Changeset 9973d57 for fedd/federation/skeleton_access.py

Timestamp:

Dec 12, 2010 9:33:44 AM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

2627eb3

Parents:

c65b7e4

Message:

Move common GetRequest/ReleaseAccess? implementations to the base class

File:

• fedd/federation/skeleton_access.py (modified) (1 diff)

fedd/federation/skeleton_access.py

@@ -163 +163 @@
             }
 
-    def RequestAccess(self, req, fid):
-        """
-        Handle an access request.  Success here maps the requester into the
-        local access control space and establishes state about that user keyed
-        to a fedid.  We also save a copy of the certificate underlying that
-        fedid so this allocation can access configuration information and
-        shared parameters on the experiment controller.
-        """
-
-        # The dance to get into the request body
-        if req.has_key('RequestAccessRequestBody'):
-            req = req['RequestAccessRequestBody']
-        else:
-            raise service_error(service_error.req, "No request!?")
-
-        # Base class lookup routine.  If this fails, it throws a service
-        # exception denying access that triggers a fault response back to the
-        # caller.
-        found, match, owners = self.lookup_access(req, fid)
-        self.log.info(
-                "[RequestAccess] Access granted to %s with local creds %s" % \
-                (match, found))
-        # Make a fedid for this allocation
-        allocID, alloc_cert = generate_fedid(subj="alloc", log=self.log)
-        aid = unicode(allocID)
-
-        # Store the data about this allocation: 
-        self.state_lock.acquire()
-        self.state[aid] = { }
-        self.state[aid]['user'] = found
-        self.state[aid]['owners'] = owners
-        self.state[aid]['auth'] = set()
-        # Authorize the creating fedid and the principal representing the
-        # allocation to manipulate it.
-        self.append_allocation_authorization(aid, 
-                ((fid, allocID), (allocID, allocID)))
-        self.write_state()
-        self.state_lock.release()
-
-        # Create a directory to stash the certificate in, ans stash it.
-        try:
-            f = open("%s/%s.pem" % (self.certdir, aid), "w")
-            print >>f, alloc_cert
-            f.close()
-        except EnvironmentError, e:
-            raise service_error(service_error.internal, 
-                    "Can't open %s/%s : %s" % (self.certdir, aid, e))
-        self.log.debug('[RequestAccess] Returning allocation ID: %s' % allocID)
-        return { 'allocID': { 'fedid': allocID } }
-
-    def ReleaseAccess(self, req, fid):
-        """
-        Release the allocation granted earlier.  Access to the allocation is
-        checked and if valid, the state and cached certificate are destroyed.
-        """
-        # The dance to get into the request body
-        if req.has_key('ReleaseAccessRequestBody'):
-            req = req['ReleaseAccessRequestBody']
-        else:
-            raise service_error(service_error.req, "No request!?")
-
-        # Pull a key out of the request.  One can request to delete an
-        # allocation by a local human readable name or by a fedid.  This finds
-        # both choices.
-        try:
-            if 'localname' in req['allocID']:
-                auth_attr = aid = req['allocID']['localname']
-            elif 'fedid' in req['allocID']:
-                aid = unicode(req['allocID']['fedid'])
-                auth_attr = req['allocID']['fedid']
-            else:
-                raise service_error(service_error.req,
-                        "Only localnames and fedids are understood")
-        except KeyError:
-            raise service_error(service_error.req, "Badly formed request")
-
-        self.log.debug("[ReleaseAccess] deallocation requested for %s", aid)
-        #  Confirm access
-        if not self.auth.check_attribute(fid, auth_attr):
-            self.log.debug("[ReleaseAccess] deallocation denied for %s", aid)
-            raise service_error(service_error.access, "Access Denied")
-
-        # If there is an allocation in the state, delete it.  Note the locking.
-        self.state_lock.acquire()
-        if aid in self.state:
-            self.log.debug("[ReleaseAccess] Found allocation for %s" %aid)
-            self.clear_allocation_authorization(aid)
-            del self.state[aid]
-            self.write_state()
-            self.state_lock.release()
-            # And remove the access cert
-            cf = "%s/%s.pem" % (self.certdir, aid)
-            self.log.debug("[ReleaseAccess] Removing %s" % cf)
-            os.remove(cf)
-            return { 'allocID': req['allocID'] } 
-        else:
-            self.state_lock.release()
-            raise service_error(service_error.req, "No such allocation")
+    # RequestAccess and ReleaseAccess come from the base class
 
     def StartSegment(self, req, fid):