Changeset dee164e for fedd/federation/access.py

Timestamp:

Nov 30, 2010 7:20:16 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

c324ad3

Parents:

4692a16

Message:

Looks like internal works now.

Had to add default entries to the access list to accomodate that, and discovered that ABAC requires strings - not unicode.

Moved lookup_access into the aceess class as most should be able to use it directly now.

File:

• fedd/federation/access.py (modified) (3 diffs)

fedd/federation/access.py

@@ -132 +132 @@
 
 
-    def read_access(self, fn, access_obj=None):
+    def read_access(self, fn, access_obj=None, default=[]):
         """
         Read an access DB of the form
@@ -188 +188 @@
             if a.attr in priorities:
                 a.priority = priorities[a.attr]
+
+        # default access mappings
+        for a, v in default:
+            self.access.append(
+                    access_base.access_attribute(attr=a, value=v, pri=0))
+
+
 
     def write_state(self):
@@ -226 +233 @@
                 self.log.warning(("[read_state]: No saved state: " + \
                         "Unpickling failed: %s") % e)
+
+    def lookup_access(self, req, fid, filter=None, compare=None): 
+        """
+        Check all the attributes that this controller knows how to map and see
+        if the requester is allowed to use any of them.  If so return one.
+        Filter defined the objects to check - it's a function that returns true
+        for the objects to check - and cmp defines the order to check them in
+        as the cmp field of sorted().  If filter is None, all possibilities are
+        checked.  If cmp is None, the choices are sorted by priority.
+        """
+
+        # Import request credentials into this (clone later??)
+        if self.auth.import_credentials(
+                data_list=req.get('abac_credential', [])):
+            self.auth.save()
+
+        # NB: in the default case (the else), the comparison order is reversed
+        # so numerically larger priorities are checked first.
+        if compare: c = compare
+        else: c = lambda(a, b): cmp(b,a)
+
+        if filter: f = filter
+        else: f = lambda(x): True
+
+        check = sorted([ a for a in self.access if f(a)], cmp=c)
+
+        # Check every attribute that we know how to map and take the first
+        # success.
+        for attr in check:
+            if self.auth.check_attribute(fid, attr.attr):
+                self.log.debug("Access succeeded for %s %s" % (attr.attr, fid))
+                # XXX: needs to deal with dynamics
+                return copy.copy(attr.value), (False, False, False), \
+                        [ fid ]
+            else:
+                self.log.debug("Access failed for %s %s" % (attr.attr, fid))
+        else:
+            raise service_error(service_error.access, "Access denied")
+