Changeset 9e75ff8 for fedd

Timestamp:

Jan 7, 2011 5:20:41 PM (14 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

f158ccf

Parents:

454f398 (diff), 490ee21 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Merge branch 'master' of tardis.deterlab.net:/var/local/git/fedd

Location:

fedd

Files:

• cert_to_fedid.py (modified) (3 diffs)
• federation/ns2topdl.py (modified) (5 diffs)

fedd/cert_to_fedid.py

@@ -4 +4 @@
 import subprocess, tempfile
 import os.path
+import re
+
+from M2Crypto import X509
 
 from string import join
@@ -16 +19 @@
         self.add_option('--debug', dest='debug', action='store_true', 
                 default=False, help='Just print command')
+        self.add_option('--cert', dest='cert', 
+                help='Cretificate to copy subject from')
         self.add_option('--openssl', dest='openssl',
                 help='Path to openssl command', default='/usr/bin/openssl')
@@ -37 +42 @@
 
 try:
+    c = X509.load_cert(opts.cert)
+    subj = c.get_subject().as_text()
+    if subj.startswith('/'): i = 1
+    else: i = 0
+    subj = '/' + re.sub('/', '\/', subj[i:])
+
     tf, tn = tempfile.mkstemp(suffix=".pem")
     cmd = [opts.openssl, 'req', '-new', '-nodes', '-subj', 
-            '/CN=users.isi.deterlab.net', '-x509', '-days',  '3650',
+            subj, '-x509', '-days',  '3650',
             '-key', key, '-out', tn]
     if opts.debug:

fedd/federation/ns2topdl.py

@@ -11 +11 @@
 from remote_service import xmlrpc_handler, soap_handler
 from service_error import *
-from authorizer import authorizer
+from authorizer import authorizer, abac_authorizer
 
 
@@ -31 +31 @@
         self.tcl_splitter = config.get("ns2topdl", "tcl_splitter",
                 "/usr/testbed/lib/ns2ir/parse.tcl")
+        self.auth_type = config.get('ns2topdl', 'auth_type') or 'legacy'
         access_db = config.get("ns2topdl", "accessdb", None)
-        allow_any = config.getboolean("ns2topdl", "allow_any", False)
+        self.allow_any = config.getboolean("ns2topdl", "allow_any", False)
+        auth_dir = config.get('ns2topdl', 'auth_dir')
 
         self.log = logging.getLogger("fedd.ns2topdl")
@@ -47 +49 @@
                     "using local one")
 
-        if access_db and allow_any: 
+
+        if self.auth_type == 'legacy':
+            if access_db and self.allow_any: 
+                raise service_error(service_error.internal, 
+                        "Cannot specify both an access database and " + 
+                        "allow_any for ns2topdl")
+            
+            if access_db:
+                try:
+                    read_simple_accessdb(access_db, self.auth, 'ns2topdl')
+                except EnvironmentError, e:
+                    raise service_error(service_error.internal,
+                            "Error reading accessDB %s: %s" % (access_db, e))
+                except ValueError:
+                    raise service_error(service_error.internal, "%s" % e)
+            elif self.allow_any:
+                auth.set_global_attribute("ns2topdl")
+        elif self.auth_type == 'abac':
+            self.auth = abac_authorizer(load=auth_dir)
+        else:
             raise service_error(service_error.internal, 
-                    "Cannot specify both an access database and allow_any " +\
-                            "for ns2topdl")
-        
-        if access_db:
-            try:
-                read_simple_accessdb(access_db, self.auth, 'ns2topdl')
-            except EnvironmentError, e:
-                raise service_error(service_error.internal,
-                        "Error reading accessDB %s: %s" % (access_db, e))
-            except ValueError:
-                raise service_error(service_error.internal, "%s" % e)
-        elif allow_any:
-            auth.set_global_attribute("ns2topdl")
+                    "Unknown auth_type: %s" % self.auth_type)
 
 
@@ -81 +90 @@
         """
 
-        if not self.auth.check_attribute(fid, 'ns2topdl'):
-            raise service_error(service_error.access, "Access Denied")
+        if self.allow_any:
+            self.auth.set_attribute(fid, 'ns2topdl')
+
+        access_ok, proof = self.auth.check_attribute(fid, 'ns2topdl',
+            with_proof=True)
+
+        if not access_ok:
+            raise service_error(service_error.access, "Access Denied", 
+                proof=proof)
 
         try:
@@ -137 +153 @@
                 'experimentdescription':  { 
                     'topdldescription': top.to_dict(),
-                    }
+                    },
+                'proof': proof.to_dict(),
                 }