Changeset dee164e for fedd/federation/authorizer.py

Timestamp:

Nov 30, 2010 7:20:16 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

c324ad3

Parents:

4692a16

Message:

Looks like internal works now.

Had to add default entries to the access list to accomodate that, and discovered that ABAC requires strings - not unicode.

Moved lookup_access into the aceess class as most should be able to use it directly now.

File:

• fedd/federation/authorizer.py (modified) (5 diffs)

fedd/federation/authorizer.py

@@ -6 +6 @@
 from threading import Lock
 
-from string import join
+from string import join, hexdigits
 
 from fedid import fedid
@@ -240 +240 @@
         return abac_authorizer.clean_attr_re.sub('_', attr)
 
+
     def import_credentials(self, file_list=None, data_list=None):
         if data_list:
@@ -272 +273 @@
             if not isinstance(attr, basestring):
                 attr = "%s" % attr
+
             if self.me and self.key:
                 # Create a credential and insert it into context
@@ -338 +340 @@
         self.lock.release()
 
+    @staticmethod
+    def starts_with_fedid(attr):
+        """
+        Return true if the first 40 characters of the string are hex digits
+        followed by a dot.  False otherwise.  Used in check_attribute.
+        """
+        if attr.find('.') == 40:
+            return all([ x in hexdigits for x in attr[0:40]])
+        else:
+            return False
+
 
     def check_attribute(self, name, attr):
@@ -348 +361 @@
             if not isinstance(attr, basestring):
                 attr = "%s" % attr
-            # Naked attributes are attested by this principal
-            if attr.find('.') == -1: 
-                a = "%s.%s" % (self.fedid, self.clean_attr(attr))
-            else: 
+            # Attributes that start with a fedid only have the part of the
+            # attribute after the dot cleaned.  Others are completely cleaned
+            # and have the owner fedid attached.
+            if self.starts_with_fedid(attr):
                 r, a = attr.split('.',1)
                 a = "%s.%s" % ( r, self.clean_attr(a))
+            else: 
+                a = "%s.%s" % (self.fedid, self.clean_attr(attr))
+
+            a = str(a)
+            n = str("%s" % name)
 
             self.lock.acquire()
-            rv, proof = self.context.query(a, "%s" % name)
+            # Sigh. Unicode vs swig and swig seems to lose.  Make sure
+            # everything we pass into ABAC is a str not a unicode.
+            rv, proof = self.context.query(a, n)
             # XXX delete soon
             if not rv and attr in self.globals: rv = True