Changeset c65b7e4 for fedd

Timestamp:

Dec 10, 2010 6:25:50 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

9973d57

Parents:

b16cfc0

Message:

Access controllers delete (some) unused ABAC attrs.

Location:

fedd/federation

Files:

• access.py (modified) (1 diff)
• deter_internal_access.py (modified) (2 diffs)
• dragon_access.py (modified) (2 diffs)
• emulab_access.py (modified) (4 diffs)
• protogeni_access.py (modified) (2 diffs)
• skeleton_access.py (modified) (2 diffs)

fedd/federation/access.py

@@ -233 +233 @@
                 self.log.warning(("[read_state]: No saved state: " + \
                         "Unpickling failed: %s") % e)
+
+    def append_allocation_authorization(self, aid, attrs, 
+            need_state_lock=False, write_state_file=False, state_attr='state'):
+        """
+        Append the authorization information to system state.  By default we
+        assume this is called with the state lock and with a write of the state
+        file in the near future, need_state_lock and write_state_file can
+        override this.  The state_attr is the attribute in the access class
+        that holds the per allocation information.  Some complex classes use
+        different names for the dict.
+        """
+
+        for p, a in attrs:
+            self.auth.set_attribute(p, a)
+        self.auth.save()
+
+        if need_state_lock: self.state_lock.acquire()
+        d = getattr(self, state_attr)
+        if aid in d and 'auth' in d[aid]:
+            d[aid]['auth'].update(attrs)
+        if write_state_file: self.write_state()
+        if need_state_lock: self.state_lock.release()
+
+    def clear_allocation_authorization(self, aid, need_state_lock=False,
+            write_state_file=False, state_attr='state'):
+        """
+        Attrs is a set of attribute principal pairs that need to be removed
+        from the authenticator.  Remove them and save the authenticator.  See
+        append_allocation_authorization for the various overrides.
+        """
+
+        if need_state_lock: self.state_lock.acquire()
+        d = getattr(self, state_attr)
+        if aid in d and 'auth' in d[aid]:
+            for p, a in d[aid]['auth']:
+                self.auth.unset_attribute(p, a)
+            d[aid]['auth'] = set()
+        if write_state_file: self.write_state()
+        if need_state_lock: self.state_lock.release()
+        self.auth.save()
 
     def lookup_access(self, req, fid, filter=None, compare=None): 

fedd/federation/deter_internal_access.py

@@ -166 +166 @@
         self.state[aid]['owners'] = owners
         self.state[aid]['vlan'] = None
+        self.state[aid]['auth'] = set()
+        self.append_allocation_authorization(aid, 
+                ((fid, allocID),(allocID, allocID)))
         self.write_state()
         self.state_lock.release()
-        self.auth.set_attribute(fid, allocID)
-        self.auth.set_attribute(allocID, allocID)
-        self.auth.save()
 
         try:
@@ -209 +209 @@
         if self.state.has_key(aid):
             self.log.debug("Found allocation for %s" %aid)
+            self.clear_allocation_authorization(aid)
             del self.state[aid]
             self.write_state()

fedd/federation/dragon_access.py

@@ -149 +149 @@
         self.state[aid]['user'] = found
         self.state[aid]['owners'] = owners
+        self.state[aid]['auth'] = set()
+        self.append_allocation_authorization(aid, 
+                ((fid, allocID),(allocID, allocID)))
         self.write_state()
         self.state_lock.release()
-        self.auth.set_attribute(fid, allocID)
-        self.auth.set_attribute(allocID, allocID)
-        self.auth.save()
 
         try:
@@ -191 +191 @@
         if self.state.has_key(aid):
             self.log.debug("Found allocation for %s" %aid)
+            self.clear_allocation_authorization(aid)
             del self.state[aid]
             self.write_state()

fedd/federation/emulab_access.py

@@ -254 +254 @@
                     'Bad mapping (unbalanced parens or more than 1 comma)')
 
-
     # RequestAccess support routines
 
@@ -384 +383 @@
         self.state_lock.acquire()
         self.allocation[aid] = { }
+        self.allocation[aid]['auth'] = set()
         try:
             pname = ap['project']['name']['localname']
@@ -511 +511 @@
         for k, v in svc_state.items():
             self.allocation[aid][k] = v
+        self.append_allocation_authorization(aid, 
+                set([(o, allocID) for o in owners]), state_attr='allocation')
         self.write_state()
         self.state_lock.release()
-        # Give the owners the right to change this allocation
-        for o in owners:
-            self.auth.set_attribute(o, allocID)
-        self.auth.save()
         try:
             f = open("%s/%s.pem" % (self.certdir, aid), "w")
@@ -591 +589 @@
         if aid in self.allocation:
             self.log.debug("Found allocation for %s" %aid)
+            self.clear_allocation_authorization(aid, state_attr='allocation')
             for k in self.allocation[aid]['keys']:
                 kk = "%s:%s" % k

fedd/federation/protogeni_access.py

@@ -275 +275 @@
         # The list of owner FIDs
         self.allocation[aid]['owners'] = owners
+        self.allocation[aid]['auth'] = set()
+        self.append_allocation_authorization(aid, 
+                ((fid, allocID), (allocID, allocID)), state_attr='allocation')
         self.write_state()
         self.state_lock.release()
-        self.auth.set_attribute(fid, allocID)
-        self.auth.set_attribute(allocID, allocID)
-        self.auth.save()
 
         try:
@@ -319 +319 @@
         if self.allocation.has_key(aid):
             self.log.debug("Found allocation for %s" %aid)
+            self.clear_allocation_authorization(aid, state_attr='allocation')
             del self.allocation[aid]
             self.write_state()

fedd/federation/skeleton_access.py

@@ -194 +194 @@
         self.state[aid]['user'] = found
         self.state[aid]['owners'] = owners
+        self.state[aid]['auth'] = set()
+        # Authorize the creating fedid and the principal representing the
+        # allocation to manipulate it.
+        self.append_allocation_authorization(aid, 
+                ((fid, allocID), (allocID, allocID)))
         self.write_state()
         self.state_lock.release()
-        # Authorize the creating fedid and the principal representing the
-        # allocation to manipulate it.
-        self.auth.set_attribute(fid, allocID)
-        self.auth.set_attribute(allocID, allocID)
-        self.auth.save()
 
         # Create a directory to stash the certificate in, ans stash it.
@@ -249 +249 @@
         if aid in self.state:
             self.log.debug("[ReleaseAccess] Found allocation for %s" %aid)
+            self.clear_allocation_authorization(aid)
             del self.state[aid]
             self.write_state()