Changeset dee164e for fedd/federation/deter_internal_access.py

Timestamp:

Nov 30, 2010 7:20:16 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

c324ad3

Parents:

4692a16

Message:

Looks like internal works now.

Had to add default entries to the access list to accomodate that, and discovered that ABAC requires strings - not unicode.

Moved lookup_access into the aceess class as most should be able to use it directly now.

File:

• fedd/federation/deter_internal_access.py (modified) (7 diffs)

fedd/federation/deter_internal_access.py

@@ -15 +15 @@
 from allocate_project import allocate_project_local, allocate_project_remote
 from fedid import fedid, generate_fedid
-from authorizer import authorizer
+from authorizer import authorizer, abac_authorizer
 from service_error import service_error
 from remote_service import xmlrpc_handler, soap_handler, service_caller
@@ -29 +29 @@
 
 from access import access_base
+from legacy_access import legacy_access
 
 # Make log messages disappear if noone configures a fedd logger
@@ -37 +38 @@
 fl.addHandler(nullHandler())
 
-class access(access_base):
+class access(access_base, legacy_access):
     @staticmethod
     def parse_vlans(v, log=None):
@@ -81 +82 @@
         set_log_level(config, "access", self.log)
 
-        if config.has_option("access", "accessdb"):
-            self.read_access(config.get("access", "accessdb"))
-
-        # Add the ownership attributes to the authorizer.  Note that the
-        # indices of the allocation dict are strings, but the attributes are
-        # fedids, so there is a conversion.
-        self.state_lock.acquire()
-        for k in self.state.keys():
-            for o in self.state[k].get('owners', []):
-                self.auth.set_attribute(o, fedid(hexstr=k))
-            self.auth.set_attribute(fedid(hexstr=k),fedid(hexstr=k))
-            # If the allocation has a vlan assigned, remove it from the
-            # available vlans
-            v = self.state[k].get('vlan', None)
-            if v:
-                self.vlans.discard(v)
-        self.state_lock.release()
-
-        self.lookup_access = self.lookup_access_base
+
+        # authorization information
+        self.auth_type = config.get('access', 'auth_type') \
+                or 'legacy'
+        self.auth_dir = config.get('access', 'auth_dir')
+        accessdb = config.get("access", "accessdb")
+        # initialize the authorization system
+        if self.auth_type == 'legacy':
+            self.access = { }
+            if accessdb:
+                self.legacy_read_access(accessdb)
+        elif self.auth_type == 'abac':
+            self.auth = abac_authorizer(load=self.auth_dir)
+            self.access = [ ]
+            if accessdb:
+                self.read_access(accessdb, default=[('access', None)])
+        else:
+            raise service_error(service_error.internal, 
+                    "Unknown auth_type: %s" % self.auth_type)
+
+        if self.auth_type == 'legacy':
+            # Add the ownership attributes to the authorizer.  Note that the
+            # indices of the allocation dict are strings, but the attributes are
+            # fedids, so there is a conversion.
+            self.state_lock.acquire()
+            for k in self.state.keys():
+                for o in self.state[k].get('owners', []):
+                    self.auth.set_attribute(o, fedid(hexstr=k))
+                self.auth.set_attribute(fedid(hexstr=k),fedid(hexstr=k))
+                # If the allocation has a vlan assigned, remove it from the
+                # available vlans
+                v = self.state[k].get('vlan', None)
+                if v:
+                    self.vlans.discard(v)
+            self.state_lock.release()
+
+            self.lookup_access = self.legacy_lookup_access_base
+        # under ABAC we use access.lookup_access
+
 
         self.call_GetValue= service_caller('GetValue')
@@ -135 +156 @@
             raise service_error(service_error.req, "No request!?")
 
-        found, match = self.lookup_access(req, fid)
+        found, match, owners = self.lookup_access(req, fid)
         # keep track of what's been added
         allocID, alloc_cert = generate_fedid(subj="alloc", log=self.log)
@@ -143 +164 @@
         self.state[aid] = { }
         self.state[aid]['user'] = found
-        self.state[aid]['owners'] = [ fid ]
+        self.state[aid]['owners'] = owners
         self.state[aid]['vlan'] = None
         self.write_state()
@@ -149 +170 @@
         self.auth.set_attribute(fid, allocID)
         self.auth.set_attribute(allocID, allocID)
+        self.auth.save()
 
         try: