Changeset 08329f4

Timestamp:

Dec 2, 2008 3:49:25 PM (16 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master, version-1.30, version-2.00, version-3.01, version-3.02

Children:

b0b9499

Parents:

5a6b75b

Message:

dynamic projects and multiple keys

Location:

fedd

Files:

• federation/allocate_project.py (modified) (12 diffs)
• federation/fixed_resource.py (modified) (1 diff)
• user_to_group.py (added)

fedd/federation/allocate_project.py

@@ -10 +10 @@
 from util import *
 from fedid import fedid
-from fixed_resource import read_key_db, read_project_db
+from fixed_resource import read_key_db, read_project_db, read_user_db
 from remote_service import xmlrpc_handler, soap_handler, service_caller
 from service_error import service_error
@@ -56 +56 @@
         self.rmproj = config.get('allocate', 'rmproj',
                 '/usr/testbed/sbin/rmproj')
+        self.rmuser = config.get('allocate', 'rmuser',
+                '/usr/testbed/sbin/rmuser')
+        self.newuser = config.get('allocate', 'newuser',
+                '/usr/testbed/sbin/newuser')
         self.addpubkey = config.get('allocate', 'addpubkey', 
                 '/usr/testbed/sbin/taddpubkey')
@@ -62 +66 @@
         self.confirmkey = config.get('allocate', 'confirmkey', 
                 '/usr/testbed/sbin/taddpubkey')
+        self.user_to_project=config.get("allocate", 'user_to_project',
+                '/usr/local/bin/user_to_project.py')
         self.allocation_level = config.get("allocate", "allocation_level", 
                 "none")
@@ -94 +100 @@
         fixed_key_db = config.get("allocate", "fixed_keys", None)
         fixed_project_db = config.get("allocate", "fixed_projects", None)
+        fixed_user_db = config.get("allocate", "fixed_users", None)
         self.fixed_keys = set()
         self.fixed_projects = set()
+        self.fixed_users = set()
 
         # initialize the fixed resource sets
         for db, rset, fcn in (\
                 (fixed_key_db, self.fixed_keys, read_key_db), \
-                (fixed_project_db, self.fixed_projects, read_project_db)):
+                (fixed_project_db, self.fixed_projects, read_project_db),
+                (fixed_user_db, self.fixed_users, read_user_db)):
             if db:
                 try:
@@ -160 +169 @@
                             "permitted: check allocation level")
         # tempfiles for the parameter files
-        uf, userfile = tempfile.mkstemp(prefix="usr", suffix=".xml",
+        cuf, create_userfile = tempfile.mkstemp(prefix="usr", suffix=".xml",
+                dir="/tmp")
+        suf, service_userfile = tempfile.mkstemp(prefix="usr", suffix=".xml",
                 dir="/tmp")
         pf, projfile = tempfile.mkstemp(prefix="proj", suffix=".xml",
@@ -173 +184 @@
         # Take the first user and ssh key
         name = proj.get('name', None) or self.random_string("proj",4)
-        user = proj.get('user', None)
-        if user != None:
-            user = user[0]      # User is a list, take the first entry
-            if not user.has_key("userID"):
-                uname = self.random_string("user", 3)
-            else:
-                uid = proj['userID']
-                # XXX: fedid
-                uname = uid.get('localname', None) or \
+        user = proj.get('user', [])
+
+        uname = { }
+        ssh = { }
+        for u in user:
+            role = u.get('role', None)
+            if not role: continue
+            if u.has_key('userID'):
+                uid = u['userID']
+                uname[role] = uid.get('localname', None) or \
                         uid.get('kerberosUsername', None) or \
                         uid.get('uri', None)
-                if uname == None:
-                    raise service_error(service_error.req, "No ID for user");
-
-            access = user.get('access', None)
-            if access != None:
-                ssh = access[0].get('sshPubkey', None)
-                if ssh == None:
-                    raise service_error(service_error.req, 
-                            "No ssh key for user");
-        else:
-            raise service_error(service_error.req, 
-                    "No access information for project");
-
-        # uname, name and ssh are set
-        user_fields = [
-                ("name", "Federation User %s" % uname),
-                ("email", "%s-fed@isi.deterlab.net" % uname),
+                if uname[role] == None:
+                    raise service_error(service_error.req, "No ID for user")
+            else:
+                uname[role] = self.random_string("user", 3)
+
+            access = u.get('access', None)
+            if access:
+                # XXX collect and call addpubkey later, for now use first one.
+                for a in access:
+                    ssh[role] = a.get('sshPubkey', None)
+                    if ssh: break
+                else:
+                    raise service_error(service_error.req,
+                            "No SSH key for user %s" % uname[role])
+            else:
+                raise service_error(service_error.req,
+                        "No access mechanisms for for user %s" % uname[role])
+
+        if not (uname.has_key('experimentCreation') and \
+                uname.has_key('serviceAccess')):
+            raise service_error(service_error.req,
+                    "Must specify both user roles")
+        
+
+        create_user_fields = [
+                ("name", "Federation User %s" % uname['experimentCreation']),
+                ("email", "%s-fed@isi.deterlab.net" % \
+                        uname['experimentCreation']),
                 ("password", self.random_string("", 8)),
-                ("login", uname),
+                ("login", uname['experimentCreation']),
                 ("address", "4676 Admiralty"),
                 ("city", "Marina del Rey"),
@@ -211 +234 @@
                 ("title", "None"),
                 ("affiliation", "USC/ISI"),
-                ("pubkey", ssh)
+                ("pubkey", ssh['experimentCreation'])
+        ]
+
+        service_user_fields = [
+                ("name", "Federation User %s" % uname['serviceAccess']),
+                ("email", "%s-fed@isi.deterlab.net" % uname['serviceAccess']),
+                ("password", self.random_string("", 8)),
+                ("login", uname['serviceAccess']),
+                ("address", "4676 Admiralty"),
+                ("city", "Marina del Rey"),
+                ("state", "CA"),
+                ("zip", "90292"),
+                ("country", "USA"),
+                ("phone", "310-448-9190"),
+                ("title", "None"),
+                ("affiliation", "USC/ISI"),
+                ("pubkey", ssh['serviceAccess'])
         ]
 
