Changeset 5529264

Timestamp:

Mar 26, 2012 6:01:37 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

compt_changes, master

Children:

3bcb2eb

Parents:

406f3b5

Message:

Add commands for delegated federated users

File:

• fedd/access_to_abac.py (modified) (5 diffs)

fedd/access_to_abac.py

@@ -280 +280 @@
                 help='do not accept delegated attributes with the ' +\
                         'acting_for linking role')
+        self.add_option('--fed-root', dest='root', 
+                help='add a rule to accept federated users from facilities ' +\
+                        'recognized by ROOT.  This is a certificate file')
+        self.add_option('--fed-tuple', dest='ftuple', 
+                help='a tuple into which to map federated ' + \
+                        'users about which we know nothing else.')
         self.add_option('--no_auth', action='store_false', dest='create_auth', 
                 default=True, help='do not create a full ABAC authorizer')
@@ -392 +398 @@
     cert = None
 
+fed_to_id =  { }
+if any((opts.root, opts.ftuple)) and not all ((opts.root, opts.ftuple)):
+    sys.exit('Either both or neither of --fed-root and ' + \
+            '--fed-project must be specified')
+elif opts.root:
+    try:
+        root_fedid = fedid(file=opts.root)
+    except EnvironmentError, e:
+        sys.exit('Bad --root: %s (%s)' % (e.strerror, e.filename or '?!'))
+
+    fed_tuple = tuple(opts.ftuple.split(','))
+    fed_someuser_cred = \
+            credential(me, 'some_feduser', 
+                    [attribute(root_fedid.get_hexstr(), 
+                        'fedfacility', 'feduser')])
+    fed_user_cred = \
+            credential(me, 'default_feduser', 
+                    [attribute(me.get_hexstr(), 
+                        'some_feduser', 'acting_for')])
+    fed_access_cred = \
+            credential(me, 'access', 
+                    [attribute(me.get_hexstr(), 'default_feduser')])
+    
+    fed_to_id[fed_tuple] = [fed_user_cred]
+
+else:
+    # No fed-root or fed-tuple
+    fed_access_cred = None
+    fed_user_cred = None
+    fed_someuser_cred = None
+    
 # The try block makes sure that credentials split into tmp files are deleted
 try:
@@ -401 +438 @@
             print >> sys.stderr, "%s" % e
             continue
-
         except EnvironmentError, e:
             print >>sys.stderr, "File error %s: %s" % \
@@ -409 +445 @@
         # Credential output
         if opts.create_creds:
+            if fed_access_cred and fed_user_cred and fed_someuser_cred:
+                creds.add(fed_access_cred)
+                creds.add(fed_user_cred)
+                creds.add(fed_someuser_cred)
             if all([cert, key, opts.dir]):
                 try:
@@ -426 +466 @@
                 else:
                     f = sys.stdout
-                for k, c in to_id.items():
+                for k, c in to_id.items() + fed_to_id.items():
                     # Keys are either a single string or a tuple of them; join
                     # the tuples into a comma-separated string.