Changeset 8222e09 for fedd/access_to_abac.py
- Timestamp:
- Aug 21, 2012 11:02:35 AM (12 years ago)
- Branches:
- master
- Children:
- 794325b, b90c44d
- Parents:
- adf8517
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
fedd/access_to_abac.py
radf8517 r8222e09 69 69 # attributes mapping and the global one creates the access policy credentials. 70 70 71 # All the local parsing functions get the unparsed remainder of the line 72 # (after the three-name and the attribute it maps to), the credential list to 73 # add the new ABAC credential(s) that will be mapped into the local 74 # credentials, the fedid of this entity, a dict mapping the local credentials 75 # to ABAC credentials that are required to exercise those local rights and the 76 # three-name (p, gp, gu) that is being mapped. 71 # All the local parsing functions get 72 # * the unparsed remainder of the line in l. This is everything on the 73 # input line from the first comma after the -> to the end of the line. 74 # * the current list of credentials to be issued. This is a list of 75 # credential objects assigned from this principal (me) to principals 76 # making requests. They are derived from the three-name and delegation 77 # credentials. This routine adds any credentials that will be mapped to 78 # local access control information to creds. 79 # * me is this princpal - the access controller 80 # * to_id is a dict that maps the local name access control information into 81 # a list of credentials that imply the principal should be mapped to them. 82 # For example, parse_emulab is assigning (project, user, cert, key) to 83 # principals. The key of to_id is that tuple and it maps to a list of 84 # ABAC attributes. If an access controller wants to see if a caller can 85 # use a 4-tuple of credentials, it tries to prove that the caller has one 86 # of those attributes. 87 # * p is the principal that assigned the project and group. It is the name 88 # of an external experiment controller. 89 # * gp is the group asserted by the experiment controller 90 # * gu is the user asserted by the experiment controller 91 # * lr is the linking role used for delegation. If present credentials 92 # should be created with it. If it is None the credential construator will 93 # ignore it. It is hard to go wrong just passing it to the credential 94 # constructor. 95 # 96 # These functions map an assertion of (testbed, project, user) into the 97 # local parameters (local project, password, etc.) that triple gives the caller 98 # the caller to. These local parameters are parsed out of l. Those 99 # credentials are the keys to the to_id dict that will become the abac map. 100 # The c = credential... and creds.add(c) lines 101 # in parse_emulab can be taken as boilerplate for creating ABAC credentials. 102 # Each ABAC credential created by that boilerplate should be added to to_id, 103 # keyed by the local credentials. 77 104 def parse_emulab(l, creds, me, to_id, p, gp, gu, lr): 78 105 '''
Note: See TracChangeset
for help on using the changeset viewer.