Changeset c65b7e4 for fedd/federation/access.py

Timestamp:

Dec 10, 2010 6:25:50 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

9973d57

Parents:

b16cfc0

Message:

Access controllers delete (some) unused ABAC attrs.

File:

• fedd/federation/access.py (modified) (1 diff)

fedd/federation/access.py

@@ -233 +233 @@
                 self.log.warning(("[read_state]: No saved state: " + \
                         "Unpickling failed: %s") % e)
+
+    def append_allocation_authorization(self, aid, attrs, 
+            need_state_lock=False, write_state_file=False, state_attr='state'):
+        """
+        Append the authorization information to system state.  By default we
+        assume this is called with the state lock and with a write of the state
+        file in the near future, need_state_lock and write_state_file can
+        override this.  The state_attr is the attribute in the access class
+        that holds the per allocation information.  Some complex classes use
+        different names for the dict.
+        """
+
+        for p, a in attrs:
+            self.auth.set_attribute(p, a)
+        self.auth.save()
+
+        if need_state_lock: self.state_lock.acquire()
+        d = getattr(self, state_attr)
+        if aid in d and 'auth' in d[aid]:
+            d[aid]['auth'].update(attrs)
+        if write_state_file: self.write_state()
+        if need_state_lock: self.state_lock.release()
+
+    def clear_allocation_authorization(self, aid, need_state_lock=False,
+            write_state_file=False, state_attr='state'):
+        """
+        Attrs is a set of attribute principal pairs that need to be removed
+        from the authenticator.  Remove them and save the authenticator.  See
+        append_allocation_authorization for the various overrides.
+        """
+
+        if need_state_lock: self.state_lock.acquire()
+        d = getattr(self, state_attr)
+        if aid in d and 'auth' in d[aid]:
+            for p, a in d[aid]['auth']:
+                self.auth.unset_attribute(p, a)
+            d[aid]['auth'] = set()
+        if write_state_file: self.write_state()
+        if need_state_lock: self.state_lock.release()
+        self.auth.save()
 
     def lookup_access(self, req, fid, filter=None, compare=None):