Changeset e83f2f2 for fedd/federation/authorizer.py

Timestamp:

Dec 14, 2010 6:58:28 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

c092b7f

Parents:

2627eb3

Message:

Move proofs around. Lots of changes, including fault handling.

File:

• fedd/federation/authorizer.py (modified) (7 diffs)

fedd/federation/authorizer.py

@@ -1 +1 @@
 #/usr/local/bin/python
 
-from string import join
 from tempfile import mkstemp
 from subprocess import call
@@ -12 +11 @@
 from service_error import service_error
 from util import abac_pem_type, abac_split_cert
+from proof import proof
 
 
@@ -116 +116 @@
         if attrs: attrs.discard(attr)
 
-    def check_attribute(self, name, attr):
+    def check_attribute(self, name, attr, with_proof=False):
         """
         Return True if name has attr (or if attr is global).  Tuple names match
@@ -130 +130 @@
         self.valid_name(name)
         if attr in self.globals:
-            return True
+            if with_proof: return True, proof("me", name, attr)
+            else: return True
 
         if isinstance(name, tuple):
@@ -137 +138 @@
                 if self.attrs.has_key(lookup):
                     if attr in self.attrs[lookup]:
-                        return True
-        else:
-            return  attr in self.attrs.get(self.auth_name(name), set())
+                        if with_proof: return True, proof("me", name, attr)
+                        else: return True
+                # Drop through
+                if with_proof: return False, proof("me", name, attr)
+                else: return False
+        else:
+            if with_proof:
+                return attr in self.attrs.get(self.auth_name(name), set()), \
+                        proof("me", name, attr)
+            else:
+                return attr in self.attrs.get(self.auth_name(name), set())
 
     def set_global_attribute(self, attr):
@@ -375 +384 @@
 
 
-    def check_attribute(self, name, attr):
-        # XXX proof soon
+    def check_attribute(self, name, attr, with_proof=False):
         if isinstance(name, tuple):
             raise abac_authorizer.bad_name(
@@ -399 +407 @@
             # Sigh. Unicode vs swig and swig seems to lose.  Make sure
             # everything we pass into ABAC is a str not a unicode.
-            rv, proof = self.context.query(a, n)
+            rv, p = self.context.query(a, n)
             # XXX delete soon
-            if not rv and attr in self.globals: rv = True
-            self.lock.release()
-
-            return rv
+            if not rv and attr in self.globals: 
+                rv = True
+                p = None
+            self.lock.release()
+            if with_proof: return rv, proof(self.fedid, name, a, p)
+            else: return rv
 
     def set_global_attribute(self, attr):