+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'gpg'", optional = False),
+ 'name': Parameter(str, "Peer or user name", optional = False),
+ 'signature': Parameter(str, "Message signature", optional = False)
+ })
+
+ def check(self, method, auth, *args):
+ try:
+ peers = Peers(method.api, [auth['name']])
+ if peers:
+ if 'peer' not in method.roles:
+ raise PLCAuthenticationFailure, "GPGAuth: Not allowed to call method, missing 'peer' role"
+
+ method.caller = peer = peers[0]
+ gpg_keys = [ peer['key'] ]
+ else:
+ persons = Persons(method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None})
+ if not persons:
+ raise PLCAuthenticationFailure, "GPGAuth: No such user '%s'" % auth['name']
+
+ method.caller = person = persons[0]
+ if not set(person['roles']).intersection(method.roles):
+ raise PLCAuthenticationFailure, "GPGAuth: Not allowed to call method, missing role"
+
+ keys = Keys(method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None})
+ gpg_keys = [ key['key'] for key in keys ]
+
+ if not gpg_keys:
+ raise PLCAuthenticationFailure, "GPGAuth: No GPG key on record for peer or user '%s'"%auth['name']
+
+ for gpg_key in gpg_keys:
+ try:
+ from PLC.GPG import gpg_verify
+ gpg_verify(args, gpg_key, auth['signature'], method.name)
+ return
+ except PLCAuthenticationFailure, fault:
+ pass
+
+ raise fault
+
+ except PLCAuthenticationFailure, fault:
+ # XXX Send e-mail
+ raise fault
+
+class SessionAuth(Auth):
+ """
+ Secondary authentication method. After authenticating with a
+ primary authentication method, call GetSession() to generate a
+ session key that may be used for subsequent calls.
+ """
+
+ def __init__(self):
+ Auth.__init__(self, {
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'session'", optional = False),