 49 | "authorization") |
|---|
| 50 | if self.cert_file: |
|---|
| 51 | me = fedid(file=self.cert_file) |
|---|
| 52 | else: |
|---|
| 53 | raise RuntimeError("ABAC authorization needs a " +\ |
|---|
| 54 | "certificate file") |
|---|
| 55 | self.auth= abac_authorizer(url=auth_url, |
|---|
| 56 | cert_file=self.cert_file, cert_pwd=self.cert_pwd, |
|---|
| 57 | trusted_certs=self.trusted_certs, me=me) |
|---|
| 58 | else: |
|---|
| 59 | raise RuntimeError("Unknown authorizer type %s" % \ |
|---|
| 60 | self.auth_type) |
|---|
| 61 | |
|---|
| 62 | access_db = config.get("globals", "accessdb") |
|---|
| 63 | |
|---|
| 64 | if access_db: |
|---|
| 65 | try: |
|---|
| 66 | read_simple_accessdb(access_db, self.auth) |
|---|
| 67 | except EnvironmentError, e: |
|---|
| 68 | raise RuntimeError( |
|---|
| 69 | "Error reading accessDB %s: %s" % (access_db, e)) |
|---|
| 70 | except ValueError, e: |
|---|
| 71 | raise RuntimeError("%s" % e) |
|---|
| 72 | |
|---|
| 73 | if config.has_section("access"): |
|---|
| 74 | if self.access_type == "emulab": |
|---|
| 75 | self.access = emulab_access.access(config, self.auth) |
|---|
| 76 | elif self.access_type == "dragon": |
|---|
| 77 | self.access = dragon_access.access(config, self.auth) |
|---|
| 78 | elif self.access_type == "protogeni": |
|---|
| 79 | self.access = protogeni_access.access(config, self.auth) |
|---|
| 80 | elif self.access_type == "deter_internal": |
|---|
| 81 | self.access = deter_internal_access.access(config, |
|---|
| 82 | self.auth) |
|---|
| 83 | elif self.access_type == "skel": |
|---|
| 84 | self.access = skeleton_access.access(config, self.auth) |
|---|
| 85 | else: |
|---|
| 86 | raise RuntimeError("Unknown access_type: %s" % \ |
|---|
| 87 | self.access_type) |
|---|
| 88 | self.soap_services.update(self.access.soap_services) |
|---|
| 89 | self.xmlrpc_services.update(self.access.xmlrpc_services) |
|---|
| 90 | else: |
|---|
| 91 | self.access = None |
|---|
| 92 | |
|---|
| 93 | if config.has_section("experiment_control"): |
|---|
| 94 | self.experiment = \ |
|---|
| 95 | experiment_control_local(config, self.auth) |
|---|
| 96 | # Tell the experiment control where local access control is and |
|---|
| 97 | # what testbeds it pertains to. |
|---|
| 98 | if getattr(self, 'access', None): |
|---|
| 99 | for t in self.access.testbed: |
|---|
| 100 | self.experiment.local_access[t] = self.access |
|---|
| 101 | |
|---|
| 102 | self.soap_services.update(self.experiment.soap_services) |
|---|
| 103 | self.xmlrpc_services.update(self.experiment.xmlrpc_services) |
|---|
| 104 | self.get_handler = self.experiment.get_handler |
|---|
| 105 | else: |
|---|
| 106 | if self.access and getattr(self.access, 'get_handler', None): |
|---|
| 107 | self.get_handler = self.access.get_handler |
|---|
| 108 | else: |
|---|
| 109 | self.get_handler = None |
|---|
| 110 | |
|---|
| 111 | if config.has_section("ns2topdl"): |
|---|
| 112 | self.ns2topdl = ns2topdl_local(config, self.auth) |
|---|
| 113 | self.soap_services.update(self.ns2topdl.soap_services) |
|---|
| 114 | self.xmlrpc_services.update(self.ns2topdl.xmlrpc_services) |
|---|
| 115 | |
|---|
| 116 | def new_feddservice(config): |
|---|
| 117 | return deter_impl(config) |
|---|
