Changeset cbe0570 for fedd

Timestamp:

Sep 19, 2011 11:27:46 AM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

compt_changes, info-ops, master

Children:

5f51dc1

Parents:

36f642f

Message:

Convert to libcreddy. Closes #19

File:

• fedd/federation/authorizer.py (modified) (8 diffs)

fedd/federation/authorizer.py

@@ -15 +15 @@
 
 import ABAC
+import Creddy
 import pickle
 
@@ -208 +209 @@
 
     def __init__(self, certs=None, me=None, key=None, load=None, save=None):
-        self.creddy = '/usr/local/bin/creddy'
+        self.creddy_id = None
         self.globals = set()
         self.lock = Lock()
@@ -230 +231 @@
                 self.key, self.me = abac_split_cert(self.me, keyfile, certfile)
                 self.local_files = True
+                self.init_libcreddy_id()
             else:
                 raise abac_authorizer.bad_cert_error("Combination " + \
@@ -254 +256 @@
             self.load(load)
 
+    def init_libcreddy_id(self):
+        self.creddy_id = None
+        try:
+            self.creddy_id = Creddy.ID(self.me)
+        except:
+            raise abac_authorizer.bad_cert_error('Cannot load cert %s: %s' \
+                    % self.me)
+
+        try:
+            self.creddy_id.load_privkey(self.key)
+        except:
+            self.creddy_id = None
+            raise abac_authorized_bad_cert_error('Cannot load key %s' \
+                    % self.key)
+
+
+
     # Modify the pickling operations so that the context and lock are not
     # pickled
@@ -261 +280 @@
         del d['lock']
         del d['context']
+        del d['creddy_id']
         return d
 
@@ -310 +330 @@
                 attr = "%s" % attr
 
-            if self.me and self.key:
+            if self.creddy_id:
                 # Create a credential and insert it into context
                 # This will simplify when we have libcreddy
                 try:
-                    # create temp file
-                    f, fn = mkstemp()
-                    os.close(f)
-                except EnvironmentError, e:
-                    raise abac_authorizer.attribute_error(
-                            "Cannot create temp file: %s" %e)
-
-                # Create the attribute certificate with creddy
-                cmd = [self.creddy, '--attribute', '--issuer=%s' % self.me, 
-                    '--key=%s' % self.key, '--role=%s' % self.clean_attr(attr), 
-                    '--subject-id=%s' % name, '--out=%s' % fn]
-                rv = call(cmd)
-                if rv == 0:
-                    self.lock.acquire()
-                    # load it to context and remove the file
-                    rv = self.context.load_attribute_file(fn)
-                    self.lock.release()
-                    os.unlink(fn)
-                else:
-                    os.unlink(fn)
-                    raise abac_authorizer.attribute_error(
-                            "creddy returned %s" % rv)
+                    attrcert = Creddy.Attribute(self.creddy_id, 
+                            self.clean_attr(attr), 3600 * 24 * 365 * 10)
+                    attrcert.principal("%s" % name)
+                    attrcert.bake()
+                except:
+                    raise abac_authorized_bad_cert_error(
+                            "Cannot create attribute cert")
+                self.lock.acquire()
+                # load it to context and remove the file
+                rv = self.context.load_attribute_chunk(attrcert.cert_chunk())
+                self.lock.release()
+                return rv
             else:
                 raise abac_authorizer.attribute_error(
@@ -342 +352 @@
             # Insert this credential into the context
             self.lock.acquire()
-            self.context.load_attribute_chunk(cert)
-            self.lock.release()
+            rv = self.context.load_attribute_chunk(cert)
+            self.lock.release()
+            return rv
         else:
             raise abac_authorizer.attribute_error(
@@ -552 +563 @@
             if self.me:
                 self.context.load_id_file(self.me)
+                if self.key:
+                    self.init_libcreddy_id()
             self.context.load_directory("%s/certs" % dir)
             self.save_dir = dir