Changeset 3bddd24 for fedd

Timestamp:

Dec 8, 2009 5:45:03 PM (15 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master, version-3.01, version-3.02

Children:

99eb8cf

Parents:

7d2814a

Message:

moving toward credentials, and away from emulab specifics

Location:

fedd/federation

Files:

• emulab_access.py (modified) (4 diffs)
• experiment_control.py (modified) (2 diffs)

fedd/federation/emulab_access.py

@@ -68 +68 @@
         self.certdir = config.get("access","certdir")
         self.ssh_privkey_file = config.get("access","ssh_privkey_file")
+        self.ssh_pubkey_file = config.get("access","ssh_pubkey_file")
         self.create_debug = config.getboolean("access", "create_debug")
         self.cleanup = not config.getboolean("access", "leave_tmpfiles")
@@ -365 +366 @@
         The fedid is needed to construct the request
         """
+        user_re = re.compile("user:\s(.*)")
+        project_re = re.compile("project:\s(.*)")
+
         # Search keys
         tb = None
@@ -373 +377 @@
         ru = None
 
-        if req.has_key('project'):
-            p = req['project']
-            if p.has_key('name'):
-                project = unpack_id(p['name'])
-            user = self.get_users(p)
-        else:
-            user = self.get_users(req)
+        user = [ user_re.findall(x)[0] for x in req.get('credential', []) \
+                if user_re.match(x)]
+        project = [ project_re.findall(x)[0] \
+                for x in req.get('credential', []) \
+                    if project_re.match(x)]
+
+        if len(project) == 1: project = project[0]
+        elif len(project) == 0: project = None
+        else: 
+            raise service_error(service_error.req, 
+                    "More than one project credential")
+
 
         user_fedids = [ u for u in user if isinstance(u, fedid)]
@@ -553 +562 @@
                             "Access denied (nodetypes %s)" % \
                             str(', ').join(inaccessible))
-            # These collect the keys for the two roles into single sets, one
-            # for creation and one for service.  The sets are a simple way to
-            # eliminate duplicates
-            create_ssh = set([ x['sshPubkey'] \
-                    for x in req['createAccess'] \
-                        if x.has_key('sshPubkey')])
-
-            service_ssh = set([ x['sshPubkey'] \
-                    for x in req['serviceAccess'] \
-                        if x.has_key('sshPubkey')])
+
+            # These were passed around before, but now are hidden from users
+            # and configurators alike, beyond a configuration file entry.
+            create_ssh = [ self.ssh_pubkey_file ]
+            service_ssh = [ self.ssh_pubkey_file ]
 
             if len(create_ssh) > 0 and len(service_ssh) >0: 

fedd/federation/experiment_control.py

@@ -762 +762 @@
                 req = {\
                         'destinationTestbed' : { 'uri' : uri },
-                        'project': { 
-                            'name': {'localname': p},
-                            'user': [ {'userID': { 'localname': u } } ],
-                            },
-                        'user':  user,
+                        'credential': [ "project: %s" % p, "user: %s"  % u],
                         'allocID' : { 'localname': 'test' },
-                        'createAccess' : [ { 'sshPubkey' : self.ssh_pubkey } ],
-                        'serviceAccess' : service_keys
                     }
             else:
@@ -775 +769 @@
                 req = {\
                         'destinationTestbed' : { 'uri' : uri },
+                        'credential': [ 'user: %s' % u ],
                         'user':  [ {'userID': { 'localname': u } } ],
                         'allocID' : { 'localname': 'test' },
-                        'createAccess' : [ { 'sshPubkey' : self.ssh_pubkey } ],
-                        'serviceAccess' : service_keys
                     }