Changeset b7a61ac for fedd

Timestamp:

Dec 3, 2010 10:20:08 AM (14 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

262328f

Parents:

a0e20ac

Message:

ABAC into the skeleton

File:

• fedd/federation/skeleton_access.py (modified) (6 diffs)

fedd/federation/skeleton_access.py

@@ -11 +11 @@
 from util import *
 from fedid import fedid, generate_fedid
-from authorizer import authorizer
+from authorizer import authorizer, abac_authorizer
 from service_error import service_error
 from remote_service import xmlrpc_handler, soap_handler, service_caller
@@ -64 +64 @@
         here.
 
-        The access database maps users to a simple string.  Use the sample at.
+        The access database maps users to a simple string.
         """
 
@@ -74 +74 @@
         # The available integers
         self.available_ints = set(range(0,self.maxint))
-        # This will contain the local data from a successful access request.
-        # Keys are the valid three-names, and values are the locally
-        # interpreted data.
-        self.access = { }
-        # Read the access values.  We read the accessDB in the derived class so
-        # that the derived class can specialize the reading of access info.  In
-        # this case, we gather the strings in the access db into self.access
-        # using the translator above.
-        if config.has_option("access", "accessdb"):
-            try:
-                self.read_access(config.get("access", "accessdb"), 
-                        self.parse_access_string)
-            except EnvironmentError, e:
-                self.log.error("Cannot read %s: %s" % \
-                        (config.get("access", "accessdb"), e))
-                raise e
-
-        # The base class initializer has read the state dictionary from the
-        # state file, if there is one.  The state variable includes information
-        # about each active allocation, keyed by the allocation identifier.
-        # This loop extracts the owners stored with each allocation and
-        # associates an access attribute with them.  Each owner is allowed to
-        # access each thing they own.  This is a specialization of the state
-        # handling.
+
+        # authorization information
+        self.auth_type = config.get('access', 'auth_type') \
+                or 'legacy'
+        self.auth_dir = config.get('access', 'auth_dir')
+        accessdb = config.get("access", "accessdb")
+        # initialize the authorization system.  In each case we make a call to
+        # read the access database that maps from authorization information
+        # into local information.  The local information is parsed by the
+        # translator above.
+        if self.auth_type == 'legacy':
+            self.access = { }
+            if accessdb:
+                try:
+                    self.legacy_read_access(accessdb, self.parse_access_string)
+                except EnvironmentError, e:
+                    self.log.error("Cannot read %s: %s" % \
+                            (config.get("access", "accessdb"), e))
+                    raise e
+            # The base class initializer has read the state dictionary from the
+            # state file, if there is one.  The state variable includes
+            # information about each active allocation, keyed by the allocation
+            # identifier.  This loop extracts the owners stored with each
+            # allocation and associates an access attribute with them.  Each
+            # owner is allowed to access each thing they own.  This is a
+            # specialization of the state handling.  ABAC records this
+            # information explicitly so this loop only executes for legacy
+            # code.
+            self.state_lock.acquire()
+            for k in self.state.keys():
+                # Add the owners
+                for o in self.state[k].get('owners', []):
+                    self.auth.set_attribute(o, fedid(hexstr=k))
+                # The principal represented by the allocation itself is also
+                # allowed to make accesses.
+                self.auth.set_attribute(fedid(hexstr=k),fedid(hexstr=k))
+            self.state_lock.release()
+            # This access controller does not specialize the process of looking
+            # up local information.  This aliases the lookup_access method to
+            # be easier to read.
+            self.lookup_access = self.legacy_lookup_access_base
+        elif self.auth_type == 'abac':
+            #  Load the current authorization state
+            self.auth = abac_authorizer(load=self.auth_dir)
+            self.access = [ ]
+            if accessdb:
+                try:
+                    self.read_access(accessdb, self.parse_access_string)
+                except EnvironmentError, e:
+                    self.log.error("Cannot read %s: %s" % \
+                            (config.get("access", "accessdb"), e))
+                    raise e
+        else:
+            raise service_error(service_error.internal, 
+                    "Unknown auth_type: %s" % self.auth_type)
+
+        # Clean the state
         self.state_lock.acquire()
         for k in self.state.keys():
-            # Add the owners
-            for o in self.state[k].get('owners', []):
-                self.auth.set_attribute(o, fedid(hexstr=k))
-            # The principal represented by the allocation itself is also
-            # allowed to make accesses.
-            self.auth.set_attribute(fedid(hexstr=k),fedid(hexstr=k))
             # Remove any allocated integers from the available ones
             if 'integer' in self.state[k]:
                 self.available_ints.discard(self.state[k]['integer'])
         self.state_lock.release()
-
-        # This access controller does not specialize the process of looking up
-        # local information.  This aliases the lookup_access method to be
-        # easier to read.
-        self.lookup_access = self.lookup_access_base
 
         # These dictionaries register the plug-in's local routines for handline
@@ -158 +180 @@
         # exception denying access that triggers a fault response back to the
         # caller.
-        found, match = self.lookup_access(req, fid)
+        found, match, owners = self.lookup_access(req, fid)
         self.log.info(
                 "[RequestAccess] Access granted to %s with local creds %s" % \
@@ -170 +192 @@
         self.state[aid] = { }
         self.state[aid]['user'] = found
-        self.state[aid]['owners'] = [ fid ]
+        self.state[aid]['owners'] = owners
         self.write_state()
         self.state_lock.release()
@@ -177 +199 @@
         self.auth.set_attribute(fid, allocID)
         self.auth.set_attribute(allocID, allocID)
+        self.auth.save()
 
         # Create a directory to stash the certificate in, ans stash it.