Changeset 9e75ff8 for fedd/federation

Timestamp:

Jan 7, 2011 5:20:41 PM (14 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

f158ccf

Parents:

454f398 (diff), 490ee21 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Merge branch 'master' of tardis.deterlab.net:/var/local/git/fedd

File:

• fedd/federation/ns2topdl.py (modified) (5 diffs)

fedd/federation/ns2topdl.py

@@ -11 +11 @@
 from remote_service import xmlrpc_handler, soap_handler
 from service_error import *
-from authorizer import authorizer
+from authorizer import authorizer, abac_authorizer
 
 
@@ -31 +31 @@
         self.tcl_splitter = config.get("ns2topdl", "tcl_splitter",
                 "/usr/testbed/lib/ns2ir/parse.tcl")
+        self.auth_type = config.get('ns2topdl', 'auth_type') or 'legacy'
         access_db = config.get("ns2topdl", "accessdb", None)
-        allow_any = config.getboolean("ns2topdl", "allow_any", False)
+        self.allow_any = config.getboolean("ns2topdl", "allow_any", False)
+        auth_dir = config.get('ns2topdl', 'auth_dir')
 
         self.log = logging.getLogger("fedd.ns2topdl")
@@ -47 +49 @@
                     "using local one")
 
-        if access_db and allow_any: 
+
+        if self.auth_type == 'legacy':
+            if access_db and self.allow_any: 
+                raise service_error(service_error.internal, 
+                        "Cannot specify both an access database and " + 
+                        "allow_any for ns2topdl")
+            
+            if access_db:
+                try:
+                    read_simple_accessdb(access_db, self.auth, 'ns2topdl')
+                except EnvironmentError, e:
+                    raise service_error(service_error.internal,
+                            "Error reading accessDB %s: %s" % (access_db, e))
+                except ValueError:
+                    raise service_error(service_error.internal, "%s" % e)
+            elif self.allow_any:
+                auth.set_global_attribute("ns2topdl")
+        elif self.auth_type == 'abac':
+            self.auth = abac_authorizer(load=auth_dir)
+        else:
             raise service_error(service_error.internal, 
-                    "Cannot specify both an access database and allow_any " +\
-                            "for ns2topdl")
-        
-        if access_db:
-            try:
-                read_simple_accessdb(access_db, self.auth, 'ns2topdl')
-            except EnvironmentError, e:
-                raise service_error(service_error.internal,
-                        "Error reading accessDB %s: %s" % (access_db, e))
-            except ValueError:
-                raise service_error(service_error.internal, "%s" % e)
-        elif allow_any:
-            auth.set_global_attribute("ns2topdl")
+                    "Unknown auth_type: %s" % self.auth_type)
 
 
@@ -81 +90 @@
         """
 
-        if not self.auth.check_attribute(fid, 'ns2topdl'):
-            raise service_error(service_error.access, "Access Denied")
+        if self.allow_any:
+            self.auth.set_attribute(fid, 'ns2topdl')
+
+        access_ok, proof = self.auth.check_attribute(fid, 'ns2topdl',
+            with_proof=True)
+
+        if not access_ok:
+            raise service_error(service_error.access, "Access Denied", 
+                proof=proof)
 
         try:
@@ -137 +153 @@
                 'experimentdescription':  { 
                     'topdldescription': top.to_dict(),
-                    }
+                    },
+                'proof': proof.to_dict(),
                 }