@@ -223 +262 @@
                 ("num_pcs", "100"),
                 ("linkedtous", "1"),
-                ("newuser_xml", userfile)
+                ("newuser_xml", create_userfile)
         ]
         
 
         # Write out the files
-        self.write_attr_xml(uf, "user", user_fields)
+        self.write_attr_xml(cuf, "user", create_user_fields)
+        self.write_attr_xml(suf, "user", service_user_fields)
         self.write_attr_xml(pf, "project", proj_fields)
 
@@ -234 +274 @@
         cmds = [
                 (self.wap, self.newproj, projfile),
-                (self.wap, self.mkproj, name)
+                (self.wap, self.mkproj, name),
+                (self.wap, self.newuser, service_userfile),
+                (self.wap, self.user_to_project, uname['serviceAccess'], name),
                 ]
 
@@ -260 +302 @@
                                 "[%s] (%d)" % (cmd[1], rc))
         # Clean up tempfiles
-        os.unlink(userfile)
-        os.unlink(projfile)
+        #os.unlink(create_userfile)
+        #os.unlink(service_userfile)
+        #os.unlink(projfile)
         rv = {\
             'project': {\
                 'name': { 'localname': name }, 
-                'user' : [ {\
-                    'userID': { 'localname' : uname },
-                    'access': [ { 'sshPubkey' : ssh } ],
-                } ]\
+                'user' : [\
+                    {\
+                        'userID': { 'localname' : uname['experimentCreation'] },
+                        'access': [ {'sshPubkey': ssh['experimentCreation'] } ],
+                        'role': 'experimentCreation',
+                    }, \
+                    {\
+                        'userID': { 'localname' : uname['serviceAccess'] },
+                        'access': [ { 'sshPubkey' : ssh['serviceAccess'] } ], 
+                        'role': 'serviceAccess',
+                    } \
+                ]\
             }\
         }
@@ -370 +421 @@
             raise service_error(service_error.req, "Badly formed request")
 
+        if pname and pname not in self.fixed_projects and \
+                self.allocation_level >= self.dynamic_projects:
+            cmds.append((self.wap, self.rmproj, pname))
+
         for u in users:
             try:
@@ -375 +430 @@
             except KeyError:
                 raise service_error(service_error.req, "Badly formed user")
-            for sk in [ k['sshPubkey'] for k in u.get('access', []) \
-                    if k.has_key('sshPubkey')]:
-                if (name.rstrip(), sk.rstrip()) not in self.fixed_keys:
-                    if self.allocation_level >= self.dynamic_keys:
-                        cmds.append((self.wap, self.addpubkey, '-R', '-w', \
-                                '-u', name, '-k', sk))
-        if pname and pname not in self.fixed_projects and \
-                self.allocation_level >= self.dynamic_projects:
-            cmds.append((self.wap, self.rmproj, pname))
+            if self.allocation_level >= self.dynamic_projects and \
+                    name not in self.fixed_users:
+                cmds.append((self.wap, self.rmuser, name))
+            else:
+                for sk in [ k['sshPubkey'] for k in u.get('access', []) \
+                        if k.has_key('sshPubkey')]:
+                    if (name.rstrip(), sk.rstrip()) not in self.fixed_keys:
+                        if self.allocation_level >= self.dynamic_keys:
+                            cmds.append((self.wap, self.addpubkey, '-R', '-w', \
+                                    '-u', name, '-k', sk))
 
         # Run the commands 

fedd/federation/fixed_resource.py

@@ -48 +48 @@
         print >>f, "%s" % p
     f.close()
+
+read_user_db = read_project_db
+write_user_db = write_project_db