Changeset 93a06fb for fedd

Timestamp:

Nov 26, 2008 3:11:26 PM (16 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master, version-1.30, version-2.00, version-3.01, version-3.02

Children:

0ea5050

Parents:

40eab39

Message:

Explicit allocation levels for the different knods of allocations.

File:

• fedd/fedd_allocate_project.py (modified) (8 diffs)

fedd/fedd_allocate_project.py

@@ -33 +33 @@
     Allocate projects on this machine in response to an access request.
     """
+    dynamic_projects = 4
+    dynamic_keys= 2
+    confirm_keys = 1
+    none = 0
+
+    levels = {
+            'dynamic_projects': dynamic_projects,
+            'dynamic_keys': dynamic_keys,
+            'confirm_keys': confirm_keys,
+            'none': none,
+    }
+
     def __init__(self, config, auth=None):
         """
@@ -48 +60 @@
         self.grantnodetype = config.get('access', 'grantnodetype', 
                 '/usr/testbed/sbin/grantnodetype')
+        self.confirmkey = config.get('access', 'confirmkey', 
+                '/usr/testbed/sbin/taddpubkey')
+        self.allocation_level = config.get("access", "allocation_level", "none")
         self.log = logging.getLogger("fedd.allocate.local")
+
+        try:
+            self.allocation_level = \
+                    self.levels[self.allocation_level.strip().lower()]
+        except KeyError:
+            self.log.error("Bad allocation_level %s.  Defaulting to none" % \
+                    self.allocation_error)
+            self.allocation_level = self.none
+
+
         set_log_level(config, "access", self.log)
         fixed_key_db = config.get("access", "fixed_keys", None)
@@ -112 +137 @@
         Req includes the project and resources as a dictionary
         """
+
+        if self.allocation_level < self.dynamic_projects:
+            raise service_error(service_error.access, 
+                    "[dynamic_project] dynamic project allocation not " + \
+                            "permitted: check allocation level")
         # tempfiles for the parameter files
         uf, userfile = tempfile.mkstemp(prefix="usr", suffix=".xml",
@@ -254 +284 @@
             for sk in [ k['sshPubkey'] for k in u.get('access', []) \
                     if k.has_key('sshPubkey')]:
-                cmds.append((self.wap, self.addpubkey, '-w', \
-                        '-u', name, '-k', sk))
+                if self.allocation_level >= self.dynamic_keys:
+                    cmds.append((self.wap, self.addpubkey, '-w', \
+                            '-u', name, '-k', sk))
+                elif self.allocation_level >= self.confirm_keys:
+                    cmds.append((self.wap, self.confirmkey, '-C', \
+                            '-u', name, '-k', sk))
+                else:
+                    self.log.warning("[static_project] no checking of " + \
+                            "static keys")
         
 
@@ -264 +301 @@
                 if r.has_key('node') and r['node'].has_key('hardware')\
                     for h in r['node']['hardware'] ] :
-            cmds.append((self.wap, self.grantnodetype, '-p', pname, nt))
+            if self.allocation_level >= self.confirm_keys:
+                cmds.append((self.wap, self.grantnodetype, '-p', pname, nt))
 
         # Run the commands 
@@ -314 +352 @@
                     if k.has_key('sshPubkey')]:
                 if (name.rstrip(), sk.rstrip()) not in self.fixed_keys:
-                    cmds.append((self.wap, self.addpubkey, '-R', '-w', \
-                            '-u', name, '-k', sk))
-        if pname and pname not in self.fixed_projects:
+                    if self.allocation_level >= self.dynamic_keys:
+                        cmds.append((self.wap, self.addpubkey, '-R', '-w', \
+                                '-u', name, '-k', sk))
+        if pname and pname not in self.fixed_projects and \
+                self.allocation_level >= self.dynamic_projects:
             cmds.append((self.wap, self.rmproj, pname))
 
@@ -393 +433 @@
 
         self.debug = config.get("access", "debug_project", False)
-        self.url = config.get("access", "dynamic_projects_url", "")
+        self.url = config.get("access", "project_allocation_uri", "")
 
         self.cert_file = config.get("access", "cert_file", None)
@@ -429 +469 @@
         self.log = logging.getLogger("fedd.allocate.remote")
         set_log_level(config, "access", self.log)
+
         # The specializations of the proxy functions
         self.dynamic_project = self.proxy(self.url, self.cert_file,