Changeset d894c21

Timestamp:

Dec 1, 2010 5:23:19 PM (14 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

de86b35

Parents:

5c3d542

Message:

One step policy extraction and authorizer creation

File:

• fedd/access_to_abac.py (modified) (9 diffs)

fedd/access_to_abac.py

@@ -4 +4 @@
 import re
 import subprocess
+import os.path
 
 from string import join
+from optparse import OptionParser, OptionValueError
+from tempfile import mkdtemp
+
 from federation.fedid import fedid
+from federation.authorizer import abac_authorizer
 from federation.util import abac_split_cert, abac_pem_type
-from optparse import OptionParser, OptionValueError
 
 
@@ -179 +183 @@
 # internal plug-ins have no local attributes.
 def parse_internal(l, creds, me, to_id, p, gp, gu, lr): pass
+
+
+def parse_access(fn, mapper):
+    """
+    Parse the access file, calling out to the mapper to parse specific
+    credential types.  Mappers are above this code.
+    """
+    creds = set()
+    to_id = { }
+    f = open(fn, "r")
+    for i, l in enumerate(f):
+        try:
+            if comment_re.match(l):
+                continue
+            else:
+                m =  line_re.match(l)
+                if m:
+                    p, da = m.group(1, 4)
+                    gp, gu = m.group(2, 3)
+                    if gp == '<any>': gp = None
+                    if gu == '<any>': gu = None
+
+                    creds.add(credential(me, da, 
+                            [attribute(p, x, delegation_link) \
+                                    for x in (gp, gu) \
+                                        if x is not None]))
+                    if m.group(5) and mapper:
+                        mapper(m.group(5), creds, me, to_id, p, gp, gu,
+                                delegation_link)
+                else:
+                    raise parse_error('Syntax error')
+        except parse_error, e:
+            f.close()
+            raise parse_error('Error on line %d of %s: %s' % \
+                    (i, fn, e.message))
+    f.close()
+
+    return creds, to_id
+
 
 
@@ -233 +276 @@
                 help='do not accept delegated attributes with the ' +\
                         'acting_for linking role')
+        self.add_option('--auth', action='store_true', dest='create_auth', 
+                default=False, help='create a full ABAC authorizer')
         self.add_option('--debug', action='store_true', dest='debug', 
                 default=False, help='Just print actions')
@@ -273 +318 @@
                 raise credential_error("%s: %d" % (join(cmd), rv))
 
+def clear_dir(dir):
+    for path, dirs, files in os.walk(dir, topdown=False):
+        for f in files: os.unlink(os.path.join(path, f))
+        for d in dirs: os.rmdir(os.path.join(path, d))
+
 # Regular expressions and parts thereof for parsing
 comment_re = re.compile('^\s*#|^$')
@@ -290 +340 @@
 cert, key = None, None
 delete_certs = False
+delete_creds = False
 
 if opts.file:
@@ -315 +366 @@
         sys.exit('%s is not writable' % opts.dir)
 
+if opts.create_auth:
+    creds_dir = mkdtemp()
+    delete_creds = True
+    auth_dir = opts.dir
+else:
+    creds_dir = opts.dir
+    auth_dir = None
+
 if opts.delegate: delegation_link = 'acting_for'
 else: delegation_link = None
@@ -341 +400 @@
     # Do the parsing
     for fn in args:
-        creds = set()
-        to_id = { }
         try:
-            f = open(fn, "r")
-            for i, l in enumerate(f):
-                try:
-                    if comment_re.match(l):
-                        continue
-                    else:
-                        m =  line_re.match(l)
-                        if m:
-                            p, da = m.group(1, 4)
-                            gp, gu = m.group(2, 3)
-                            if gp == '<any>': gp = None
-                            if gu == '<any>': gu = None
-
-                            creds.add(credential(me, da, 
-                                    [attribute(p, x, delegation_link) \
-                                            for x in (gp, gu) \
-                                                if x is not None]))
-                            if m.group(5) and mapper:
-                                mapper(m.group(5), creds, me, to_id, p, gp, gu,
-                                        delegation_link)
-                        else:
-                            raise parse_error('Syntax error')
-                except parse_error, e:
-                    f.close()
-                    raise parse_error('Error on line %d of %s: %s' % \
-                            (i, fn, e.message))
-                    
-            f.close()
+            creds, to_id = parse_access(fn, mapper)
         except parse_error, e:
             print >> sys.stderr, "%s" % e
@@ -386 +416 @@
                 try:
                     create_creds([c for c in creds if c.principal == me],
-                            cert, key, opts.dir, opts.debug)
+                            cert, key, creds_dir, opts.debug)
                 except credential_error, e:
                     sys.exit('Credential creation failed: %s' % e)
             else:
-                print >>sys.stderr, 'Cannot create credentials.  Missing parameter'
+                print >>sys.stderr, 'Cannot create credentials.  ' + \
+                        'Missing parameter'
 
         # Local map output
@@ -403 +434 @@
                         print >>f, "%s -> (%s)" % ( a, join(k, ', '))
             except EnvironmentError, e:
-                sys.exit("Cannot open %s: %s" % (e.filename or '!?', e.strerror))
+                sys.exit("Cannot open %s: %s" % (e.filename or '!?', 
+                    e.strerror))
+
+        # Create an authorizer if requested.
+        if opts.create_auth:
+            clear_dir(auth_dir)
+            try:
+                # Pass in the options rather than the potentially split key
+                # because abac_authorizer will split it and store it
+                # internally.  The opts.cert may get split twice, but we won't
+                # lose one.
+                a = abac_authorizer(key=opts.key, me=opts.cert, 
+                        certs=creds_dir, save=auth_dir)
+                a.save(auth_dir)
+            except EnvironmentError, e:
+                sys.exit("Can't create or write %s: %s" % (e.filename, e.strerror))
+            except abac_authorizer.bad_cert_error, e:
+                sys.exit("Error creating authorizer: %s" % e)
+
 finally:
-    if delete_certs:
-        if cert: os.unlink(cert)
-        if key: os.unlink(key)
+    try:
+        if delete_certs:
+            if cert: os.unlink(cert)
+            if key: os.unlink(key)
+        if delete_creds and creds_dir:
+            clear_dir(creds_dir)
+            os.rmdir(creds_dir)
+    except EnvironmentError, e:
+        sys.exit("Can't remove %s: %s" % ( e.filename, e.strerror))