+ def __init__(self, auth=None):
+ if auth is None:
+ auth = {'AuthMethod': Parameter(str, "Authentication method to use",
+ optional=False)}
+ Parameter.__init__(self, auth, "API authentication structure")
+
+ def check(self, method, auth, *args):
+ global auth_methods
+
+ # Method.type_check() should have checked that all of the
+ # mandatory fields were present.
+ assert 'AuthMethod' in auth
+
+ if auth['AuthMethod'] in auth_methods:
+ expected = auth_methods[auth['AuthMethod']]()
+ else:
+ sm = "'" + "', '".join(list(auth_methods.keys())) + "'"
+ raise PLCInvalidArgument("must be " + sm, "AuthMethod")
+
+ # Re-check using the specified authentication method
+ method.type_check("auth", auth, expected, (auth,) + args)
+
+
+class GPGAuth(Auth):
+ """
+ Proposed PlanetLab federation authentication structure.
+ """
+
+ def __init__(self):
+ Auth.__init__(self, {
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'gpg'", optional=False),
+ 'name': Parameter(str, "Peer or user name", optional=False),
+ 'signature': Parameter(str, "Message signature", optional=False)
+ })
+
+ def check(self, method, auth, *args):
+ try:
+ peers = Peers(method.api, [auth['name']])
+ if peers:
+ if 'peer' not in method.roles:
+ raise PLCAuthenticationFailure(
+ "GPGAuth: Not allowed to call method, missing 'peer' role")
+
+ method.caller = peer = peers[0]
+ gpg_keys = [peer['key']]
+ else:
+ persons = Persons(
+ method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None})
+ if not persons:
+ raise PLCAuthenticationFailure(
+ "GPGAuth: No such user '%s'" % auth['name'])
+
+ method.caller = person = persons[0]
+ if not set(person['roles']).intersection(method.roles):
+ raise PLCAuthenticationFailure(
+ "GPGAuth: Not allowed to call method, missing role")
+
+ keys = Keys(
+ method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None})
+ gpg_keys = [key['key'] for key in keys]
+
+ if not gpg_keys:
+ raise PLCAuthenticationFailure(
+ "GPGAuth: No GPG key on record for peer or user '%s'" % auth['name'])
+
+ for gpg_key in gpg_keys:
+ try:
+ from PLC.GPG import gpg_verify
+ gpg_verify(args, gpg_key, auth['signature'], method.name)
+ return
+ except PLCAuthenticationFailure as fault:
+ pass
+
+ raise fault
+
+ except PLCAuthenticationFailure as fault:
+ # XXX Send e-mail
+ raise fault
+
+
+class SessionAuth(Auth):
+ """
+ Secondary authentication method. After authenticating with a
+ primary authentication method, call GetSession() to generate a
+ session key that may be used for subsequent calls.
+ """
+
+ def __init__(self):
+ Auth.__init__(self, {
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'session'", optional=False),
+ 'session': Parameter(str, "Session key", optional=False)
+ })
+
+ def check(self, method, auth, *args):
+ # Method.type_check() should have checked that all of the
+ # mandatory fields were present.
+ assert 'session' in auth
+
+ # Get session record
+ sessions = Sessions(method.api, [auth['session']], expires=None)
+ if not sessions:
+ raise PLCAuthenticationFailure("SessionAuth: No such session")
+ session = sessions[0]
+
+ try:
+ if session['node_id'] is not None:
+ nodes = Nodes(
+ method.api, {'node_id': session['node_id'], 'peer_id': None})
+ if not nodes:
+ raise PLCAuthenticationFailure("SessionAuth: No such node")
+ node = nodes[0]
+
+ if 'node' not in method.roles:
+ # using PermissionDenied rather than AuthenticationFailure here because
+ # if that fails we don't want to delete the session..
+ raise PLCPermissionDenied(
+ "SessionAuth: Not allowed to call method %s, missing 'node' role" % method.name)
+
+ method.caller = node
+
+ elif session['person_id'] is not None and session['expires'] > time.time():
+ persons = Persons(method.api, {
+ 'person_id': session['person_id'], 'enabled': True, 'peer_id': None})
+ if not persons:
+ raise PLCAuthenticationFailure(
+ "SessionAuth: No such enabled account")
+ person = persons[0]
+
+ if not set(person['roles']).intersection(method.roles):
+ method_message = "method %s has roles [%s]" % (
+ method.name, ','.join(method.roles))
+ person_message = "caller %s has roles [%s]" % (
+ person['email'], ','.join(person['roles']))
+ # not PLCAuthenticationFailure b/c that would end the session..
+ raise PLCPermissionDenied(
+ "SessionAuth: missing role, %s -- %s" % (method_message, person_message))