Changeset 8222e09 for fedd

Timestamp:

Aug 21, 2012 11:02:35 AM (12 years ago)

Author:

Ted Faber <faber@…>

Branches:

master

Children:

794325b, b90c44d

Parents:

adf8517

Message:

Better comment???

File:

• fedd/access_to_abac.py (modified) (1 diff)

fedd/access_to_abac.py

@@ -69 +69 @@
 # attributes mapping and the global one creates the access policy credentials.
 
-#  All the local parsing functions get the unparsed remainder of the line
-#  (after the three-name and the attribute it maps to), the credential list to
-#  add the new ABAC credential(s) that will be mapped into the local
-#  credentials, the fedid of this entity, a dict mapping the local credentials
-#  to ABAC credentials that are required to exercise those local rights and the
-#  three-name (p, gp, gu) that is being mapped.
+#  All the local parsing functions get 
+#    * the unparsed remainder of the line in l.  This is everything on the
+#       input line from the first comma after the -> to the end of the line.
+#    * the current list of credentials to be issued.  This is a list of
+#      credential objects assigned from this principal (me) to principals
+#      making requests.  They are derived from the three-name and delegation
+#      credentials.  This routine adds any credentials that will be mapped to
+#      local access control information to creds.
+#    * me is this princpal - the access controller
+#    * to_id is a dict that maps the local name access control information into
+#      a list of credentials that imply the principal should be mapped to them.
+#      For example, parse_emulab is assigning (project, user, cert, key) to
+#      principals.  The key of to_id is that tuple and it maps to a list of
+#      ABAC attributes.  If an access controller wants to see if a caller can
+#      use a 4-tuple of credentials, it tries to prove that the caller has one
+#      of those attributes.
+#    * p is the principal that assigned the project and group.  It is the name
+#       of an external experiment controller.
+#    * gp is the group asserted by the experiment controller
+#    * gu is the user asserted by the experiment controller
+#    * lr is the linking role used for delegation.  If present credentials
+#    should be created with it.  If it is None the credential construator will
+#    ignore it.  It is hard to go wrong just passing it to the credential
+#    constructor.
+#
+# These functions map an assertion of (testbed, project, user) into the
+# local parameters (local project, password, etc.) that triple gives the caller
+# the caller to.  These local parameters are parsed out of l.  Those
+# credentials are the keys to the to_id dict that will become the abac map.
+# The c = credential... and creds.add(c)  lines
+# in parse_emulab can be taken as boilerplate for creating ABAC credentials.
+# Each ABAC credential created by that boilerplate should be added to to_id,
+# keyed by the local credentials.
 def parse_emulab(l, creds, me, to_id, p, gp, gu, lr):
     '''