Changeset e83f2f2 for fedd/federation/access.py

Timestamp:

Dec 14, 2010 6:58:28 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

c092b7f

Parents:

2627eb3

Message:

Move proofs around. Lots of changes, including fault handling.

File:

• fedd/federation/access.py (modified) (7 diffs)

fedd/federation/access.py

@@ -301 +301 @@
         # Check every attribute that we know how to map and take the first
         # success.
+        fail_proofs = [ ]
         for attr in check:
-            if self.auth.check_attribute(fid, attr.attr):
+            access_ok, proof = self.auth.check_attribute(fid, attr.attr,
+                    with_proof=True)
+            if access_ok:
                 self.log.debug("Access succeeded for %s %s" % (attr.attr, fid))
                 # XXX: needs to deal with dynamics
                 return copy.copy(attr.value), (False, False, False), \
-                        [ fid ]
+                        [ fid ], proof
             else:
+                fail_proofs.append(proof)
                 self.log.debug("Access failed for %s %s" % (attr.attr, fid))
         else:
-            raise service_error(service_error.access, "Access denied")
+            raise service_error(service_error.access, "Access denied",
+                    proof=fail_proofs)
 
 
@@ -448 +453 @@
         return (exp, state)
 
-    def build_access_response(self, alloc_id, ap, services):
+    def build_access_response(self, alloc_id, ap, services, proof):
         """
         Create the SOAP response.
@@ -461 +466 @@
         msg = { 
                 'allocID': alloc_id,
+                'proof': proof.to_dict(),
                 'fedAttr': [
                     { 'attribute': 'domain', 'value': self.domain } , 
@@ -789 +795 @@
         # exception denying access that triggers a fault response back to the
         # caller.
-        found, match, owners = self.lookup_access(req, fid)
+        found, match, owners, proof = self.lookup_access(req, fid)
         self.log.info(
                 "[RequestAccess] Access granted to %s with local creds %s" % \
@@ -819 +825 @@
                     "Can't open %s/%s : %s" % (self.certdir, aid, e))
         self.log.debug('[RequestAccess] Returning allocation ID: %s' % allocID)
-        return { 'allocID': { 'fedid': allocID } }
+        return { 'allocID': { 'fedid': allocID }, 'proof': proof.to_dict() }
 
     def ReleaseAccess(self, req, fid):
@@ -849 +855 @@
         self.log.debug("[ReleaseAccess] deallocation requested for %s", aid)
         #  Confirm access
-        if not self.auth.check_attribute(fid, auth_attr):
+        access_ok, proof = self.auth.check_attribute(fid, auth_attr, 
+                with_proof=True)
+        if not access_ok:
             self.log.debug("[ReleaseAccess] deallocation denied for %s", aid)
-            raise service_error(service_error.access, "Access Denied")
+            raise service_error(service_error.access, "Access Denied",
+                    proof=proof)
 
         # If there is an allocation in the state, delete it.  Note the locking.
@@ -865 +874 @@
             self.log.debug("[ReleaseAccess] Removing %s" % cf)
             os.remove(cf)
-            return { 'allocID': req['allocID'] } 
+            return { 'allocID': req['allocID'], 'proof': proof.to_dict() } 
         else:
             self.state_lock.release()