Changeset 27d964d

Timestamp:

Sep 22, 2010 2:33:58 PM (14 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

d39809f

Parents:

1fc09db

Message:

Translate attributes into something acceptable to libabac (or creddy)

File:

• fedd/federation/authorizer.py (modified) (9 diffs)

fedd/federation/authorizer.py

@@ -183 +183 @@
     """
 
+    clean_attr_re = re.compile('[^A-Za-z_]+')
+    cred_file_re = re.compile('.*\.der$')
+
     def __init__(self, certs=None, me=None, key=None):
         self.bad_name = authorizer_base.bad_name
@@ -199 +202 @@
         for dir in certs or []:
             self.context.load_directory(dir)
+
+    @staticmethod
+    def clean_attr(attr):
+        return abac_authorizer.clean_attr_re.sub('_', attr)
+
 
     def set_attribute(self, name=None, attr=None, cert=None):
@@ -217 +225 @@
                 # Create the attribute certificate with creddy
                 cmd = [self.creddy, '--attribute', '--issuer=%s' % self.me, 
-                    '--key=%s' % self.key, '--role=%s' % attr, 
+                    '--key=%s' % self.key, '--role=%s' % self.clean_attr(attr), 
                     '--subject-id=%s' % name, '--out=%s' % fn]
                 rv = call(cmd)
@@ -243 +251 @@
         if isinstance(name, tuple):
             raise self.bad_name("ABAC doesn't understand three-names")
+        cattr = self.clean_attr(attr)
         self.lock.acquire()
         ctxt = ABAC.Context()
@@ -252 +261 @@
                 if t.principal() == '%s' % name and \
                         h.principal() == '%s' % self.fedid and \
-                        h.role_name() == attr:
+                        h.role_name() == cattr:
                     continue
 
@@ -269 +278 @@
             raise self.bad_name("ABAC doesn't understand three-names")
         else:
-            
             # Naked attributes are attested by this principal
-            if attr.find('.') == -1: a = "%s.%s" % (self.fedid, attr)
-            else: a = attr
+            if attr.find('.') == -1: 
+                a = "%s.%s" % (self.fedid, self.clean_attr(attr))
+            else: 
+                r, a = attr.split('.',1)
+                a = "%s.%s" ( r, self.clean_attr(a))
 
             self.lock.acquire()
@@ -288 +299 @@
         """
         self.lock.acquire()
-        self.globals.add(attr)
+        self.globals.add(self.clean_attr(attr))
         self.lock.release()
 
@@ -297 +308 @@
 
         self.lock.acquire()
-        self.globals.discard(attr)
+        self.globals.discard(self.clean_attr(attr))
         self.lock.release()
 
@@ -330 +341 @@
             #remove old certs
             for fn in [ f for f in os.listdir("%s/certs" % dir) \
-                    if re.match('.*\.der$', f)]:
+                    if abac_authorizer.cred_file_re.match(f)]:
                 os.unlink('%s/certs/%s' % (dir, fn))
             ii = 0